From eb6031282a3ee50df2a2aa8403448a3e35941d33 Mon Sep 17 00:00:00 2001
From: Rayyan <60314224+RayyanHermanto@users.noreply.github.com>
Date: Sun, 2 Aug 2026 20:01:29 +0700
Subject: [PATCH] fix npm run build

---
 dist/app.module.js                            |  37 +++
 dist/app.module.js.map                        |   1 +
 dist/common/constants/permission.constants.js |  18 ++
 .../constants/permission.constants.js.map     |   1 +
 dist/core/auth/guards/jwt-auth.guard.js       | 106 +++++++++
 dist/core/auth/guards/jwt-auth.guard.js.map   |   1 +
 .../authenticated-request.interface.js        |   3 +
 .../authenticated-request.interface.js.map    |   1 +
 dist/core/auth/interfaces/identity-data.js    |  17 ++
 .../core/auth/interfaces/identity-data.js.map |   1 +
 dist/core/config/database.config.js           |  13 ++
 dist/core/config/database.config.js.map       |   1 +
 dist/core/event-bus/event-bus.service.js      |  36 +++
 dist/core/event-bus/event-bus.service.js.map  |   1 +
 dist/core/event-bus/event.interface.js        |   3 +
 dist/core/event-bus/event.interface.js.map    |   1 +
 dist/core/events/event-dispatcher.js          |  14 ++
 dist/core/events/event-dispatcher.js.map      |   1 +
 dist/core/events/event-handler.js             |   3 +
 dist/core/events/event-handler.js.map         |   1 +
 dist/core/events/event-publisher.js           |  14 ++
 dist/core/events/event-publisher.js.map       |   1 +
 dist/core/events/event.interface.js           |   3 +
 dist/core/events/event.interface.js.map       |   1 +
 dist/core/exceptions/http-exception.filter.js |  29 +++
 .../exceptions/http-exception.filter.js.map   |   1 +
 dist/core/logger/logger.service.js            |  11 +
 dist/core/logger/logger.service.js.map        |   1 +
 dist/core/middleware/request-id.middleware.js |  23 ++
 .../middleware/request-id.middleware.js.map   |   1 +
 dist/main.js                                  |  34 +++
 dist/main.js.map                              |   1 +
 .../modules/application/application.module.js |  50 ++++
 .../application/application.module.js.map     |   1 +
 .../handlers/create-application.handler.js    |  44 ++++
 .../create-application.handler.js.map         |   1 +
 .../handlers/delete-application.handler.js    |  31 +++
 .../delete-application.handler.js.map         |   1 +
 .../handlers/get-application.handler.js       |  30 +++
 .../handlers/get-application.handler.js.map   |   1 +
 .../handlers/get-applications.handler.js      |  30 +++
 .../handlers/get-applications.handler.js.map  |   1 +
 .../handlers/get-me-applications.handler.js   |  35 +++
 .../get-me-applications.handler.js.map        |   1 +
 .../handlers/update-application.handler.js    |  38 +++
 .../update-application.handler.js.map         |   1 +
 .../validators/application.validator.js       |  84 +++++++
 .../validators/application.validator.js.map   |   1 +
 .../domain/entities/application.entity.js     |  67 ++++++
 .../domain/entities/application.entity.js.map |   1 +
 .../repositories/application.interface.js     |   7 +
 .../repositories/application.interface.js.map |   1 +
 .../mappers/prisma-application.mapper.js      |  23 ++
 .../mappers/prisma-application.mapper.js.map  |   1 +
 .../prisma-application.repository.js          |  98 ++++++++
 .../prisma-application.repository.js.map      |   1 +
 .../controllers/applications.controller.js    | 136 +++++++++++
 .../applications.controller.js.map            |   1 +
 dist/modules/audit/audit.event-handler.js     |  65 ++++++
 dist/modules/audit/audit.event-handler.js.map |   1 +
 dist/modules/audit/audit.module.js            |  24 ++
 dist/modules/audit/audit.module.js.map        |   1 +
 dist/modules/audit/audit.service.js           |  46 ++++
 dist/modules/audit/audit.service.js.map       |   1 +
 dist/modules/auth/auth.controller.js          | 110 +++++++++
 dist/modules/auth/auth.controller.js.map      |   1 +
 dist/modules/auth/auth.module.js              |  75 ++++++
 dist/modules/auth/auth.module.js.map          |   1 +
 dist/modules/auth/auth.service.js             | 209 +++++++++++++++++
 dist/modules/auth/auth.service.js.map         |   1 +
 dist/modules/auth/authentication.service.js   |  70 ++++++
 .../auth/authentication.service.js.map        |   1 +
 dist/modules/auth/dto/login.dto.js            |   4 +
 dist/modules/auth/dto/login.dto.js.map        |   1 +
 dist/modules/auth/group-hash.service.js       |  56 +++++
 dist/modules/auth/group-hash.service.js.map   |   1 +
 dist/modules/auth/guards/oidc.guard.js        |  48 ++++
 dist/modules/auth/guards/oidc.guard.js.map    |   1 +
 dist/modules/auth/oidc.service.js             |  89 ++++++++
 dist/modules/auth/oidc.service.js.map         |   1 +
 dist/modules/auth/pkce/redis-pkce.store.js    |  56 +++++
 .../modules/auth/pkce/redis-pkce.store.js.map |   1 +
 .../auth/refresh/inmemory-refresh.store.js    |  53 +++++
 .../refresh/inmemory-refresh.store.js.map     |   1 +
 dist/modules/auth/role-sync.service.js        |  88 +++++++
 dist/modules/auth/role-sync.service.js.map    |   1 +
 .../application/authorization.service.js      |   2 +
 .../application/authorization.service.js.map  |   1 +
 .../authorization/authorization.module.js     |  29 +++
 .../authorization/authorization.module.js.map |   1 +
 .../authorization/authorization.service.js    |  71 ++++++
 .../authorization.service.js.map              |   1 +
 .../cache/permission-cache.interface.js       |   3 +
 .../cache/permission-cache.interface.js.map   |   1 +
 .../cache/redis-permission-cache.service.js   |  48 ++++
 .../redis-permission-cache.service.js.map     |   1 +
 .../authorization/guards/permission.guard.js  |  52 +++++
 .../guards/permission.guard.js.map            |   1 +
 .../decorators/permission.decorator.js        |   7 +
 .../decorators/permission.decorator.js.map    |   1 +
 .../presentation/guards/permission.guard.js   |  46 ++++
 .../guards/permission.guard.js.map            |   1 +
 dist/modules/health/health.controller.js      |  35 +++
 dist/modules/health/health.controller.js.map  |   1 +
 dist/modules/health/health.module.js          |  23 ++
 dist/modules/health/health.module.js.map      |   1 +
 dist/modules/health/health.service.js         |  24 ++
 dist/modules/health/health.service.js.map     |   1 +
 .../application/config/env-auth-config.js     |  16 ++
 .../application/config/env-auth-config.js.map |   1 +
 .../application/config/i-auth-config.js       |   7 +
 .../application/config/i-auth-config.js.map   |   1 +
 .../permission/create-permission.handler.js   |  47 ++++
 .../create-permission.handler.js.map          |   1 +
 .../permission/delete-permission.handler.js   |  54 +++++
 .../delete-permission.handler.js.map          |   1 +
 .../permission/get-permission.handler.js      |  29 +++
 .../permission/get-permission.handler.js.map  |   1 +
 .../permission/get-permissions.handler.js     |  29 +++
 .../permission/get-permissions.handler.js.map |   1 +
 .../permission/update-permission.handler.js   |  58 +++++
 .../update-permission.handler.js.map          |   1 +
 .../role/assign-permission.handler.js         |  56 +++++
 .../role/assign-permission.handler.js.map     |   1 +
 .../handlers/role/create-role.handler.js      |  54 +++++
 .../handlers/role/create-role.handler.js.map  |   1 +
 .../handlers/role/delete-role.handler.js      |  45 ++++
 .../handlers/role/delete-role.handler.js.map  |   1 +
 .../handlers/role/get-role.handler.js         |  29 +++
 .../handlers/role/get-role.handler.js.map     |   1 +
 .../handlers/role/get-roles.handler.js        |  29 +++
 .../handlers/role/get-roles.handler.js.map    |   1 +
 .../role/remove-permission.handler.js         |  46 ++++
 .../role/remove-permission.handler.js.map     |   1 +
 .../handlers/role/update-role.handler.js      |  53 +++++
 .../handlers/role/update-role.handler.js.map  |   1 +
 .../user/assign-permission.handler.js         |  42 ++++
 .../user/assign-permission.handler.js.map     |   1 +
 .../handlers/user/assign-role.handler.js      |  40 ++++
 .../handlers/user/assign-role.handler.js.map  |   1 +
 .../handlers/user/create-user.handler.js      |  39 ++++
 .../handlers/user/create-user.handler.js.map  |   1 +
 .../handlers/user/delete-user.handler.js      |  32 +++
 .../handlers/user/delete-user.handler.js.map  |   1 +
 .../handlers/user/disable-user.handler.js     |  32 +++
 .../handlers/user/disable-user.handler.js.map |   1 +
 .../handlers/user/enable-user.handler.js      |  32 +++
 .../handlers/user/enable-user.handler.js.map  |   1 +
 .../handlers/user/get-current-user.handler.js |  21 ++
 .../user/get-current-user.handler.js.map      |   1 +
 .../handlers/user/get-user.handler.js         |  29 +++
 .../handlers/user/get-user.handler.js.map     |   1 +
 .../handlers/user/get-users.handler.js        |  37 +++
 .../handlers/user/get-users.handler.js.map    |   1 +
 .../user/remove-permission.handler.js         |  33 +++
 .../user/remove-permission.handler.js.map     |   1 +
 .../handlers/user/remove-role.handler.js      |  33 +++
 .../handlers/user/remove-role.handler.js.map  |   1 +
 .../handlers/user/restore-user.handler.js     |  32 +++
 .../handlers/user/restore-user.handler.js.map |   1 +
 .../handlers/user/sync-identity.handler.js    |  92 ++++++++
 .../user/sync-identity.handler.js.map         |   1 +
 .../handlers/user/update-user.handler.js      |  45 ++++
 .../handlers/user/update-user.handler.js.map  |   1 +
 .../application/services/user.service.js      |  37 +++
 .../application/services/user.service.js.map  |   1 +
 .../domain/entities/permission.entity.js      |  33 +++
 .../domain/entities/permission.entity.js.map  |   1 +
 .../identity/domain/entities/role.entity.js   |  51 +++++
 .../domain/entities/role.entity.js.map        |   1 +
 .../identity/domain/entities/user.entity.js   | 143 ++++++++++++
 .../domain/entities/user.entity.js.map        |   1 +
 .../domain/events/user-created.event.js       |  13 ++
 .../domain/events/user-created.event.js.map   |   1 +
 .../domain/events/user-disabled.event.js      |  13 ++
 .../domain/events/user-disabled.event.js.map  |   1 +
 .../domain/events/user-email-changed.event.js |  13 ++
 .../events/user-email-changed.event.js.map    |   1 +
 .../domain/events/user-enabled.event.js       |  13 ++
 .../domain/events/user-enabled.event.js.map   |   1 +
 .../events/user-username-changed.event.js     |  13 ++
 .../events/user-username-changed.event.js.map |   1 +
 .../repositories/permission.interface.js      |   7 +
 .../repositories/permission.interface.js.map  |   1 +
 .../domain/repositories/role.interface.js     |   7 +
 .../domain/repositories/role.interface.js.map |   1 +
 .../domain/repositories/user.interface.js     |   7 +
 .../domain/repositories/user.interface.js.map |   1 +
 dist/modules/identity/identity.module.js      | 113 +++++++++
 dist/modules/identity/identity.module.js.map  |   1 +
 .../mappers/prisma-permission.mapper.js       |  26 +++
 .../mappers/prisma-permission.mapper.js.map   |   1 +
 .../mappers/prisma-role.mapper.js             |  31 +++
 .../mappers/prisma-role.mapper.js.map         |   1 +
 .../mappers/prisma-user.mapper.js             |  69 ++++++
 .../mappers/prisma-user.mapper.js.map         |   1 +
 .../prisma-permission.repository.js           |  67 ++++++
 .../prisma-permission.repository.js.map       |   1 +
 .../repositories/prisma-role.repository.js    | 110 +++++++++
 .../prisma-role.repository.js.map             |   1 +
 .../repositories/prisma-user.repository.js    | 216 ++++++++++++++++++
 .../prisma-user.repository.js.map             |   1 +
 .../controllers/permissions.controller.js     | 119 ++++++++++
 .../controllers/permissions.controller.js.map |   1 +
 .../controllers/roles.controller.js           | 156 +++++++++++++
 .../controllers/roles.controller.js.map       |   1 +
 .../controllers/users.controller.js           | 173 ++++++++++++++
 .../controllers/users.controller.js.map       |   1 +
 .../presentation/dto/create-permission.dto.js |  39 ++++
 .../dto/create-permission.dto.js.map          |   1 +
 .../presentation/dto/create-role.dto.js       |  45 ++++
 .../presentation/dto/create-role.dto.js.map   |   1 +
 .../presentation/dto/create-user.dto.js       |  54 +++++
 .../presentation/dto/create-user.dto.js.map   |   1 +
 .../presentation/dto/update-permission.dto.js |  41 ++++
 .../dto/update-permission.dto.js.map          |   1 +
 .../presentation/dto/update-role.dto.js       |  40 ++++
 .../presentation/dto/update-role.dto.js.map   |   1 +
 .../presentation/dto/update-user.dto.js       |  63 +++++
 .../presentation/dto/update-user.dto.js.map   |   1 +
 .../presentation/guards/current-user.guard.js |  44 ++++
 .../guards/current-user.guard.js.map          |   1 +
 dist/shared/cache-keys.js                     |   7 +
 dist/shared/cache-keys.js.map                 |   1 +
 dist/shared/prisma.service.js                 |  24 ++
 dist/shared/prisma.service.js.map             |   1 +
 dist/shared/redis.service.js                  | 121 ++++++++++
 dist/shared/redis.service.js.map              |   1 +
 dist/shared/types/request-context.js          |   3 +
 dist/shared/types/request-context.js.map      |   1 +
 dist/shared/utils/index.js                    |   5 +
 dist/shared/utils/index.js.map                |   1 +
 prisma/schema.prisma                          |  66 ++++--
 src/modules/auth/auth.service.ts              |  16 +-
 .../mappers/prisma-role.mapper.ts             |  19 +-
 .../repositories/prisma-role.repository.ts    |  10 +-
 236 files changed, 5557 insertions(+), 47 deletions(-)
 create mode 100644 dist/app.module.js
 create mode 100644 dist/app.module.js.map
 create mode 100644 dist/common/constants/permission.constants.js
 create mode 100644 dist/common/constants/permission.constants.js.map
 create mode 100644 dist/core/auth/guards/jwt-auth.guard.js
 create mode 100644 dist/core/auth/guards/jwt-auth.guard.js.map
 create mode 100644 dist/core/auth/interfaces/authenticated-request.interface.js
 create mode 100644 dist/core/auth/interfaces/authenticated-request.interface.js.map
 create mode 100644 dist/core/auth/interfaces/identity-data.js
 create mode 100644 dist/core/auth/interfaces/identity-data.js.map
 create mode 100644 dist/core/config/database.config.js
 create mode 100644 dist/core/config/database.config.js.map
 create mode 100644 dist/core/event-bus/event-bus.service.js
 create mode 100644 dist/core/event-bus/event-bus.service.js.map
 create mode 100644 dist/core/event-bus/event.interface.js
 create mode 100644 dist/core/event-bus/event.interface.js.map
 create mode 100644 dist/core/events/event-dispatcher.js
 create mode 100644 dist/core/events/event-dispatcher.js.map
 create mode 100644 dist/core/events/event-handler.js
 create mode 100644 dist/core/events/event-handler.js.map
 create mode 100644 dist/core/events/event-publisher.js
 create mode 100644 dist/core/events/event-publisher.js.map
 create mode 100644 dist/core/events/event.interface.js
 create mode 100644 dist/core/events/event.interface.js.map
 create mode 100644 dist/core/exceptions/http-exception.filter.js
 create mode 100644 dist/core/exceptions/http-exception.filter.js.map
 create mode 100644 dist/core/logger/logger.service.js
 create mode 100644 dist/core/logger/logger.service.js.map
 create mode 100644 dist/core/middleware/request-id.middleware.js
 create mode 100644 dist/core/middleware/request-id.middleware.js.map
 create mode 100644 dist/main.js
 create mode 100644 dist/main.js.map
 create mode 100644 dist/modules/application/application.module.js
 create mode 100644 dist/modules/application/application.module.js.map
 create mode 100644 dist/modules/application/application/handlers/create-application.handler.js
 create mode 100644 dist/modules/application/application/handlers/create-application.handler.js.map
 create mode 100644 dist/modules/application/application/handlers/delete-application.handler.js
 create mode 100644 dist/modules/application/application/handlers/delete-application.handler.js.map
 create mode 100644 dist/modules/application/application/handlers/get-application.handler.js
 create mode 100644 dist/modules/application/application/handlers/get-application.handler.js.map
 create mode 100644 dist/modules/application/application/handlers/get-applications.handler.js
 create mode 100644 dist/modules/application/application/handlers/get-applications.handler.js.map
 create mode 100644 dist/modules/application/application/handlers/get-me-applications.handler.js
 create mode 100644 dist/modules/application/application/handlers/get-me-applications.handler.js.map
 create mode 100644 dist/modules/application/application/handlers/update-application.handler.js
 create mode 100644 dist/modules/application/application/handlers/update-application.handler.js.map
 create mode 100644 dist/modules/application/application/validators/application.validator.js
 create mode 100644 dist/modules/application/application/validators/application.validator.js.map
 create mode 100644 dist/modules/application/domain/entities/application.entity.js
 create mode 100644 dist/modules/application/domain/entities/application.entity.js.map
 create mode 100644 dist/modules/application/domain/repositories/application.interface.js
 create mode 100644 dist/modules/application/domain/repositories/application.interface.js.map
 create mode 100644 dist/modules/application/infrastructure/mappers/prisma-application.mapper.js
 create mode 100644 dist/modules/application/infrastructure/mappers/prisma-application.mapper.js.map
 create mode 100644 dist/modules/application/infrastructure/repositories/prisma-application.repository.js
 create mode 100644 dist/modules/application/infrastructure/repositories/prisma-application.repository.js.map
 create mode 100644 dist/modules/application/presentation/controllers/applications.controller.js
 create mode 100644 dist/modules/application/presentation/controllers/applications.controller.js.map
 create mode 100644 dist/modules/audit/audit.event-handler.js
 create mode 100644 dist/modules/audit/audit.event-handler.js.map
 create mode 100644 dist/modules/audit/audit.module.js
 create mode 100644 dist/modules/audit/audit.module.js.map
 create mode 100644 dist/modules/audit/audit.service.js
 create mode 100644 dist/modules/audit/audit.service.js.map
 create mode 100644 dist/modules/auth/auth.controller.js
 create mode 100644 dist/modules/auth/auth.controller.js.map
 create mode 100644 dist/modules/auth/auth.module.js
 create mode 100644 dist/modules/auth/auth.module.js.map
 create mode 100644 dist/modules/auth/auth.service.js
 create mode 100644 dist/modules/auth/auth.service.js.map
 create mode 100644 dist/modules/auth/authentication.service.js
 create mode 100644 dist/modules/auth/authentication.service.js.map
 create mode 100644 dist/modules/auth/dto/login.dto.js
 create mode 100644 dist/modules/auth/dto/login.dto.js.map
 create mode 100644 dist/modules/auth/group-hash.service.js
 create mode 100644 dist/modules/auth/group-hash.service.js.map
 create mode 100644 dist/modules/auth/guards/oidc.guard.js
 create mode 100644 dist/modules/auth/guards/oidc.guard.js.map
 create mode 100644 dist/modules/auth/oidc.service.js
 create mode 100644 dist/modules/auth/oidc.service.js.map
 create mode 100644 dist/modules/auth/pkce/redis-pkce.store.js
 create mode 100644 dist/modules/auth/pkce/redis-pkce.store.js.map
 create mode 100644 dist/modules/auth/refresh/inmemory-refresh.store.js
 create mode 100644 dist/modules/auth/refresh/inmemory-refresh.store.js.map
 create mode 100644 dist/modules/auth/role-sync.service.js
 create mode 100644 dist/modules/auth/role-sync.service.js.map
 create mode 100644 dist/modules/authorization/application/authorization.service.js
 create mode 100644 dist/modules/authorization/application/authorization.service.js.map
 create mode 100644 dist/modules/authorization/authorization.module.js
 create mode 100644 dist/modules/authorization/authorization.module.js.map
 create mode 100644 dist/modules/authorization/authorization.service.js
 create mode 100644 dist/modules/authorization/authorization.service.js.map
 create mode 100644 dist/modules/authorization/cache/permission-cache.interface.js
 create mode 100644 dist/modules/authorization/cache/permission-cache.interface.js.map
 create mode 100644 dist/modules/authorization/cache/redis-permission-cache.service.js
 create mode 100644 dist/modules/authorization/cache/redis-permission-cache.service.js.map
 create mode 100644 dist/modules/authorization/guards/permission.guard.js
 create mode 100644 dist/modules/authorization/guards/permission.guard.js.map
 create mode 100644 dist/modules/authorization/presentation/decorators/permission.decorator.js
 create mode 100644 dist/modules/authorization/presentation/decorators/permission.decorator.js.map
 create mode 100644 dist/modules/authorization/presentation/guards/permission.guard.js
 create mode 100644 dist/modules/authorization/presentation/guards/permission.guard.js.map
 create mode 100644 dist/modules/health/health.controller.js
 create mode 100644 dist/modules/health/health.controller.js.map
 create mode 100644 dist/modules/health/health.module.js
 create mode 100644 dist/modules/health/health.module.js.map
 create mode 100644 dist/modules/health/health.service.js
 create mode 100644 dist/modules/health/health.service.js.map
 create mode 100644 dist/modules/identity/application/config/env-auth-config.js
 create mode 100644 dist/modules/identity/application/config/env-auth-config.js.map
 create mode 100644 dist/modules/identity/application/config/i-auth-config.js
 create mode 100644 dist/modules/identity/application/config/i-auth-config.js.map
 create mode 100644 dist/modules/identity/application/handlers/permission/create-permission.handler.js
 create mode 100644 dist/modules/identity/application/handlers/permission/create-permission.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/permission/delete-permission.handler.js
 create mode 100644 dist/modules/identity/application/handlers/permission/delete-permission.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/permission/get-permission.handler.js
 create mode 100644 dist/modules/identity/application/handlers/permission/get-permission.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/permission/get-permissions.handler.js
 create mode 100644 dist/modules/identity/application/handlers/permission/get-permissions.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/permission/update-permission.handler.js
 create mode 100644 dist/modules/identity/application/handlers/permission/update-permission.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/role/assign-permission.handler.js
 create mode 100644 dist/modules/identity/application/handlers/role/assign-permission.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/role/create-role.handler.js
 create mode 100644 dist/modules/identity/application/handlers/role/create-role.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/role/delete-role.handler.js
 create mode 100644 dist/modules/identity/application/handlers/role/delete-role.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/role/get-role.handler.js
 create mode 100644 dist/modules/identity/application/handlers/role/get-role.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/role/get-roles.handler.js
 create mode 100644 dist/modules/identity/application/handlers/role/get-roles.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/role/remove-permission.handler.js
 create mode 100644 dist/modules/identity/application/handlers/role/remove-permission.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/role/update-role.handler.js
 create mode 100644 dist/modules/identity/application/handlers/role/update-role.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/user/assign-permission.handler.js
 create mode 100644 dist/modules/identity/application/handlers/user/assign-permission.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/user/assign-role.handler.js
 create mode 100644 dist/modules/identity/application/handlers/user/assign-role.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/user/create-user.handler.js
 create mode 100644 dist/modules/identity/application/handlers/user/create-user.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/user/delete-user.handler.js
 create mode 100644 dist/modules/identity/application/handlers/user/delete-user.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/user/disable-user.handler.js
 create mode 100644 dist/modules/identity/application/handlers/user/disable-user.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/user/enable-user.handler.js
 create mode 100644 dist/modules/identity/application/handlers/user/enable-user.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/user/get-current-user.handler.js
 create mode 100644 dist/modules/identity/application/handlers/user/get-current-user.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/user/get-user.handler.js
 create mode 100644 dist/modules/identity/application/handlers/user/get-user.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/user/get-users.handler.js
 create mode 100644 dist/modules/identity/application/handlers/user/get-users.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/user/remove-permission.handler.js
 create mode 100644 dist/modules/identity/application/handlers/user/remove-permission.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/user/remove-role.handler.js
 create mode 100644 dist/modules/identity/application/handlers/user/remove-role.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/user/restore-user.handler.js
 create mode 100644 dist/modules/identity/application/handlers/user/restore-user.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/user/sync-identity.handler.js
 create mode 100644 dist/modules/identity/application/handlers/user/sync-identity.handler.js.map
 create mode 100644 dist/modules/identity/application/handlers/user/update-user.handler.js
 create mode 100644 dist/modules/identity/application/handlers/user/update-user.handler.js.map
 create mode 100644 dist/modules/identity/application/services/user.service.js
 create mode 100644 dist/modules/identity/application/services/user.service.js.map
 create mode 100644 dist/modules/identity/domain/entities/permission.entity.js
 create mode 100644 dist/modules/identity/domain/entities/permission.entity.js.map
 create mode 100644 dist/modules/identity/domain/entities/role.entity.js
 create mode 100644 dist/modules/identity/domain/entities/role.entity.js.map
 create mode 100644 dist/modules/identity/domain/entities/user.entity.js
 create mode 100644 dist/modules/identity/domain/entities/user.entity.js.map
 create mode 100644 dist/modules/identity/domain/events/user-created.event.js
 create mode 100644 dist/modules/identity/domain/events/user-created.event.js.map
 create mode 100644 dist/modules/identity/domain/events/user-disabled.event.js
 create mode 100644 dist/modules/identity/domain/events/user-disabled.event.js.map
 create mode 100644 dist/modules/identity/domain/events/user-email-changed.event.js
 create mode 100644 dist/modules/identity/domain/events/user-email-changed.event.js.map
 create mode 100644 dist/modules/identity/domain/events/user-enabled.event.js
 create mode 100644 dist/modules/identity/domain/events/user-enabled.event.js.map
 create mode 100644 dist/modules/identity/domain/events/user-username-changed.event.js
 create mode 100644 dist/modules/identity/domain/events/user-username-changed.event.js.map
 create mode 100644 dist/modules/identity/domain/repositories/permission.interface.js
 create mode 100644 dist/modules/identity/domain/repositories/permission.interface.js.map
 create mode 100644 dist/modules/identity/domain/repositories/role.interface.js
 create mode 100644 dist/modules/identity/domain/repositories/role.interface.js.map
 create mode 100644 dist/modules/identity/domain/repositories/user.interface.js
 create mode 100644 dist/modules/identity/domain/repositories/user.interface.js.map
 create mode 100644 dist/modules/identity/identity.module.js
 create mode 100644 dist/modules/identity/identity.module.js.map
 create mode 100644 dist/modules/identity/infrastructure/mappers/prisma-permission.mapper.js
 create mode 100644 dist/modules/identity/infrastructure/mappers/prisma-permission.mapper.js.map
 create mode 100644 dist/modules/identity/infrastructure/mappers/prisma-role.mapper.js
 create mode 100644 dist/modules/identity/infrastructure/mappers/prisma-role.mapper.js.map
 create mode 100644 dist/modules/identity/infrastructure/mappers/prisma-user.mapper.js
 create mode 100644 dist/modules/identity/infrastructure/mappers/prisma-user.mapper.js.map
 create mode 100644 dist/modules/identity/infrastructure/repositories/prisma-permission.repository.js
 create mode 100644 dist/modules/identity/infrastructure/repositories/prisma-permission.repository.js.map
 create mode 100644 dist/modules/identity/infrastructure/repositories/prisma-role.repository.js
 create mode 100644 dist/modules/identity/infrastructure/repositories/prisma-role.repository.js.map
 create mode 100644 dist/modules/identity/infrastructure/repositories/prisma-user.repository.js
 create mode 100644 dist/modules/identity/infrastructure/repositories/prisma-user.repository.js.map
 create mode 100644 dist/modules/identity/presentation/controllers/permissions.controller.js
 create mode 100644 dist/modules/identity/presentation/controllers/permissions.controller.js.map
 create mode 100644 dist/modules/identity/presentation/controllers/roles.controller.js
 create mode 100644 dist/modules/identity/presentation/controllers/roles.controller.js.map
 create mode 100644 dist/modules/identity/presentation/controllers/users.controller.js
 create mode 100644 dist/modules/identity/presentation/controllers/users.controller.js.map
 create mode 100644 dist/modules/identity/presentation/dto/create-permission.dto.js
 create mode 100644 dist/modules/identity/presentation/dto/create-permission.dto.js.map
 create mode 100644 dist/modules/identity/presentation/dto/create-role.dto.js
 create mode 100644 dist/modules/identity/presentation/dto/create-role.dto.js.map
 create mode 100644 dist/modules/identity/presentation/dto/create-user.dto.js
 create mode 100644 dist/modules/identity/presentation/dto/create-user.dto.js.map
 create mode 100644 dist/modules/identity/presentation/dto/update-permission.dto.js
 create mode 100644 dist/modules/identity/presentation/dto/update-permission.dto.js.map
 create mode 100644 dist/modules/identity/presentation/dto/update-role.dto.js
 create mode 100644 dist/modules/identity/presentation/dto/update-role.dto.js.map
 create mode 100644 dist/modules/identity/presentation/dto/update-user.dto.js
 create mode 100644 dist/modules/identity/presentation/dto/update-user.dto.js.map
 create mode 100644 dist/modules/identity/presentation/guards/current-user.guard.js
 create mode 100644 dist/modules/identity/presentation/guards/current-user.guard.js.map
 create mode 100644 dist/shared/cache-keys.js
 create mode 100644 dist/shared/cache-keys.js.map
 create mode 100644 dist/shared/prisma.service.js
 create mode 100644 dist/shared/prisma.service.js.map
 create mode 100644 dist/shared/redis.service.js
 create mode 100644 dist/shared/redis.service.js.map
 create mode 100644 dist/shared/types/request-context.js
 create mode 100644 dist/shared/types/request-context.js.map
 create mode 100644 dist/shared/utils/index.js
 create mode 100644 dist/shared/utils/index.js.map

diff --git a/dist/app.module.js b/dist/app.module.js
new file mode 100644
index 0000000..ba0f573
--- /dev/null
+++ b/dist/app.module.js
@@ -0,0 +1,37 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AppModule = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const identity_module_1 = require("./modules/identity/identity.module");
+const auth_module_1 = require("./modules/auth/auth.module");
+const health_module_1 = require("./modules/health/health.module");
+const authorization_module_1 = require("./modules/authorization/authorization.module");
+const audit_module_1 = require("./modules/audit/audit.module");
+const application_module_1 = require("./modules/application/application.module");
+let AppModule = class AppModule {
+};
+exports.AppModule = AppModule;
+exports.AppModule = AppModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            config_1.ConfigModule.forRoot({
+                isGlobal: true,
+            }),
+            identity_module_1.IdentityModule,
+            auth_module_1.AuthModule,
+            health_module_1.HealthModule,
+            // Authorization module provides permission checks and cache
+            authorization_module_1.AuthorizationModule,
+            audit_module_1.AuditModule,
+            application_module_1.ApplicationModule,
+        ],
+    })
+], AppModule);
+//# sourceMappingURL=app.module.js.map
\ No newline at end of file
diff --git a/dist/app.module.js.map b/dist/app.module.js.map
new file mode 100644
index 0000000..4fef502
--- /dev/null
+++ b/dist/app.module.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"app.module.js","sourceRoot":"","sources":["../src/app.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,2CAA8C;AAE9C,wEAAoE;AACpE,4DAAwD;AACxD,kEAA8D;AAC9D,uFAAmF;AACnF,+DAA2D;AAC3D,iFAA6E;AAmBtE,IAAM,SAAS,GAAf,MAAM,SAAS;CAAG,CAAA;AAAZ,8BAAS;oBAAT,SAAS;IAhBrB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,qBAAY,CAAC,OAAO,CAAC;gBACnB,QAAQ,EAAE,IAAI;aACf,CAAC;YAEE,gCAAc;YACd,wBAAU;YACV,4BAAY;YACZ,4DAA4D;YACpD,0CAAmB;YAC3B,0BAAW;YACX,sCAAiB;SAEtB;KACF,CAAC;GACW,SAAS,CAAG"}
\ No newline at end of file
diff --git a/dist/common/constants/permission.constants.js b/dist/common/constants/permission.constants.js
new file mode 100644
index 0000000..ffc60e9
--- /dev/null
+++ b/dist/common/constants/permission.constants.js
@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionType = void 0;
+exports.PermissionType = {
+    USER_CREATE: 'USER_CREATE',
+    USER_READ: 'USER_READ',
+    USER_UPDATE: 'USER_UPDATE',
+    USER_DELETE: 'USER_DELETE',
+    ROLE_CREATE: 'ROLE_CREATE',
+    ROLE_READ: 'ROLE_READ',
+    ROLE_UPDATE: 'ROLE_UPDATE',
+    ROLE_DELETE: 'ROLE_DELETE',
+    PERMISSION_CREATE: 'PERMISSION_CREATE',
+    PERMISSION_READ: 'PERMISSION_READ',
+    PERMISSION_UPDATE: 'PERMISSION_UPDATE',
+    PERMISSION_DELETE: 'PERMISSION_DELETE',
+};
+//# sourceMappingURL=permission.constants.js.map
\ No newline at end of file
diff --git a/dist/common/constants/permission.constants.js.map b/dist/common/constants/permission.constants.js.map
new file mode 100644
index 0000000..2749d2f
--- /dev/null
+++ b/dist/common/constants/permission.constants.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"permission.constants.js","sourceRoot":"","sources":["../../../src/common/constants/permission.constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,cAAc,GAAG;IAC5B,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAE1B,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAE1B,iBAAiB,EAAE,mBAAmB;IACtC,eAAe,EAAE,iBAAiB;IAClC,iBAAiB,EAAE,mBAAmB;IACtC,iBAAiB,EAAE,mBAAmB;CAC9B,CAAC"}
\ No newline at end of file
diff --git a/dist/core/auth/guards/jwt-auth.guard.js b/dist/core/auth/guards/jwt-auth.guard.js
new file mode 100644
index 0000000..5007d31
--- /dev/null
+++ b/dist/core/auth/guards/jwt-auth.guard.js
@@ -0,0 +1,106 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JwtAuthGuard = void 0;
+const common_1 = require("@nestjs/common");
+const jose_1 = require("jose");
+const identity_data_1 = require("../interfaces/identity-data");
+const jwt = __importStar(require("jsonwebtoken"));
+/**
+ * JwtAuthGuard verifies JWTs issued by the external Identity Provider (Authentik)
+ * using JWKS (RS256). It also accepts internal RayLab JWTs signed with a local secret.
+ */
+let JwtAuthGuard = class JwtAuthGuard {
+    jwks = null;
+    constructor() { }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        const authHeader = request.headers.authorization;
+        if (!authHeader) {
+            throw new common_1.UnauthorizedException('Authorization header is missing.');
+        }
+        const [type, token] = authHeader.split(' ');
+        if (type !== 'Bearer' || !token) {
+            throw new common_1.UnauthorizedException('Invalid authorization header.');
+        }
+        const jwksUri = process.env.AUTHENTIK_JWKS_URI;
+        // First try verifying with external JWKS (Authentik)
+        if (jwksUri) {
+            try {
+                if (!this.jwks)
+                    this.jwks = (0, jose_1.createRemoteJWKSet)(new URL(jwksUri));
+                const { payload } = await (0, jose_1.jwtVerify)(token, this.jwks, {
+                    issuer: process.env.AUTHENTIK_ISSUER,
+                    audience: process.env.AUTHENTIK_AUDIENCE,
+                });
+                const identity = new identity_data_1.IdentityData(payload.sub, payload.preferred_username, payload.email, payload);
+                request.identity = identity;
+                return true;
+            }
+            catch (err) {
+                // ignore and try internal verification
+            }
+        }
+        // Fallback: verify with internal symmetric secret
+        const secret = process.env.RAYLAB_JWT_SECRET;
+        if (!secret) {
+            throw new common_1.UnauthorizedException('Invalid or expired token.');
+        }
+        try {
+            const payload = jwt.verify(token, secret);
+            const identity = new identity_data_1.IdentityData(payload.sub, payload.preferred_username, payload.email, payload);
+            request.identity = identity;
+            return true;
+        }
+        catch (err) {
+            throw new common_1.UnauthorizedException('Invalid or expired token.');
+        }
+    }
+};
+exports.JwtAuthGuard = JwtAuthGuard;
+exports.JwtAuthGuard = JwtAuthGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [])
+], JwtAuthGuard);
+//# sourceMappingURL=jwt-auth.guard.js.map
\ No newline at end of file
diff --git a/dist/core/auth/guards/jwt-auth.guard.js.map b/dist/core/auth/guards/jwt-auth.guard.js.map
new file mode 100644
index 0000000..fa4c38d
--- /dev/null
+++ b/dist/core/auth/guards/jwt-auth.guard.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"jwt-auth.guard.js","sourceRoot":"","sources":["../../../../src/core/auth/guards/jwt-auth.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAKwB;AAExB,+BAAqD;AACrD,+DAA2D;AAC3D,kDAAoC;AAEpC;;;GAGG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAY;IACf,IAAI,GAAiD,IAAI,CAAC;IAElE,gBAAe,CAAC;IAEhB,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAyC,CAAC;QAE3F,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAEjD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAE5C,IAAI,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,8BAAqB,CAAC,+BAA+B,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAE/C,qDAAqD;QACrD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,IAAI,CAAC,IAAI,CAAC,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG,IAAA,yBAAkB,EAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAEjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;oBACpD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB;oBACpC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;iBACzC,CAAC,CAAC;gBAEH,MAAM,QAAQ,GAAG,IAAI,4BAAY,CAC/B,OAAO,CAAC,GAAa,EACpB,OAAe,CAAC,kBAAwC,EACxD,OAAe,CAAC,KAA2B,EAC5C,OAA8B,CAC/B,CAAC;gBAEF,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;gBAC5B,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uCAAuC;YACzC,CAAC;QACH,CAAC;QAED,kDAAkD;QAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAQ,CAAC;YAEjD,MAAM,QAAQ,GAAG,IAAI,4BAAY,CAC/B,OAAO,CAAC,GAAa,EACrB,OAAO,CAAC,kBAAwC,EAChD,OAAO,CAAC,KAA2B,EACnC,OAA8B,CAC/B,CAAC;YAEF,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;CACF,CAAA;AApEY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;;GACA,YAAY,CAoExB"}
\ No newline at end of file
diff --git a/dist/core/auth/interfaces/authenticated-request.interface.js b/dist/core/auth/interfaces/authenticated-request.interface.js
new file mode 100644
index 0000000..c514541
--- /dev/null
+++ b/dist/core/auth/interfaces/authenticated-request.interface.js
@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=authenticated-request.interface.js.map
\ No newline at end of file
diff --git a/dist/core/auth/interfaces/authenticated-request.interface.js.map b/dist/core/auth/interfaces/authenticated-request.interface.js.map
new file mode 100644
index 0000000..220894c
--- /dev/null
+++ b/dist/core/auth/interfaces/authenticated-request.interface.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"authenticated-request.interface.js","sourceRoot":"","sources":["../../../../src/core/auth/interfaces/authenticated-request.interface.ts"],"names":[],"mappings":""}
\ No newline at end of file
diff --git a/dist/core/auth/interfaces/identity-data.js b/dist/core/auth/interfaces/identity-data.js
new file mode 100644
index 0000000..e130fd7
--- /dev/null
+++ b/dist/core/auth/interfaces/identity-data.js
@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityData = void 0;
+class IdentityData {
+    sub;
+    preferred_username;
+    email;
+    claims;
+    constructor(sub, preferred_username, email, claims) {
+        this.sub = sub;
+        this.preferred_username = preferred_username;
+        this.email = email;
+        this.claims = claims;
+    }
+}
+exports.IdentityData = IdentityData;
+//# sourceMappingURL=identity-data.js.map
\ No newline at end of file
diff --git a/dist/core/auth/interfaces/identity-data.js.map b/dist/core/auth/interfaces/identity-data.js.map
new file mode 100644
index 0000000..292e6dc
--- /dev/null
+++ b/dist/core/auth/interfaces/identity-data.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"identity-data.js","sourceRoot":"","sources":["../../../../src/core/auth/interfaces/identity-data.ts"],"names":[],"mappings":";;;AAAA,MAAa,YAAY;IAEL;IACA;IACA;IACA;IAJlB,YACkB,GAAW,EACX,kBAA2B,EAC3B,KAAc,EACd,MAA4B;QAH5B,QAAG,GAAH,GAAG,CAAQ;QACX,uBAAkB,GAAlB,kBAAkB,CAAS;QAC3B,UAAK,GAAL,KAAK,CAAS;QACd,WAAM,GAAN,MAAM,CAAsB;IAC3C,CAAC;CACL;AAPD,oCAOC"}
\ No newline at end of file
diff --git a/dist/core/config/database.config.js b/dist/core/config/database.config.js
new file mode 100644
index 0000000..c4bf0dd
--- /dev/null
+++ b/dist/core/config/database.config.js
@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = () => ({
+    database: {
+        url: `postgresql://` +
+            `${process.env.DB_USER}:` +
+            `${process.env.DB_PASSWORD}@` +
+            `${process.env.SERVER_HOST}:` +
+            `${process.env.DB_PORT}/` +
+            `${process.env.DB_NAME}?schema=public`
+    }
+});
+//# sourceMappingURL=database.config.js.map
\ No newline at end of file
diff --git a/dist/core/config/database.config.js.map b/dist/core/config/database.config.js.map
new file mode 100644
index 0000000..4f98463
--- /dev/null
+++ b/dist/core/config/database.config.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"database.config.js","sourceRoot":"","sources":["../../../src/core/config/database.config.ts"],"names":[],"mappings":";;AAAA,kBAAe,GAAG,EAAE,CAAC,CAAC;IAClB,QAAQ,EAAE;QACN,GAAG,EACC,eAAe;YACf,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG;YACzB,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG;YAC7B,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG;YAC7B,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG;YACzB,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,gBAAgB;KAC7C;CACJ,CAAC,CAAC"}
\ No newline at end of file
diff --git a/dist/core/event-bus/event-bus.service.js b/dist/core/event-bus/event-bus.service.js
new file mode 100644
index 0000000..2421563
--- /dev/null
+++ b/dist/core/event-bus/event-bus.service.js
@@ -0,0 +1,36 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var EventBus_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EventBus = void 0;
+const common_1 = require("@nestjs/common");
+let EventBus = EventBus_1 = class EventBus {
+    handlers = new Map();
+    logger = new common_1.Logger(EventBus_1.name);
+    publish(event) {
+        const handlers = this.handlers.get(event.type) || [];
+        for (const h of handlers) {
+            try {
+                Promise.resolve(h(event)).catch((err) => this.logger.error('Event handler error', err));
+            }
+            catch (e) {
+                this.logger.error('Event handler threw', e);
+            }
+        }
+    }
+    subscribe(eventType, handler) {
+        const list = this.handlers.get(eventType) || [];
+        list.push(handler);
+        this.handlers.set(eventType, list);
+    }
+};
+exports.EventBus = EventBus;
+exports.EventBus = EventBus = EventBus_1 = __decorate([
+    (0, common_1.Injectable)()
+], EventBus);
+//# sourceMappingURL=event-bus.service.js.map
\ No newline at end of file
diff --git a/dist/core/event-bus/event-bus.service.js.map b/dist/core/event-bus/event-bus.service.js.map
new file mode 100644
index 0000000..3aa167f
--- /dev/null
+++ b/dist/core/event-bus/event-bus.service.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"event-bus.service.js","sourceRoot":"","sources":["../../../src/core/event-bus/event-bus.service.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAoD;AAO7C,IAAM,QAAQ,gBAAd,MAAM,QAAQ;IACX,QAAQ,GAA2B,IAAI,GAAG,EAAE,CAAC;IACpC,MAAM,GAAG,IAAI,eAAM,CAAC,UAAQ,CAAC,IAAI,CAAC,CAAC;IAEpD,OAAO,CAAC,KAAyB;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1F,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,CAAQ,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS,CAAC,SAAiB,EAAE,OAAgB;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;CACF,CAAA;AApBY,4BAAQ;mBAAR,QAAQ;IADpB,IAAA,mBAAU,GAAE;GACA,QAAQ,CAoBpB"}
\ No newline at end of file
diff --git a/dist/core/event-bus/event.interface.js b/dist/core/event-bus/event.interface.js
new file mode 100644
index 0000000..051ab18
--- /dev/null
+++ b/dist/core/event-bus/event.interface.js
@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=event.interface.js.map
\ No newline at end of file
diff --git a/dist/core/event-bus/event.interface.js.map b/dist/core/event-bus/event.interface.js.map
new file mode 100644
index 0000000..db1995e
--- /dev/null
+++ b/dist/core/event-bus/event.interface.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"event.interface.js","sourceRoot":"","sources":["../../../src/core/event-bus/event.interface.ts"],"names":[],"mappings":""}
\ No newline at end of file
diff --git a/dist/core/events/event-dispatcher.js b/dist/core/events/event-dispatcher.js
new file mode 100644
index 0000000..ad25771
--- /dev/null
+++ b/dist/core/events/event-dispatcher.js
@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EventDispatcher = void 0;
+class EventDispatcher {
+    publisher = new (require('./event-publisher').InMemoryEventPublisher)();
+    register(handler) {
+        this.publisher.register(handler);
+    }
+    async dispatch(event) {
+        await this.publisher.publish(event);
+    }
+}
+exports.EventDispatcher = EventDispatcher;
+//# sourceMappingURL=event-dispatcher.js.map
\ No newline at end of file
diff --git a/dist/core/events/event-dispatcher.js.map b/dist/core/events/event-dispatcher.js.map
new file mode 100644
index 0000000..065bcf8
--- /dev/null
+++ b/dist/core/events/event-dispatcher.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"event-dispatcher.js","sourceRoot":"","sources":["../../../src/core/events/event-dispatcher.ts"],"names":[],"mappings":";;;AAEA,MAAa,eAAe;IAClB,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,sBAAsB,CAAC,EAAE,CAAC;IAEhF,QAAQ,CAAC,OAA0C;QACjD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAkB;QAC/B,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;CACF;AAVD,0CAUC"}
\ No newline at end of file
diff --git a/dist/core/events/event-handler.js b/dist/core/events/event-handler.js
new file mode 100644
index 0000000..6950f78
--- /dev/null
+++ b/dist/core/events/event-handler.js
@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=event-handler.js.map
\ No newline at end of file
diff --git a/dist/core/events/event-handler.js.map b/dist/core/events/event-handler.js.map
new file mode 100644
index 0000000..efbfd3f
--- /dev/null
+++ b/dist/core/events/event-handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"event-handler.js","sourceRoot":"","sources":["../../../src/core/events/event-handler.ts"],"names":[],"mappings":""}
\ No newline at end of file
diff --git a/dist/core/events/event-publisher.js b/dist/core/events/event-publisher.js
new file mode 100644
index 0000000..7429352
--- /dev/null
+++ b/dist/core/events/event-publisher.js
@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryEventPublisher = void 0;
+class InMemoryEventPublisher {
+    handlers = [];
+    register(handler) {
+        this.handlers.push(handler);
+    }
+    async publish(event) {
+        await Promise.all(this.handlers.map((h) => h(event)));
+    }
+}
+exports.InMemoryEventPublisher = InMemoryEventPublisher;
+//# sourceMappingURL=event-publisher.js.map
\ No newline at end of file
diff --git a/dist/core/events/event-publisher.js.map b/dist/core/events/event-publisher.js.map
new file mode 100644
index 0000000..c2c673c
--- /dev/null
+++ b/dist/core/events/event-publisher.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"event-publisher.js","sourceRoot":"","sources":["../../../src/core/events/event-publisher.ts"],"names":[],"mappings":";;;AAMA,MAAa,sBAAsB;IACzB,QAAQ,GAA6C,EAAE,CAAC;IAEhE,QAAQ,CAAC,OAA0C;QACjD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAkB;QAC9B,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;CACF;AAVD,wDAUC"}
\ No newline at end of file
diff --git a/dist/core/events/event.interface.js b/dist/core/events/event.interface.js
new file mode 100644
index 0000000..051ab18
--- /dev/null
+++ b/dist/core/events/event.interface.js
@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=event.interface.js.map
\ No newline at end of file
diff --git a/dist/core/events/event.interface.js.map b/dist/core/events/event.interface.js.map
new file mode 100644
index 0000000..2fa0bd2
--- /dev/null
+++ b/dist/core/events/event.interface.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"event.interface.js","sourceRoot":"","sources":["../../../src/core/events/event.interface.ts"],"names":[],"mappings":""}
\ No newline at end of file
diff --git a/dist/core/exceptions/http-exception.filter.js b/dist/core/exceptions/http-exception.filter.js
new file mode 100644
index 0000000..36ced11
--- /dev/null
+++ b/dist/core/exceptions/http-exception.filter.js
@@ -0,0 +1,29 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HttpExceptionFilter = void 0;
+const common_1 = require("@nestjs/common");
+let HttpExceptionFilter = class HttpExceptionFilter {
+    catch(exception, host) {
+        const ctx = host.switchToHttp();
+        const response = ctx.getResponse();
+        const status = exception.getStatus ? exception.getStatus() : 500;
+        response.status(status).json({
+            success: false,
+            error: {
+                code: exception.code || 'INTERNAL_ERROR',
+                message: exception.message || 'Internal server error',
+            },
+        });
+    }
+};
+exports.HttpExceptionFilter = HttpExceptionFilter;
+exports.HttpExceptionFilter = HttpExceptionFilter = __decorate([
+    (0, common_1.Catch)()
+], HttpExceptionFilter);
+//# sourceMappingURL=http-exception.filter.js.map
\ No newline at end of file
diff --git a/dist/core/exceptions/http-exception.filter.js.map b/dist/core/exceptions/http-exception.filter.js.map
new file mode 100644
index 0000000..9774136
--- /dev/null
+++ b/dist/core/exceptions/http-exception.filter.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"http-exception.filter.js","sourceRoot":"","sources":["../../../src/core/exceptions/http-exception.filter.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAuE;AAGhE,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,KAAK,CAAC,SAAc,EAAE,IAAmB;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAEjE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YAC3B,OAAO,EAAE,KAAK;YACd,KAAK,EAAE;gBACL,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,gBAAgB;gBACxC,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,uBAAuB;aACtD;SACF,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAdY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,cAAK,GAAE;GACK,mBAAmB,CAc/B"}
\ No newline at end of file
diff --git a/dist/core/logger/logger.service.js b/dist/core/logger/logger.service.js
new file mode 100644
index 0000000..8de8f09
--- /dev/null
+++ b/dist/core/logger/logger.service.js
@@ -0,0 +1,11 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logger = void 0;
+const pino_1 = __importDefault(require("pino"));
+exports.logger = (0, pino_1.default)({
+    level: process.env.LOG_LEVEL || 'info',
+});
+//# sourceMappingURL=logger.service.js.map
\ No newline at end of file
diff --git a/dist/core/logger/logger.service.js.map b/dist/core/logger/logger.service.js.map
new file mode 100644
index 0000000..459e62c
--- /dev/null
+++ b/dist/core/logger/logger.service.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"logger.service.js","sourceRoot":"","sources":["../../../src/core/logger/logger.service.ts"],"names":[],"mappings":";;;;;;AAAA,gDAAwB;AAEX,QAAA,MAAM,GAAG,IAAA,cAAI,EAAC;IACzB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM;CACvC,CAAC,CAAC"}
\ No newline at end of file
diff --git a/dist/core/middleware/request-id.middleware.js b/dist/core/middleware/request-id.middleware.js
new file mode 100644
index 0000000..4fa05fb
--- /dev/null
+++ b/dist/core/middleware/request-id.middleware.js
@@ -0,0 +1,23 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RequestIdMiddleware = void 0;
+const common_1 = require("@nestjs/common");
+const uuid_1 = require("uuid");
+let RequestIdMiddleware = class RequestIdMiddleware {
+    use(req, res, next) {
+        req.requestId = req.headers['x-request-id'] || (0, uuid_1.v4)();
+        res.setHeader('X-Request-ID', req.requestId);
+        next();
+    }
+};
+exports.RequestIdMiddleware = RequestIdMiddleware;
+exports.RequestIdMiddleware = RequestIdMiddleware = __decorate([
+    (0, common_1.Injectable)()
+], RequestIdMiddleware);
+//# sourceMappingURL=request-id.middleware.js.map
\ No newline at end of file
diff --git a/dist/core/middleware/request-id.middleware.js.map b/dist/core/middleware/request-id.middleware.js.map
new file mode 100644
index 0000000..393bde4
--- /dev/null
+++ b/dist/core/middleware/request-id.middleware.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"request-id.middleware.js","sourceRoot":"","sources":["../../../src/core/middleware/request-id.middleware.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4D;AAC5D,+BAAoC;AAG7B,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,GAAG,CAAC,GAAQ,EAAE,GAAQ,EAAE,IAAgB;QACtC,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,IAAA,SAAM,GAAE,CAAC;QACxD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,EAAE,CAAC;IACT,CAAC;CACF,CAAA;AANY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;GACA,mBAAmB,CAM/B"}
\ No newline at end of file
diff --git a/dist/main.js b/dist/main.js
new file mode 100644
index 0000000..7a2a568
--- /dev/null
+++ b/dist/main.js
@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const config_1 = require("@nestjs/config");
+const swagger_1 = require("@nestjs/swagger");
+const app_module_1 = require("./app.module");
+async function bootstrap() {
+    const app = await core_1.NestFactory.create(app_module_1.AppModule);
+    const config = app.get(config_1.ConfigService);
+    app.setGlobalPrefix('');
+    app.useGlobalPipes(new common_1.ValidationPipe({
+        whitelist: true,
+        transform: true,
+        forbidNonWhitelisted: true,
+    }));
+    app.enableCors();
+    const swaggerEnabled = config.get('SWAGGER_ENABLED') === 'true';
+    if (swaggerEnabled) {
+        const swaggerConfig = new swagger_1.DocumentBuilder()
+            .setTitle('RayLab Core API')
+            .setDescription('RayLab Core REST API')
+            .setVersion('1.0.0')
+            .addBearerAuth()
+            .build();
+        const document = swagger_1.SwaggerModule.createDocument(app, swaggerConfig);
+        swagger_1.SwaggerModule.setup('ApiList', app, document);
+    }
+    const port = config.get('PORT') || 3000;
+    await app.listen(port);
+    console.log(`Server running on http://localhost:${port}`);
+}
+bootstrap();
+//# sourceMappingURL=main.js.map
\ No newline at end of file
diff --git a/dist/main.js.map b/dist/main.js.map
new file mode 100644
index 0000000..8c9087b
--- /dev/null
+++ b/dist/main.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"main.js","sourceRoot":"","sources":["../src/main.ts"],"names":[],"mappings":";;AAAA,2CAAgD;AAChD,uCAA2C;AAC3C,2CAA+C;AAC/C,6CAAiE;AAEjE,6CAAyC;AAEzC,KAAK,UAAU,SAAS;IACtB,MAAM,GAAG,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,sBAAS,CAAC,CAAC;IAEhD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,sBAAa,CAAC,CAAC;IAEtC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAExB,GAAG,CAAC,cAAc,CAChB,IAAI,uBAAc,CAAC;QACjB,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,IAAI;QACf,oBAAoB,EAAE,IAAI;KAC3B,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,UAAU,EAAE,CAAC;IAEjB,MAAM,cAAc,GAAG,MAAM,CAAC,GAAG,CAAS,iBAAiB,CAAC,KAAK,MAAM,CAAC;IAExE,IAAI,cAAc,EAAE,CAAC;QACnB,MAAM,aAAa,GAAG,IAAI,yBAAe,EAAE;aACxC,QAAQ,CAAC,iBAAiB,CAAC;aAC3B,cAAc,CAAC,sBAAsB,CAAC;aACtC,UAAU,CAAC,OAAO,CAAC;aACnB,aAAa,EAAE;aACf,KAAK,EAAE,CAAC;QAEX,MAAM,QAAQ,GAAG,uBAAa,CAAC,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAElE,uBAAa,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAS,MAAM,CAAC,IAAI,IAAI,CAAC;IAEhD,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEvB,OAAO,CAAC,GAAG,CAAC,sCAAsC,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,EAAE,CAAC"}
\ No newline at end of file
diff --git a/dist/modules/application/application.module.js b/dist/modules/application/application.module.js
new file mode 100644
index 0000000..93b38ff
--- /dev/null
+++ b/dist/modules/application/application.module.js
@@ -0,0 +1,50 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApplicationModule = void 0;
+const common_1 = require("@nestjs/common");
+const prisma_service_1 = require("../../shared/prisma.service");
+const applications_controller_1 = require("./presentation/controllers/applications.controller");
+const prisma_application_repository_1 = require("./infrastructure/repositories/prisma-application.repository");
+const application_interface_1 = require("./domain/repositories/application.interface");
+const get_applications_handler_1 = require("./application/handlers/get-applications.handler");
+const get_application_handler_1 = require("./application/handlers/get-application.handler");
+const create_application_handler_1 = require("./application/handlers/create-application.handler");
+const update_application_handler_1 = require("./application/handlers/update-application.handler");
+const delete_application_handler_1 = require("./application/handlers/delete-application.handler");
+const get_me_applications_handler_1 = require("./application/handlers/get-me-applications.handler");
+const application_validator_1 = require("./application/validators/application.validator");
+const jwt_auth_guard_1 = require("../../core/auth/guards/jwt-auth.guard");
+const current_user_guard_1 = require("../identity/presentation/guards/current-user.guard");
+let ApplicationModule = class ApplicationModule {
+};
+exports.ApplicationModule = ApplicationModule;
+exports.ApplicationModule = ApplicationModule = __decorate([
+    (0, common_1.Module)({
+        imports: [],
+        providers: [
+            prisma_service_1.PrismaService,
+            prisma_application_repository_1.PrismaApplicationRepository,
+            get_applications_handler_1.GetApplicationsHandler,
+            get_application_handler_1.GetApplicationHandler,
+            create_application_handler_1.CreateApplicationHandler,
+            update_application_handler_1.UpdateApplicationHandler,
+            delete_application_handler_1.DeleteApplicationHandler,
+            get_me_applications_handler_1.GetMeApplicationsHandler,
+            application_validator_1.ApplicationValidator,
+            jwt_auth_guard_1.JwtAuthGuard,
+            current_user_guard_1.CurrentUserGuard,
+            {
+                provide: application_interface_1.IApplication,
+                useClass: prisma_application_repository_1.PrismaApplicationRepository,
+            },
+        ],
+        controllers: [applications_controller_1.ApplicationsController],
+    })
+], ApplicationModule);
+//# sourceMappingURL=application.module.js.map
\ No newline at end of file
diff --git a/dist/modules/application/application.module.js.map b/dist/modules/application/application.module.js.map
new file mode 100644
index 0000000..d908fa3
--- /dev/null
+++ b/dist/modules/application/application.module.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"application.module.js","sourceRoot":"","sources":["../../../src/modules/application/application.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,gEAA4D;AAC5D,gGAA4F;AAC5F,+GAA0G;AAC1G,uFAA2E;AAC3E,8FAAyF;AACzF,4FAAuF;AACvF,kGAA6F;AAC7F,kGAA6F;AAC7F,kGAA6F;AAC7F,oGAA8F;AAC9F,0FAAsF;AACtF,0EAAqE;AACrE,2FAAsF;AAuB/E,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAAG,CAAA;AAApB,8CAAiB;4BAAjB,iBAAiB;IArB7B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,EAAE;QACX,SAAS,EAAE;YACT,8BAAa;YACb,2DAA2B;YAC3B,iDAAsB;YACtB,+CAAqB;YACrB,qDAAwB;YACxB,qDAAwB;YACxB,qDAAwB;YACxB,sDAAwB;YACxB,4CAAoB;YACpB,6BAAY;YACZ,qCAAgB;YAChB;gBACE,OAAO,EAAE,oCAAY;gBACrB,QAAQ,EAAE,2DAA2B;aACtC;SACF;QACD,WAAW,EAAE,CAAC,gDAAsB,CAAC;KACtC,CAAC;GACW,iBAAiB,CAAG"}
\ No newline at end of file
diff --git a/dist/modules/application/application/handlers/create-application.handler.js b/dist/modules/application/application/handlers/create-application.handler.js
new file mode 100644
index 0000000..ada011b
--- /dev/null
+++ b/dist/modules/application/application/handlers/create-application.handler.js
@@ -0,0 +1,44 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateApplicationHandler = void 0;
+const common_1 = require("@nestjs/common");
+const application_interface_1 = require("../../domain/repositories/application.interface");
+const application_validator_1 = require("../../application/validators/application.validator");
+const application_entity_1 = require("../../domain/entities/application.entity");
+let CreateApplicationHandler = class CreateApplicationHandler {
+    appRepo;
+    validator;
+    constructor(appRepo, validator) {
+        this.appRepo = appRepo;
+        this.validator = validator;
+    }
+    async execute(payload) {
+        await this.validator.validateCreate(payload);
+        const app = application_entity_1.ApplicationData.create({
+            code: payload.code,
+            name: payload.name,
+            description: payload.description,
+            icon: payload.icon,
+            url: payload.url,
+            applicationsClaim: payload.applicationsClaim,
+            displayOrder: payload.displayOrder,
+        });
+        const created = await this.appRepo.create(app);
+        return created;
+    }
+};
+exports.CreateApplicationHandler = CreateApplicationHandler;
+exports.CreateApplicationHandler = CreateApplicationHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [application_interface_1.IApplication, application_validator_1.ApplicationValidator])
+], CreateApplicationHandler);
+//# sourceMappingURL=create-application.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/application/application/handlers/create-application.handler.js.map b/dist/modules/application/application/handlers/create-application.handler.js.map
new file mode 100644
index 0000000..cb30776
--- /dev/null
+++ b/dist/modules/application/application/handlers/create-application.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"create-application.handler.js","sourceRoot":"","sources":["../../../../../src/modules/application/application/handlers/create-application.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAiE;AACjE,2FAA+E;AAC/E,8FAA0F;AAC1F,iFAA2E;AAGpE,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACN;IAAwC;IAArE,YAA6B,OAAqB,EAAmB,SAA+B;QAAvE,YAAO,GAAP,OAAO,CAAc;QAAmB,cAAS,GAAT,SAAS,CAAsB;IAAG,CAAC;IAExG,KAAK,CAAC,OAAO,CAAC,OAAY;QACxB,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAE7C,MAAM,GAAG,GAAG,oCAAe,CAAC,MAAM,CAAC;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AAnBY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAE2B,oCAAY,EAA8B,4CAAoB;GADzF,wBAAwB,CAmBpC"}
\ No newline at end of file
diff --git a/dist/modules/application/application/handlers/delete-application.handler.js b/dist/modules/application/application/handlers/delete-application.handler.js
new file mode 100644
index 0000000..97a35cf
--- /dev/null
+++ b/dist/modules/application/application/handlers/delete-application.handler.js
@@ -0,0 +1,31 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeleteApplicationHandler = void 0;
+const common_1 = require("@nestjs/common");
+const application_interface_1 = require("../../domain/repositories/application.interface");
+let DeleteApplicationHandler = class DeleteApplicationHandler {
+    appRepo;
+    constructor(appRepo) {
+        this.appRepo = appRepo;
+    }
+    async execute(id) {
+        // ensure exists
+        await this.appRepo.findById(id);
+        await this.appRepo.delete(id);
+    }
+};
+exports.DeleteApplicationHandler = DeleteApplicationHandler;
+exports.DeleteApplicationHandler = DeleteApplicationHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [application_interface_1.IApplication])
+], DeleteApplicationHandler);
+//# sourceMappingURL=delete-application.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/application/application/handlers/delete-application.handler.js.map b/dist/modules/application/application/handlers/delete-application.handler.js.map
new file mode 100644
index 0000000..7bb6d4d
--- /dev/null
+++ b/dist/modules/application/application/handlers/delete-application.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"delete-application.handler.js","sourceRoot":"","sources":["../../../../../src/modules/application/application/handlers/delete-application.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,2FAA+E;AAGxE,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACN;IAA7B,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,gBAAgB;QAChB,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;CACF,CAAA;AARY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAE2B,oCAAY;GADvC,wBAAwB,CAQpC"}
\ No newline at end of file
diff --git a/dist/modules/application/application/handlers/get-application.handler.js b/dist/modules/application/application/handlers/get-application.handler.js
new file mode 100644
index 0000000..0021280
--- /dev/null
+++ b/dist/modules/application/application/handlers/get-application.handler.js
@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetApplicationHandler = void 0;
+const common_1 = require("@nestjs/common");
+const application_interface_1 = require("../../domain/repositories/application.interface");
+let GetApplicationHandler = class GetApplicationHandler {
+    appRepo;
+    constructor(appRepo) {
+        this.appRepo = appRepo;
+    }
+    async execute(id) {
+        const app = await this.appRepo.findById(id);
+        return app;
+    }
+};
+exports.GetApplicationHandler = GetApplicationHandler;
+exports.GetApplicationHandler = GetApplicationHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [application_interface_1.IApplication])
+], GetApplicationHandler);
+//# sourceMappingURL=get-application.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/application/application/handlers/get-application.handler.js.map b/dist/modules/application/application/handlers/get-application.handler.js.map
new file mode 100644
index 0000000..4c93749
--- /dev/null
+++ b/dist/modules/application/application/handlers/get-application.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"get-application.handler.js","sourceRoot":"","sources":["../../../../../src/modules/application/application/handlers/get-application.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,2FAA+E;AAGxE,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IACH;IAA7B,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AAPY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;qCAE2B,oCAAY;GADvC,qBAAqB,CAOjC"}
\ No newline at end of file
diff --git a/dist/modules/application/application/handlers/get-applications.handler.js b/dist/modules/application/application/handlers/get-applications.handler.js
new file mode 100644
index 0000000..2fb1069
--- /dev/null
+++ b/dist/modules/application/application/handlers/get-applications.handler.js
@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetApplicationsHandler = void 0;
+const common_1 = require("@nestjs/common");
+const application_interface_1 = require("../../domain/repositories/application.interface");
+let GetApplicationsHandler = class GetApplicationsHandler {
+    appRepo;
+    constructor(appRepo) {
+        this.appRepo = appRepo;
+    }
+    async execute(query) {
+        const res = await this.appRepo.find({ page: query.page, limit: query.limit, search: query.search || null });
+        return res;
+    }
+};
+exports.GetApplicationsHandler = GetApplicationsHandler;
+exports.GetApplicationsHandler = GetApplicationsHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [application_interface_1.IApplication])
+], GetApplicationsHandler);
+//# sourceMappingURL=get-applications.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/application/application/handlers/get-applications.handler.js.map b/dist/modules/application/application/handlers/get-applications.handler.js.map
new file mode 100644
index 0000000..5d78953
--- /dev/null
+++ b/dist/modules/application/application/handlers/get-applications.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"get-applications.handler.js","sourceRoot":"","sources":["../../../../../src/modules/application/application/handlers/get-applications.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,2FAA+E;AAGxE,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACJ;IAA7B,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,KAAyD;QACrE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;QAC5G,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AAPY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;qCAE2B,oCAAY;GADvC,sBAAsB,CAOlC"}
\ No newline at end of file
diff --git a/dist/modules/application/application/handlers/get-me-applications.handler.js b/dist/modules/application/application/handlers/get-me-applications.handler.js
new file mode 100644
index 0000000..db284f1
--- /dev/null
+++ b/dist/modules/application/application/handlers/get-me-applications.handler.js
@@ -0,0 +1,35 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetMeApplicationsHandler = void 0;
+const common_1 = require("@nestjs/common");
+const application_interface_1 = require("../../domain/repositories/application.interface");
+let GetMeApplicationsHandler = class GetMeApplicationsHandler {
+    appRepo;
+    constructor(appRepo) {
+        this.appRepo = appRepo;
+    }
+    async execute(applicationsClaimList) {
+        if (!applicationsClaimList || applicationsClaimList.length === 0)
+            return { data: [], total: 0 };
+        // Only return active applications whose applicationsClaim exists in provided list
+        const res = await this.appRepo.find({ page: 1, limit: 1000, isActive: true, applicationsClaimIn: applicationsClaimList });
+        // sort by displayOrder asc
+        res.data.sort((a, b) => (a.displayOrder ?? 0) - (b.displayOrder ?? 0));
+        return res;
+    }
+};
+exports.GetMeApplicationsHandler = GetMeApplicationsHandler;
+exports.GetMeApplicationsHandler = GetMeApplicationsHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [application_interface_1.IApplication])
+], GetMeApplicationsHandler);
+//# sourceMappingURL=get-me-applications.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/application/application/handlers/get-me-applications.handler.js.map b/dist/modules/application/application/handlers/get-me-applications.handler.js.map
new file mode 100644
index 0000000..7983311
--- /dev/null
+++ b/dist/modules/application/application/handlers/get-me-applications.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"get-me-applications.handler.js","sourceRoot":"","sources":["../../../../../src/modules/application/application/handlers/get-me-applications.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,2FAA+E;AAGxE,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACN;IAA7B,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,qBAAkD;QAC9D,IAAI,CAAC,qBAAqB,IAAI,qBAAqB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAEhG,kFAAkF;QAClF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC1H,2BAA2B;QAC3B,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AAZY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAE2B,oCAAY;GADvC,wBAAwB,CAYpC"}
\ No newline at end of file
diff --git a/dist/modules/application/application/handlers/update-application.handler.js b/dist/modules/application/application/handlers/update-application.handler.js
new file mode 100644
index 0000000..242bd8e
--- /dev/null
+++ b/dist/modules/application/application/handlers/update-application.handler.js
@@ -0,0 +1,38 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateApplicationHandler = void 0;
+const common_1 = require("@nestjs/common");
+const application_interface_1 = require("../../domain/repositories/application.interface");
+const application_validator_1 = require("../../application/validators/application.validator");
+let UpdateApplicationHandler = class UpdateApplicationHandler {
+    appRepo;
+    validator;
+    constructor(appRepo, validator) {
+        this.appRepo = appRepo;
+        this.validator = validator;
+    }
+    async execute(id, payload) {
+        const existing = await this.appRepo.findById(id);
+        if (!existing)
+            throw new Error('Application not found');
+        await this.validator.validateUpdate(id, payload);
+        existing.update(payload);
+        const updated = await this.appRepo.update(existing);
+        return updated;
+    }
+};
+exports.UpdateApplicationHandler = UpdateApplicationHandler;
+exports.UpdateApplicationHandler = UpdateApplicationHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [application_interface_1.IApplication, application_validator_1.ApplicationValidator])
+], UpdateApplicationHandler);
+//# sourceMappingURL=update-application.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/application/application/handlers/update-application.handler.js.map b/dist/modules/application/application/handlers/update-application.handler.js.map
new file mode 100644
index 0000000..83a74d2
--- /dev/null
+++ b/dist/modules/application/application/handlers/update-application.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"update-application.handler.js","sourceRoot":"","sources":["../../../../../src/modules/application/application/handlers/update-application.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,2FAA+E;AAC/E,8FAA0F;AAGnF,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACN;IAAwC;IAArE,YAA6B,OAAqB,EAAmB,SAA+B;QAAvE,YAAO,GAAP,OAAO,CAAc;QAAmB,cAAS,GAAT,SAAS,CAAsB;IAAG,CAAC;IAExG,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,OAAY;QACpC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAExD,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAEjD,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AAbY,4DAAwB;mCAAxB,wBAAwB;IADpC,IAAA,mBAAU,GAAE;qCAE2B,oCAAY,EAA8B,4CAAoB;GADzF,wBAAwB,CAapC"}
\ No newline at end of file
diff --git a/dist/modules/application/application/validators/application.validator.js b/dist/modules/application/application/validators/application.validator.js
new file mode 100644
index 0000000..dd91f08
--- /dev/null
+++ b/dist/modules/application/application/validators/application.validator.js
@@ -0,0 +1,84 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApplicationValidator = void 0;
+const common_1 = require("@nestjs/common");
+const application_interface_1 = require("../../domain/repositories/application.interface");
+let ApplicationValidator = class ApplicationValidator {
+    appRepo;
+    constructor(appRepo) {
+        this.appRepo = appRepo;
+    }
+    async validateCreate(payload) {
+        if (!payload || !payload.code)
+            throw new common_1.BadRequestException('code is required');
+        if (!payload.name)
+            throw new common_1.BadRequestException('name is required');
+        if (!payload.applicationsClaim)
+            throw new common_1.BadRequestException('applicationsClaim is required');
+        // url validation if provided
+        if (payload.url) {
+            try {
+                // allow relative urls
+                if (!payload.url.startsWith('/') && !payload.url.startsWith('http')) {
+                    throw new Error('invalid');
+                }
+                // new URL(payload.url) // avoid throwing for relative
+            }
+            catch (e) {
+                throw new common_1.BadRequestException('invalid url');
+            }
+        }
+        // displayOrder
+        if (payload.displayOrder !== undefined && typeof payload.displayOrder !== 'number') {
+            throw new common_1.BadRequestException('invalid displayOrder');
+        }
+        // unique code
+        const byCode = await this.appRepo.findByCode(payload.code);
+        if (byCode)
+            throw new common_1.BadRequestException('duplicate code');
+        const byClaim = await this.appRepo.findByApplicationsClaim(payload.applicationsClaim);
+        if (byClaim)
+            throw new common_1.BadRequestException('duplicate applicationsClaim');
+    }
+    async validateUpdate(id, payload) {
+        if (!payload)
+            return;
+        if (payload.url) {
+            try {
+                if (!payload.url.startsWith('/') && !payload.url.startsWith('http'))
+                    throw new Error('invalid');
+            }
+            catch (e) {
+                throw new common_1.BadRequestException('invalid url');
+            }
+        }
+        if (payload.displayOrder !== undefined && typeof payload.displayOrder !== 'number') {
+            throw new common_1.BadRequestException('invalid displayOrder');
+        }
+        if (payload.code) {
+            const existing = await this.appRepo.findByCode(payload.code);
+            if (existing && existing.id !== id)
+                throw new common_1.BadRequestException('duplicate code');
+        }
+        if (payload.applicationsClaim) {
+            const existing = await this.appRepo.findByApplicationsClaim(payload.applicationsClaim);
+            if (existing && existing.id !== id)
+                throw new common_1.BadRequestException('duplicate applicationsClaim');
+        }
+    }
+};
+exports.ApplicationValidator = ApplicationValidator;
+exports.ApplicationValidator = ApplicationValidator = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [application_interface_1.IApplication])
+], ApplicationValidator);
+//# sourceMappingURL=application.validator.js.map
\ No newline at end of file
diff --git a/dist/modules/application/application/validators/application.validator.js.map b/dist/modules/application/application/validators/application.validator.js.map
new file mode 100644
index 0000000..7f4f045
--- /dev/null
+++ b/dist/modules/application/application/validators/application.validator.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"application.validator.js","sourceRoot":"","sources":["../../../../../src/modules/application/application/validators/application.validator.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAiE;AACjE,2FAA+E;AAGxE,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACF;IAA7B,YAA6B,OAAqB;QAArB,YAAO,GAAP,OAAO,CAAc;IAAG,CAAC;IAEtD,KAAK,CAAC,cAAc,CAAC,OAAY;QAC/B,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,MAAM,IAAI,4BAAmB,CAAC,kBAAkB,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,MAAM,IAAI,4BAAmB,CAAC,kBAAkB,CAAC,CAAC;QACrE,IAAI,CAAC,OAAO,CAAC,iBAAiB;YAAE,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,CAAC,CAAC;QAE/F,6BAA6B;QAC7B,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,sBAAsB;gBACtB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC7B,CAAC;gBACD,sDAAsD;YACxD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,4BAAmB,CAAC,aAAa,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,eAAe;QACf,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnF,MAAM,IAAI,4BAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,cAAc;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,MAAM;YAAE,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAE5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACtF,IAAI,OAAO;YAAE,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU,EAAE,OAAY;QAC3C,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC;YAClG,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,4BAAmB,CAAC,aAAa,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnF,MAAM,IAAI,4BAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7D,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE;gBAAE,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YACvF,IAAI,QAAQ,IAAI,QAAQ,CAAC,EAAE,KAAK,EAAE;gBAAE,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,CAAC,CAAC;QACnG,CAAC;IACH,CAAC;CACF,CAAA;AA3DY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAE2B,oCAAY;GADvC,oBAAoB,CA2DhC"}
\ No newline at end of file
diff --git a/dist/modules/application/domain/entities/application.entity.js b/dist/modules/application/domain/entities/application.entity.js
new file mode 100644
index 0000000..6319c92
--- /dev/null
+++ b/dist/modules/application/domain/entities/application.entity.js
@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApplicationData = void 0;
+class ApplicationData {
+    id;
+    code;
+    name;
+    description;
+    icon;
+    url;
+    applicationsClaim;
+    isActive;
+    displayOrder;
+    createdAt;
+    updatedAt;
+    constructor(id, code, name, description, icon, url, applicationsClaim, isActive, displayOrder, createdAt, updatedAt) {
+        this.id = id;
+        this.code = code;
+        this.name = name;
+        this.description = description;
+        this.icon = icon;
+        this.url = url;
+        this.applicationsClaim = applicationsClaim;
+        this.isActive = isActive;
+        this.displayOrder = displayOrder;
+        this.createdAt = createdAt;
+        this.updatedAt = updatedAt;
+    }
+    static create(data) {
+        return new ApplicationData(crypto.randomUUID(), data.code, data.name, data.description ?? null, data.icon ?? null, data.url ?? null, data.applicationsClaim, true, data.displayOrder ?? 0, new Date(), new Date());
+    }
+    static restore(props) {
+        return new ApplicationData(props.id, props.code, props.name, props.description ?? null, props.icon ?? null, props.url ?? null, props.applicationsClaim, props.isActive !== undefined ? props.isActive : true, props.displayOrder ?? 0, props.createdAt ?? null, props.updatedAt ?? null);
+    }
+    update(data) {
+        if (data.code !== undefined)
+            this.code = data.code;
+        if (data.name !== undefined)
+            this.name = data.name;
+        if (data.description !== undefined)
+            this.description = data.description;
+        if (data.icon !== undefined)
+            this.icon = data.icon;
+        if (data.url !== undefined)
+            this.url = data.url;
+        if (data.applicationsClaim !== undefined)
+            this.applicationsClaim = data.applicationsClaim;
+        if (data.isActive !== undefined)
+            this.isActive = data.isActive;
+        if (data.displayOrder !== undefined)
+            this.displayOrder = data.displayOrder;
+        this.updatedAt = new Date();
+    }
+    toResponse() {
+        return {
+            id: this.id,
+            code: this.code,
+            name: this.name,
+            description: this.description,
+            icon: this.icon,
+            url: this.url,
+            displayOrder: this.displayOrder,
+        };
+    }
+}
+exports.ApplicationData = ApplicationData;
+//# sourceMappingURL=application.entity.js.map
\ No newline at end of file
diff --git a/dist/modules/application/domain/entities/application.entity.js.map b/dist/modules/application/domain/entities/application.entity.js.map
new file mode 100644
index 0000000..fb200f8
--- /dev/null
+++ b/dist/modules/application/domain/entities/application.entity.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"application.entity.js","sourceRoot":"","sources":["../../../../../src/modules/application/domain/entities/application.entity.ts"],"names":[],"mappings":";;;AAAA,MAAa,eAAe;IAER;IACT;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAXT,YACkB,EAAU,EACnB,IAAY,EACZ,IAAY,EACZ,WAA0B,EAC1B,IAAmB,EACnB,GAAkB,EAClB,iBAAyB,EACzB,QAAiB,EACjB,YAAoB,EACpB,SAAsB,EACtB,SAAsB;QAVb,OAAE,GAAF,EAAE,CAAQ;QACnB,SAAI,GAAJ,IAAI,CAAQ;QACZ,SAAI,GAAJ,IAAI,CAAQ;QACZ,gBAAW,GAAX,WAAW,CAAe;QAC1B,SAAI,GAAJ,IAAI,CAAe;QACnB,QAAG,GAAH,GAAG,CAAe;QAClB,sBAAiB,GAAjB,iBAAiB,CAAQ;QACzB,aAAQ,GAAR,QAAQ,CAAS;QACjB,iBAAY,GAAZ,YAAY,CAAQ;QACpB,cAAS,GAAT,SAAS,CAAa;QACtB,cAAS,GAAT,SAAS,CAAa;IAC5B,CAAC;IAEJ,MAAM,CAAC,MAAM,CAAC,IAQb;QACC,OAAO,IAAI,eAAe,CACxB,MAAM,CAAC,UAAU,EAAE,EACnB,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,WAAW,IAAI,IAAI,EACxB,IAAI,CAAC,IAAI,IAAI,IAAI,EACjB,IAAI,CAAC,GAAG,IAAI,IAAI,EAChB,IAAI,CAAC,iBAAiB,EACtB,IAAI,EACJ,IAAI,CAAC,YAAY,IAAI,CAAC,EACtB,IAAI,IAAI,EAAE,EACV,IAAI,IAAI,EAAE,CACX,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,KAYd;QACC,OAAO,IAAI,eAAe,CACxB,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,WAAW,IAAI,IAAI,EACzB,KAAK,CAAC,IAAI,IAAI,IAAI,EAClB,KAAK,CAAC,GAAG,IAAI,IAAI,EACjB,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EACpD,KAAK,CAAC,YAAY,IAAI,CAAC,EACvB,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,KAAK,CAAC,SAAS,IAAI,IAAI,CACxB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IASN;QACC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACxE,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QAChD,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS;YAAE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,CAAC;QAC1F,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/D,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QAC3E,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;IAC9B,CAAC;IAED,UAAU;QACR,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;IACJ,CAAC;CACF;AAnGD,0CAmGC"}
\ No newline at end of file
diff --git a/dist/modules/application/domain/repositories/application.interface.js b/dist/modules/application/domain/repositories/application.interface.js
new file mode 100644
index 0000000..a6bf53a
--- /dev/null
+++ b/dist/modules/application/domain/repositories/application.interface.js
@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IApplication = void 0;
+class IApplication {
+}
+exports.IApplication = IApplication;
+//# sourceMappingURL=application.interface.js.map
\ No newline at end of file
diff --git a/dist/modules/application/domain/repositories/application.interface.js.map b/dist/modules/application/domain/repositories/application.interface.js.map
new file mode 100644
index 0000000..906e160
--- /dev/null
+++ b/dist/modules/application/domain/repositories/application.interface.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"application.interface.js","sourceRoot":"","sources":["../../../../../src/modules/application/domain/repositories/application.interface.ts"],"names":[],"mappings":";;;AAEA,MAAsB,YAAY;CASjC;AATD,oCASC"}
\ No newline at end of file
diff --git a/dist/modules/application/infrastructure/mappers/prisma-application.mapper.js b/dist/modules/application/infrastructure/mappers/prisma-application.mapper.js
new file mode 100644
index 0000000..dd8942e
--- /dev/null
+++ b/dist/modules/application/infrastructure/mappers/prisma-application.mapper.js
@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaApplicationMapper = void 0;
+const application_entity_1 = require("../../domain/entities/application.entity");
+class PrismaApplicationMapper {
+    static toDomain(model) {
+        return application_entity_1.ApplicationData.restore({
+            id: model.id,
+            code: model.code,
+            name: model.name,
+            description: model.description,
+            icon: model.icon,
+            url: model.url,
+            applicationsClaim: model.applicationsClaim,
+            isActive: model.isActive,
+            displayOrder: model.displayOrder,
+            createdAt: model.createdAt,
+            updatedAt: model.updatedAt,
+        });
+    }
+}
+exports.PrismaApplicationMapper = PrismaApplicationMapper;
+//# sourceMappingURL=prisma-application.mapper.js.map
\ No newline at end of file
diff --git a/dist/modules/application/infrastructure/mappers/prisma-application.mapper.js.map b/dist/modules/application/infrastructure/mappers/prisma-application.mapper.js.map
new file mode 100644
index 0000000..4c74586
--- /dev/null
+++ b/dist/modules/application/infrastructure/mappers/prisma-application.mapper.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"prisma-application.mapper.js","sourceRoot":"","sources":["../../../../../src/modules/application/infrastructure/mappers/prisma-application.mapper.ts"],"names":[],"mappings":";;;AAAA,iFAA2E;AAE3E,MAAa,uBAAuB;IAClC,MAAM,CAAC,QAAQ,CAAC,KAAU;QACxB,OAAO,oCAAe,CAAC,OAAO,CAAC;YAC7B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,GAAG,EAAE,KAAK,CAAC,GAAG;YACd,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;YAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;CACF;AAhBD,0DAgBC"}
\ No newline at end of file
diff --git a/dist/modules/application/infrastructure/repositories/prisma-application.repository.js b/dist/modules/application/infrastructure/repositories/prisma-application.repository.js
new file mode 100644
index 0000000..50a273b
--- /dev/null
+++ b/dist/modules/application/infrastructure/repositories/prisma-application.repository.js
@@ -0,0 +1,98 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaApplicationRepository = void 0;
+const common_1 = require("@nestjs/common");
+const prisma_service_1 = require("../../../../shared/prisma.service");
+const prisma_application_mapper_1 = require("../mappers/prisma-application.mapper");
+let PrismaApplicationRepository = class PrismaApplicationRepository {
+    prisma;
+    constructor(prisma) {
+        this.prisma = prisma;
+    }
+    async find(params) {
+        const page = params.page && params.page > 0 ? params.page : 1;
+        const limit = params.limit && params.limit > 0 ? params.limit : 25;
+        const where = {};
+        if (params.search) {
+            where.OR = [
+                { name: { contains: params.search, mode: 'insensitive' } },
+                { code: { contains: params.search, mode: 'insensitive' } },
+                { description: { contains: params.search, mode: 'insensitive' } },
+            ];
+        }
+        if (params.isActive !== undefined && params.isActive !== null) {
+            where.isActive = params.isActive;
+        }
+        if (params.applicationsClaimIn && params.applicationsClaimIn.length > 0) {
+            where.applicationsClaim = { in: params.applicationsClaimIn };
+        }
+        const [total, items] = await Promise.all([
+            this.prisma.application.count({ where }),
+            this.prisma.application.findMany({ where, skip: (page - 1) * limit, take: limit, orderBy: { displayOrder: 'asc', createdAt: 'asc' } }),
+        ]);
+        return { data: items.map(i => prisma_application_mapper_1.PrismaApplicationMapper.toDomain(i)), total };
+    }
+    async findById(id) {
+        const row = await this.prisma.application.findUnique({ where: { id } });
+        if (!row)
+            throw new Error('Application not found');
+        return prisma_application_mapper_1.PrismaApplicationMapper.toDomain(row);
+    }
+    async findByCode(code) {
+        const row = await this.prisma.application.findUnique({ where: { code } });
+        if (!row)
+            return null;
+        return prisma_application_mapper_1.PrismaApplicationMapper.toDomain(row);
+    }
+    async findByApplicationsClaim(claim) {
+        const row = await this.prisma.application.findUnique({ where: { applicationsClaim: claim } });
+        if (!row)
+            return null;
+        return prisma_application_mapper_1.PrismaApplicationMapper.toDomain(row);
+    }
+    async create(app) {
+        const created = await this.prisma.application.create({ data: {
+                id: app.id,
+                code: app.code,
+                name: app.name,
+                description: app.description,
+                icon: app.icon,
+                url: app.url,
+                applicationsClaim: app.applicationsClaim,
+                isActive: app.isActive,
+                displayOrder: app.displayOrder,
+            } });
+        return prisma_application_mapper_1.PrismaApplicationMapper.toDomain(created);
+    }
+    async update(app) {
+        const updated = await this.prisma.application.update({ where: { id: app.id }, data: {
+                code: app.code,
+                name: app.name,
+                description: app.description,
+                icon: app.icon,
+                url: app.url,
+                applicationsClaim: app.applicationsClaim,
+                isActive: app.isActive,
+                displayOrder: app.displayOrder,
+            } });
+        return prisma_application_mapper_1.PrismaApplicationMapper.toDomain(updated);
+    }
+    async delete(appId) {
+        await this.prisma.application.delete({ where: { id: appId } });
+    }
+};
+exports.PrismaApplicationRepository = PrismaApplicationRepository;
+exports.PrismaApplicationRepository = PrismaApplicationRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [prisma_service_1.PrismaService])
+], PrismaApplicationRepository);
+//# sourceMappingURL=prisma-application.repository.js.map
\ No newline at end of file
diff --git a/dist/modules/application/infrastructure/repositories/prisma-application.repository.js.map b/dist/modules/application/infrastructure/repositories/prisma-application.repository.js.map
new file mode 100644
index 0000000..87825ed
--- /dev/null
+++ b/dist/modules/application/infrastructure/repositories/prisma-application.repository.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"prisma-application.repository.js","sourceRoot":"","sources":["../../../../../src/modules/application/infrastructure/repositories/prisma-application.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,sEAAkE;AAElE,oFAA+E;AAIxE,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACT;IAA7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD,KAAK,CAAC,IAAI,CAAC,MAAmI;QAC5I,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnE,MAAM,KAAK,GAAQ,EAAE,CAAC;QACtB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,CAAC,EAAE,GAAG;gBACT,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;gBAC1D,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;gBAC1D,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;aAClE,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC9D,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACnC,CAAC;QAED,IAAI,MAAM,CAAC,mBAAmB,IAAI,MAAM,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxE,KAAK,CAAC,iBAAiB,GAAG,EAAE,EAAE,EAAE,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/D,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;SACvI,CAAC,CAAC;QAEH,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,mDAAuB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACnD,OAAO,mDAAuB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,mDAAuB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACzC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,OAAO,mDAAuB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAoB;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE;gBAC3D,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;gBACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,YAAY,EAAE,GAAG,CAAC,YAAY;aAC/B,EAAE,CAAC,CAAC;QAEL,OAAO,mDAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAoB;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;gBAClF,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;gBACxC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,YAAY,EAAE,GAAG,CAAC,YAAY;aAC/B,EAAE,CAAC,CAAC;QAEL,OAAO,mDAAuB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACjE,CAAC;CACF,CAAA;AApFY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;qCAE0B,8BAAa;GADvC,2BAA2B,CAoFvC"}
\ No newline at end of file
diff --git a/dist/modules/application/presentation/controllers/applications.controller.js b/dist/modules/application/presentation/controllers/applications.controller.js
new file mode 100644
index 0000000..92d3eb3
--- /dev/null
+++ b/dist/modules/application/presentation/controllers/applications.controller.js
@@ -0,0 +1,136 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApplicationsController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const jwt_auth_guard_1 = require("../../../../core/auth/guards/jwt-auth.guard");
+const current_user_guard_1 = require("../../../identity/presentation/guards/current-user.guard");
+const get_applications_handler_1 = require("../../application/handlers/get-applications.handler");
+const get_application_handler_1 = require("../../application/handlers/get-application.handler");
+const create_application_handler_1 = require("../../application/handlers/create-application.handler");
+const update_application_handler_1 = require("../../application/handlers/update-application.handler");
+const delete_application_handler_1 = require("../../application/handlers/delete-application.handler");
+const get_me_applications_handler_1 = require("../../application/handlers/get-me-applications.handler");
+let ApplicationsController = class ApplicationsController {
+    getApplicationsHandler;
+    getApplicationHandler;
+    createApplicationHandler;
+    updateApplicationHandler;
+    deleteApplicationHandler;
+    getMeApplicationsHandler;
+    constructor(getApplicationsHandler, getApplicationHandler, createApplicationHandler, updateApplicationHandler, deleteApplicationHandler, getMeApplicationsHandler) {
+        this.getApplicationsHandler = getApplicationsHandler;
+        this.getApplicationHandler = getApplicationHandler;
+        this.createApplicationHandler = createApplicationHandler;
+        this.updateApplicationHandler = updateApplicationHandler;
+        this.deleteApplicationHandler = deleteApplicationHandler;
+        this.getMeApplicationsHandler = getMeApplicationsHandler;
+    }
+    async findAll(query) {
+        const res = await this.getApplicationsHandler.execute({ page: query.page, limit: query.limit, search: query.search });
+        return { success: true, data: res.data.map(a => a.toResponse ? a.toResponse() : a), meta: { total: res.total } };
+    }
+    async findOne(id) {
+        const app = await this.getApplicationHandler.execute(id);
+        return { success: true, data: app.toResponse(), meta: {} };
+    }
+    async create(body) {
+        const created = await this.createApplicationHandler.execute(body);
+        return { success: true, data: created.toResponse(), meta: {} };
+    }
+    async update(id, body) {
+        const updated = await this.updateApplicationHandler.execute(id, body);
+        return { success: true, data: updated.toResponse(), meta: {} };
+    }
+    async remove(id) {
+        await this.deleteApplicationHandler.execute(id);
+        return { success: true, data: null, meta: {} };
+    }
+    // Dashboard endpoint
+    async me(req) {
+        const ctx = req.raylabContext;
+        const identity = ctx && ctx.identity ? ctx.identity : {};
+        const applicationsClaimList = identity.applications || [];
+        const res = await this.getMeApplicationsHandler.execute(applicationsClaimList);
+        return { success: true, data: res.data.map(a => a.toResponse ? a.toResponse() : a), meta: { total: res.total } };
+    }
+};
+exports.ApplicationsController = ApplicationsController;
+__decorate([
+    (0, common_1.Get)('applications'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard, current_user_guard_1.CurrentUserGuard),
+    (0, swagger_1.ApiOperation)({ summary: 'List applications' }),
+    __param(0, (0, common_1.Query)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ApplicationsController.prototype, "findAll", null);
+__decorate([
+    (0, common_1.Get)('applications/:id'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard, current_user_guard_1.CurrentUserGuard),
+    (0, swagger_1.ApiOperation)({ summary: 'Get application by id' }),
+    __param(0, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], ApplicationsController.prototype, "findOne", null);
+__decorate([
+    (0, common_1.Post)('applications'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard, current_user_guard_1.CurrentUserGuard),
+    (0, swagger_1.ApiOperation)({ summary: 'Create application' }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ApplicationsController.prototype, "create", null);
+__decorate([
+    (0, common_1.Patch)('applications/:id'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard, current_user_guard_1.CurrentUserGuard),
+    (0, swagger_1.ApiOperation)({ summary: 'Update application' }),
+    __param(0, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], ApplicationsController.prototype, "update", null);
+__decorate([
+    (0, common_1.Delete)('applications/:id'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard, current_user_guard_1.CurrentUserGuard),
+    (0, swagger_1.ApiOperation)({ summary: 'Delete application' }),
+    __param(0, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], ApplicationsController.prototype, "remove", null);
+__decorate([
+    (0, common_1.Get)('me/applications'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard, current_user_guard_1.CurrentUserGuard),
+    (0, swagger_1.ApiOperation)({ summary: "Get current user's applications (filtered by Authentik claims)" }),
+    __param(0, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ApplicationsController.prototype, "me", null);
+exports.ApplicationsController = ApplicationsController = __decorate([
+    (0, swagger_1.ApiTags)('Applications'),
+    (0, common_1.Controller)(),
+    __metadata("design:paramtypes", [get_applications_handler_1.GetApplicationsHandler,
+        get_application_handler_1.GetApplicationHandler,
+        create_application_handler_1.CreateApplicationHandler,
+        update_application_handler_1.UpdateApplicationHandler,
+        delete_application_handler_1.DeleteApplicationHandler,
+        get_me_applications_handler_1.GetMeApplicationsHandler])
+], ApplicationsController);
+//# sourceMappingURL=applications.controller.js.map
\ No newline at end of file
diff --git a/dist/modules/application/presentation/controllers/applications.controller.js.map b/dist/modules/application/presentation/controllers/applications.controller.js.map
new file mode 100644
index 0000000..29a4e4a
--- /dev/null
+++ b/dist/modules/application/presentation/controllers/applications.controller.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"applications.controller.js","sourceRoot":"","sources":["../../../../../src/modules/application/presentation/controllers/applications.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA0G;AAC1G,6CAAwD;AACxD,gFAA2E;AAC3E,iGAA4F;AAC5F,kGAA6F;AAC7F,gGAA2F;AAC3F,sGAAiG;AACjG,sGAAiG;AACjG,sGAAiG;AACjG,wGAAkG;AAI3F,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAEd;IACA;IACA;IACA;IACA;IACA;IANnB,YACmB,sBAA8C,EAC9C,qBAA4C,EAC5C,wBAAkD,EAClD,wBAAkD,EAClD,wBAAkD,EAClD,wBAAkD;QALlD,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,6BAAwB,GAAxB,wBAAwB,CAA0B;IAClE,CAAC;IAKE,AAAN,KAAK,CAAC,OAAO,CAAU,KAAU;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IACnH,CAAC;IAKK,AAAN,KAAK,CAAC,OAAO,CAAc,EAAU;QACnC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC7D,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAS,IAAS;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAc,EAAU,EAAU,IAAS;QACrD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACtE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjE,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAc,EAAU;QAClC,MAAM,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjD,CAAC;IAED,qBAAqB;IAIf,AAAN,KAAK,CAAC,EAAE,CAAQ,GAAQ;QACtB,MAAM,GAAG,GAAG,GAAG,CAAC,aAAa,CAAC;QAC9B,MAAM,QAAQ,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,qBAAqB,GAAG,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QAC/E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IACnH,CAAC;CACF,CAAA;AA9DY,wDAAsB;AAa3B;IAHL,IAAA,YAAG,EAAC,cAAc,CAAC;IACnB,IAAA,kBAAS,EAAC,6BAAY,EAAE,qCAAgB,CAAC;IACzC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAChC,WAAA,IAAA,cAAK,GAAE,CAAA;;;;qDAGrB;AAKK;IAHL,IAAA,YAAG,EAAC,kBAAkB,CAAC;IACvB,IAAA,kBAAS,EAAC,6BAAY,EAAE,qCAAgB,CAAC;IACzC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC;IACpC,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;qDAGzB;AAKK;IAHL,IAAA,aAAI,EAAC,cAAc,CAAC;IACpB,IAAA,kBAAS,EAAC,6BAAY,EAAE,qCAAgB,CAAC;IACzC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAClC,WAAA,IAAA,aAAI,GAAE,CAAA;;;;oDAGnB;AAKK;IAHL,IAAA,cAAK,EAAC,kBAAkB,CAAC;IACzB,IAAA,kBAAS,EAAC,6BAAY,EAAE,qCAAgB,CAAC;IACzC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAClC,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IAAc,WAAA,IAAA,aAAI,GAAE,CAAA;;;;oDAG5C;AAKK;IAHL,IAAA,eAAM,EAAC,kBAAkB,CAAC;IAC1B,IAAA,kBAAS,EAAC,6BAAY,EAAE,qCAAgB,CAAC;IACzC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;IAClC,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;oDAGxB;AAMK;IAHL,IAAA,YAAG,EAAC,iBAAiB,CAAC;IACtB,IAAA,kBAAS,EAAC,6BAAY,EAAE,qCAAgB,CAAC;IACzC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC;IAClF,WAAA,IAAA,YAAG,GAAE,CAAA;;;;gDAOd;iCA7DU,sBAAsB;IAFlC,IAAA,iBAAO,EAAC,cAAc,CAAC;IACvB,IAAA,mBAAU,GAAE;qCAGgC,iDAAsB;QACvB,+CAAqB;QAClB,qDAAwB;QACxB,qDAAwB;QACxB,qDAAwB;QACxB,sDAAwB;GAP1D,sBAAsB,CA8DlC"}
\ No newline at end of file
diff --git a/dist/modules/audit/audit.event-handler.js b/dist/modules/audit/audit.event-handler.js
new file mode 100644
index 0000000..ad7e864
--- /dev/null
+++ b/dist/modules/audit/audit.event-handler.js
@@ -0,0 +1,65 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AuditEventHandler_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditEventHandler = void 0;
+const common_1 = require("@nestjs/common");
+const event_bus_service_1 = require("../../core/event-bus/event-bus.service");
+const audit_service_1 = require("./audit.service");
+let AuditEventHandler = AuditEventHandler_1 = class AuditEventHandler {
+    events;
+    auditService;
+    logger = new common_1.Logger(AuditEventHandler_1.name);
+    constructor(events, auditService) {
+        this.events = events;
+        this.auditService = auditService;
+        this.events.subscribe('RolesSynchronized', (e) => this.handleRolesSynchronized(e));
+        this.events.subscribe('UserAuthenticated', (e) => this.handleUserAuthenticated(e));
+        this.events.subscribe('RoleCreated', (e) => this.handleGeneric(e));
+        this.events.subscribe('RoleUpdated', (e) => this.handleGeneric(e));
+        this.events.subscribe('RoleDeleted', (e) => this.handleGeneric(e));
+        this.events.subscribe('PermissionCreated', (e) => this.handleGeneric(e));
+        this.events.subscribe('PermissionUpdated', (e) => this.handleGeneric(e));
+        this.events.subscribe('PermissionDeleted', (e) => this.handleGeneric(e));
+        this.events.subscribe('UserActivated', (e) => this.handleGeneric(e));
+        this.events.subscribe('UserDeactivated', (e) => this.handleGeneric(e));
+    }
+    async handleRolesSynchronized(event) {
+        try {
+            await this.auditService.createFromEvent(event);
+        }
+        catch (e) {
+            this.logger.error('Audit handler failed', e);
+        }
+    }
+    async handleUserAuthenticated(event) {
+        try {
+            await this.auditService.createFromEvent(event);
+        }
+        catch (e) {
+            this.logger.error('Audit handler failed', e);
+        }
+    }
+    async handleGeneric(event) {
+        try {
+            await this.auditService.createFromEvent(event);
+        }
+        catch (e) {
+            this.logger.error('Audit handler failed', e);
+        }
+    }
+};
+exports.AuditEventHandler = AuditEventHandler;
+exports.AuditEventHandler = AuditEventHandler = AuditEventHandler_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [event_bus_service_1.EventBus, audit_service_1.AuditService])
+], AuditEventHandler);
+//# sourceMappingURL=audit.event-handler.js.map
\ No newline at end of file
diff --git a/dist/modules/audit/audit.event-handler.js.map b/dist/modules/audit/audit.event-handler.js.map
new file mode 100644
index 0000000..e0434a4
--- /dev/null
+++ b/dist/modules/audit/audit.event-handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"audit.event-handler.js","sourceRoot":"","sources":["../../../src/modules/audit/audit.event-handler.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,8EAAkE;AAElE,mDAA+C;AAGxC,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAGC;IAAmC;IAF/C,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAE7D,YAA6B,MAAgB,EAAmB,YAA0B;QAA7D,WAAM,GAAN,MAAM,CAAU;QAAmB,iBAAY,GAAZ,YAAY,CAAc;QACxF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAAyB;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAQ,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,KAAyB;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAQ,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAyB;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,EAAE,CAAQ,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;CACF,CAAA;AAvCY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAI0B,4BAAQ,EAAiC,4BAAY;GAH/E,iBAAiB,CAuC7B"}
\ No newline at end of file
diff --git a/dist/modules/audit/audit.module.js b/dist/modules/audit/audit.module.js
new file mode 100644
index 0000000..efa72d9
--- /dev/null
+++ b/dist/modules/audit/audit.module.js
@@ -0,0 +1,24 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditModule = void 0;
+const common_1 = require("@nestjs/common");
+const audit_service_1 = require("./audit.service");
+const audit_event_handler_1 = require("./audit.event-handler");
+const prisma_service_1 = require("../../shared/prisma.service");
+const event_bus_service_1 = require("../../core/event-bus/event-bus.service");
+let AuditModule = class AuditModule {
+};
+exports.AuditModule = AuditModule;
+exports.AuditModule = AuditModule = __decorate([
+    (0, common_1.Module)({
+        providers: [audit_service_1.AuditService, audit_event_handler_1.AuditEventHandler, prisma_service_1.PrismaService, event_bus_service_1.EventBus],
+        exports: [audit_service_1.AuditService],
+    })
+], AuditModule);
+//# sourceMappingURL=audit.module.js.map
\ No newline at end of file
diff --git a/dist/modules/audit/audit.module.js.map b/dist/modules/audit/audit.module.js.map
new file mode 100644
index 0000000..e4509ad
--- /dev/null
+++ b/dist/modules/audit/audit.module.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"audit.module.js","sourceRoot":"","sources":["../../../src/modules/audit/audit.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,mDAA+C;AAC/C,+DAA0D;AAC1D,gEAA4D;AAC5D,8EAAkE;AAM3D,IAAM,WAAW,GAAjB,MAAM,WAAW;CAAG,CAAA;AAAd,kCAAW;sBAAX,WAAW;IAJvB,IAAA,eAAM,EAAC;QACN,SAAS,EAAE,CAAC,4BAAY,EAAE,uCAAiB,EAAE,8BAAa,EAAE,4BAAQ,CAAC;QACrE,OAAO,EAAE,CAAC,4BAAY,CAAC;KACxB,CAAC;GACW,WAAW,CAAG"}
\ No newline at end of file
diff --git a/dist/modules/audit/audit.service.js b/dist/modules/audit/audit.service.js
new file mode 100644
index 0000000..fbe5659
--- /dev/null
+++ b/dist/modules/audit/audit.service.js
@@ -0,0 +1,46 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AuditService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditService = void 0;
+const common_1 = require("@nestjs/common");
+const prisma_service_1 = require("../../shared/prisma.service");
+let AuditService = AuditService_1 = class AuditService {
+    prisma;
+    logger = new common_1.Logger(AuditService_1.name);
+    constructor(prisma) {
+        this.prisma = prisma;
+    }
+    async createFromEvent(event) {
+        try {
+            // Map standard events to AuditLog entries
+            await this.prisma.auditLog.create({
+                data: {
+                    userId: event.payload?.userId || null,
+                    action: event.type,
+                    resource: event.payload?.resource || null,
+                    resourceId: event.payload?.resourceId || null,
+                    details: event.payload,
+                    createdAt: new Date(event.timestamp),
+                },
+            });
+        }
+        catch (e) {
+            this.logger.error('Failed to write audit log', e);
+        }
+    }
+};
+exports.AuditService = AuditService;
+exports.AuditService = AuditService = AuditService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [prisma_service_1.PrismaService])
+], AuditService);
+//# sourceMappingURL=audit.service.js.map
\ No newline at end of file
diff --git a/dist/modules/audit/audit.service.js.map b/dist/modules/audit/audit.service.js.map
new file mode 100644
index 0000000..3ee3df5
--- /dev/null
+++ b/dist/modules/audit/audit.service.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"audit.service.js","sourceRoot":"","sources":["../../../src/modules/audit/audit.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,gEAA4D;AAIrD,IAAM,YAAY,oBAAlB,MAAM,YAAY;IAGM;IAFZ,MAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAExD,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD,KAAK,CAAC,eAAe,CAAC,KAAyB;QAC7C,IAAI,CAAC;YACH,0CAA0C;YAC1C,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAChC,IAAI,EAAE;oBACJ,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,IAAI,IAAI;oBACrC,MAAM,EAAE,KAAK,CAAC,IAAI;oBAClB,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,IAAI,IAAI;oBACzC,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,IAAI,IAAI;oBAC7C,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,SAAS,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC;iBACrC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE,CAAQ,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF,CAAA;AAtBY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;qCAI0B,8BAAa;GAHvC,YAAY,CAsBxB"}
\ No newline at end of file
diff --git a/dist/modules/auth/auth.controller.js b/dist/modules/auth/auth.controller.js
new file mode 100644
index 0000000..3052f6a
--- /dev/null
+++ b/dist/modules/auth/auth.controller.js
@@ -0,0 +1,110 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const auth_service_1 = require("./auth.service");
+let AuthController = class AuthController {
+    authService;
+    constructor(authService) {
+        this.authService = authService;
+    }
+    async login(returnTo, res) {
+        const redirect = await this.authService.createAuthorizationRedirect(returnTo);
+        return res.redirect(302, redirect);
+    }
+    async callback(code, state, res) {
+        const result = await this.authService.handleCallback(code, state);
+        // set cookies
+        const cookieOptions = {
+            httpOnly: true,
+            secure: process.env.NODE_ENV === 'production',
+            sameSite: 'lax',
+            path: '/',
+        };
+        // access token cookie (internal JWT)
+        res.cookie('raylab_jwt', result.accessToken, { ...cookieOptions, maxAge: result.expiresIn * 1000 });
+        // refresh token cookie
+        res.cookie('raylab_refresh', result.refreshToken, { ...cookieOptions, maxAge: result.refreshTtl * 1000 });
+        return res.redirect(302, result.returnTo || '/');
+    }
+    async logout(req, res) {
+        const refreshToken = req.cookies?.raylab_refresh || req.body?.refreshToken;
+        const redirect = await this.authService.logout(refreshToken);
+        return res.redirect(302, redirect);
+    }
+    async refresh(req) {
+        const refreshToken = req.cookies?.raylab_refresh || req.body?.refreshToken;
+        const result = await this.authService.refresh(refreshToken);
+        return { success: true, data: result };
+    }
+    async me(req) {
+        const token = (req.cookies?.raylab_jwt) || (req.headers.authorization && req.headers.authorization.replace(/^Bearer\s+/i, ''));
+        const user = await this.authService.me(token);
+        return { success: true, data: user };
+    }
+};
+exports.AuthController = AuthController;
+__decorate([
+    (0, common_1.Get)('login'),
+    (0, swagger_1.ApiOperation)({ summary: 'Start Authorization Code + PKCE login (redirect to Identity Provider)' }),
+    __param(0, (0, common_1.Query)('returnTo')),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "login", null);
+__decorate([
+    (0, common_1.Get)('callback'),
+    (0, swagger_1.ApiOperation)({ summary: 'OIDC callback endpoint' }),
+    __param(0, (0, common_1.Query)('code')),
+    __param(1, (0, common_1.Query)('state')),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "callback", null);
+__decorate([
+    (0, common_1.Post)('logout'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({ summary: 'Logout (invalidate internal session and redirect to identity provider logout)' }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "logout", null);
+__decorate([
+    (0, common_1.Post)('refresh'),
+    (0, swagger_1.ApiOperation)({ summary: 'Refresh internal JWT using internal refresh token' }),
+    __param(0, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "refresh", null);
+__decorate([
+    (0, common_1.Get)('me'),
+    (0, swagger_1.ApiOperation)({ summary: 'Get current user from internal JWT (cookie or Authorization header)' }),
+    __param(0, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "me", null);
+exports.AuthController = AuthController = __decorate([
+    (0, swagger_1.ApiTags)('Auth'),
+    (0, common_1.Controller)('auth'),
+    __metadata("design:paramtypes", [auth_service_1.AuthService])
+], AuthController);
+//# sourceMappingURL=auth.controller.js.map
\ No newline at end of file
diff --git a/dist/modules/auth/auth.controller.js.map b/dist/modules/auth/auth.controller.js.map
new file mode 100644
index 0000000..33fa0bb
--- /dev/null
+++ b/dist/modules/auth/auth.controller.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AACA,2CAAoG;AACpG,6CAAwD;AACxD,iDAA6C;AAKtC,IAAM,cAAc,GAApB,MAAM,cAAc;IACI;IAA7B,YAA6B,WAAwB;QAAxB,gBAAW,GAAX,WAAW,CAAa;IAAG,CAAC;IAInD,AAAN,KAAK,CAAC,KAAK,CAAoB,QAA4B,EAAS,GAAa;QAC/E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QAC9E,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAIK,AAAN,KAAK,CAAC,QAAQ,CAAgB,IAAY,EAAkB,KAAa,EAAS,GAAa;QAC7F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAElE,cAAc;QACd,MAAM,aAAa,GAAQ;YACzB,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY;YAC7C,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;SACV,CAAC;QAEF,qCAAqC;QACrC,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,GAAG,IAAI,EAAE,CAAC,CAAC;QAEpG,uBAAuB;QACvB,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,GAAG,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC,CAAC;QAE1G,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,CAAC;IACnD,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAQ,GAAY,EAAS,GAAa;QACpD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,EAAE,cAAc,IAAI,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC;QAC3E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7D,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrC,CAAC;IAIK,AAAN,KAAK,CAAC,OAAO,CAAQ,GAAY;QAC/B,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,EAAE,cAAc,IAAI,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACzC,CAAC;IAIK,AAAN,KAAK,CAAC,EAAE,CAAQ,GAAY;QAC1B,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,IAAK,GAAG,CAAC,OAAO,CAAC,aAAwB,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC;QAC3I,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;CACF,CAAA;AAxDY,wCAAc;AAKnB;IAFL,IAAA,YAAG,EAAC,OAAO,CAAC;IACZ,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,uEAAuE,EAAE,CAAC;IACtF,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAgC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2CAGlE;AAIK;IAFL,IAAA,YAAG,EAAC,UAAU,CAAC;IACf,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACpC,WAAA,IAAA,cAAK,EAAC,MAAM,CAAC,CAAA;IAAgB,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IAAiB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8CAkBhF;AAKK;IAHL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+EAA+E,EAAE,CAAC;IAC7F,WAAA,IAAA,YAAG,GAAE,CAAA;IAAgB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;4CAIvC;AAIK;IAFL,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC;IAChE,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6CAInB;AAIK;IAFL,IAAA,YAAG,EAAC,IAAI,CAAC;IACT,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qEAAqE,EAAE,CAAC;IACvF,WAAA,IAAA,YAAG,GAAE,CAAA;;;;wCAId;yBAvDU,cAAc;IAF1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,MAAM,CAAC;qCAEyB,0BAAW;GAD1C,cAAc,CAwD1B"}
\ No newline at end of file
diff --git a/dist/modules/auth/auth.module.js b/dist/modules/auth/auth.module.js
new file mode 100644
index 0000000..a07a073
--- /dev/null
+++ b/dist/modules/auth/auth.module.js
@@ -0,0 +1,75 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthModule = void 0;
+const common_1 = require("@nestjs/common");
+const auth_controller_1 = require("./auth.controller");
+const auth_service_1 = require("./auth.service");
+const config_1 = require("@nestjs/config");
+const jwt_1 = require("@nestjs/jwt");
+const prisma_service_1 = require("../../shared/prisma.service");
+const user_interface_1 = require("../identity/domain/repositories/user.interface");
+const prisma_user_repository_1 = require("../identity/infrastructure/repositories/prisma-user.repository");
+const sync_identity_handler_1 = require("../identity/application/handlers/user/sync-identity.handler");
+const role_interface_1 = require("../identity/domain/repositories/role.interface");
+const prisma_role_repository_1 = require("../identity/infrastructure/repositories/prisma-role.repository");
+const i_auth_config_1 = require("../identity/application/config/i-auth-config");
+const env_auth_config_1 = require("../identity/application/config/env-auth-config");
+const redis_pkce_store_1 = require("./pkce/redis-pkce.store");
+const inmemory_refresh_store_1 = require("./refresh/inmemory-refresh.store");
+const oidc_service_1 = require("./oidc.service");
+const role_sync_service_1 = require("./role-sync.service");
+const redis_service_1 = require("../../shared/redis.service");
+const group_hash_service_1 = require("./group-hash.service");
+const authentication_service_1 = require("./authentication.service");
+const event_bus_service_1 = require("../../core/event-bus/event-bus.service");
+const audit_service_1 = require("../audit/audit.service");
+const authorization_module_1 = require("../authorization/authorization.module");
+let AuthModule = class AuthModule {
+};
+exports.AuthModule = AuthModule;
+exports.AuthModule = AuthModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            config_1.ConfigModule,
+            authorization_module_1.AuthorizationModule,
+            jwt_1.JwtModule.registerAsync({
+                imports: [config_1.ConfigModule],
+                useFactory: async (config) => ({
+                    secret: config.get('RAYLAB_JWT_SECRET') || 'raylab-secret',
+                    signOptions: { algorithm: 'HS256' },
+                }),
+                inject: [config_1.ConfigService],
+            }),
+        ],
+        controllers: [auth_controller_1.AuthController],
+        providers: [
+            auth_service_1.AuthService,
+            prisma_service_1.PrismaService,
+            prisma_user_repository_1.PrismaUserRepository,
+            prisma_role_repository_1.PrismaRoleRepository,
+            sync_identity_handler_1.SyncIdentityHandler,
+            { provide: user_interface_1.IUser, useClass: prisma_user_repository_1.PrismaUserRepository },
+            { provide: role_interface_1.IRole, useClass: prisma_role_repository_1.PrismaRoleRepository },
+            { provide: i_auth_config_1.IAuthConfig, useClass: env_auth_config_1.EnvAuthConfig },
+            // In-memory PKCE and Refresh stores (Redis removed)
+            redis_pkce_store_1.RedisPkceStore,
+            inmemory_refresh_store_1.InMemoryRefreshStore,
+            // OIDC & Role Sync
+            oidc_service_1.OidcService,
+            role_sync_service_1.RoleSyncService,
+            group_hash_service_1.GroupHashService,
+            authentication_service_1.AuthenticationService,
+            event_bus_service_1.EventBus,
+            audit_service_1.AuditService,
+            redis_service_1.RedisService,
+        ],
+        exports: [auth_service_1.AuthService, oidc_service_1.OidcService, role_sync_service_1.RoleSyncService, authentication_service_1.AuthenticationService, event_bus_service_1.EventBus],
+    })
+], AuthModule);
+//# sourceMappingURL=auth.module.js.map
\ No newline at end of file
diff --git a/dist/modules/auth/auth.module.js.map b/dist/modules/auth/auth.module.js.map
new file mode 100644
index 0000000..4cdac68
--- /dev/null
+++ b/dist/modules/auth/auth.module.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,uDAAmD;AACnD,iDAA6C;AAC7C,2CAA6D;AAC7D,qCAAwC;AACxC,gEAA4D;AAC5D,mFAAuE;AACvE,2GAAsG;AACtG,uGAAkG;AAClG,mFAAuE;AACvE,2GAAsG;AACtG,gFAA2E;AAC3E,oFAA+E;AAC/E,8DAAyD;AACzD,6EAAwE;AACxE,iDAA6C;AAC7C,2DAAsD;AACtD,8DAA0D;AAC1D,6DAAwD;AACxD,qEAAiE;AACjE,8EAAkE;AAClE,0DAAsD;AACtD,gFAA4E;AA0CrE,IAAM,UAAU,GAAhB,MAAM,UAAU;CAAG,CAAA;AAAb,gCAAU;qBAAV,UAAU;IAvCtB,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,qBAAY;YACZ,0CAAmB;YACnB,eAAS,CAAC,aAAa,CAAC;gBACtB,OAAO,EAAE,CAAC,qBAAY,CAAC;gBACvB,UAAU,EAAE,KAAK,EAAE,MAAqB,EAAE,EAAE,CAAC,CAAC;oBAC5C,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,eAAe;oBAC1D,WAAW,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE;iBACpC,CAAC;gBACF,MAAM,EAAE,CAAC,sBAAa,CAAC;aACxB,CAAC;SACH;QACD,WAAW,EAAE,CAAC,gCAAc,CAAC;QAC7B,SAAS,EAAE;YACT,0BAAW;YACX,8BAAa;YACb,6CAAoB;YACpB,6CAAoB;YACpB,2CAAmB;YACnB,EAAE,OAAO,EAAE,sBAAK,EAAE,QAAQ,EAAE,6CAAoB,EAAE;YAClD,EAAE,OAAO,EAAE,sBAAK,EAAE,QAAQ,EAAE,6CAAoB,EAAE;YAClD,EAAE,OAAO,EAAE,2BAAW,EAAE,QAAQ,EAAE,+BAAa,EAAE;YAEjD,oDAAoD;YACpD,iCAAc;YACd,6CAAoB;YAEpB,mBAAmB;YACnB,0BAAW;YACX,mCAAe;YACf,qCAAgB;YAChB,8CAAqB;YACrB,4BAAQ;YACR,4BAAY;YACZ,4BAAY;SACb;QACD,OAAO,EAAE,CAAC,0BAAW,EAAE,0BAAW,EAAE,mCAAe,EAAE,8CAAqB,EAAE,4BAAQ,CAAC;KACtF,CAAC;GACW,UAAU,CAAG"}
\ No newline at end of file
diff --git a/dist/modules/auth/auth.service.js b/dist/modules/auth/auth.service.js
new file mode 100644
index 0000000..754d15e
--- /dev/null
+++ b/dist/modules/auth/auth.service.js
@@ -0,0 +1,209 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const jwt_1 = require("@nestjs/jwt");
+const sync_identity_handler_1 = require("../identity/application/handlers/user/sync-identity.handler");
+const user_interface_1 = require("../identity/domain/repositories/user.interface");
+const prisma_service_1 = require("../../shared/prisma.service");
+const redis_pkce_store_1 = require("./pkce/redis-pkce.store");
+const inmemory_refresh_store_1 = require("./refresh/inmemory-refresh.store");
+const openidClient = require('openid-client');
+let AuthService = class AuthService {
+    config;
+    jwtService;
+    prisma;
+    userRepository;
+    syncIdentityHandler;
+    pkceStore;
+    refreshStore;
+    constructor(config, jwtService, prisma, userRepository, syncIdentityHandler, pkceStore, refreshStore) {
+        this.config = config;
+        this.jwtService = jwtService;
+        this.prisma = prisma;
+        this.userRepository = userRepository;
+        this.syncIdentityHandler = syncIdentityHandler;
+        this.pkceStore = pkceStore;
+        this.refreshStore = refreshStore;
+    }
+    issuer = null;
+    client = null;
+    async getIssuer() {
+        if (this.issuer)
+            return this.issuer;
+        const issuerUrl = this.config.get('AUTHENTIK_ISSUER');
+        if (!issuerUrl)
+            throw new Error('AUTHENTIK_ISSUER not configured');
+        this.issuer = await openidClient.Issuer.discover(issuerUrl);
+        return this.issuer;
+    }
+    async getClient() {
+        if (this.client)
+            return this.client;
+        const issuer = await this.getIssuer();
+        const clientId = this.config.get('AUTHENTIK_CLIENT_ID');
+        const clientSecret = this.config.get('AUTHENTIK_CLIENT_SECRET');
+        if (!clientId)
+            throw new Error('AUTHENTIK_CLIENT_ID not configured');
+        this.client = new issuer.Client({ client_id: clientId, client_secret: clientSecret });
+        return this.client;
+    }
+    async createAuthorizationRedirect(returnTo) {
+        const client = await this.getClient();
+        const redirectUri = this.config.get('AUTH_CALLBACK_URL') || `${this.config.get('APP_URL') || ''}/auth/callback`;
+        const state = require('crypto').randomUUID();
+        const code_verifier = openidClient.generators.codeVerifier();
+        const code_challenge = await openidClient.generators.codeChallenge(code_verifier);
+        const nonce = openidClient.generators.nonce();
+        await this.pkceStore.save(state, { code_verifier, nonce, returnTo }, 300);
+        const url = client.authorizationUrl({
+            redirect_uri: redirectUri,
+            scope: this.config.get('AUTHENTIK_DEFAULT_SCOPE') || 'openid email profile',
+            response_type: 'code',
+            code_challenge,
+            code_challenge_method: 'S256',
+            state,
+            nonce,
+        });
+        return url;
+    }
+    async handleCallback(code, state) {
+        const client = await this.getClient();
+        const pkce = await this.pkceStore.get(state);
+        if (!pkce)
+            throw new common_1.UnauthorizedException('Invalid or expired state');
+        // remove one-time state
+        await this.pkceStore.remove(state);
+        const redirectUri = this.config.get('AUTH_CALLBACK_URL') || `${this.config.get('APP_URL') || ''}/auth/callback`;
+        // exchange code
+        const tokenSet = await client.callback(redirectUri, { code, state }, { code_verifier: pkce.code_verifier, nonce: pkce.nonce });
+        // verify id_token and get claims
+        const claims = tokenSet.claims();
+        // fetch userinfo if available
+        let userInfo = null;
+        try {
+            if (tokenSet.access_token && client.userinfo) {
+                userInfo = await client.userinfo(tokenSet.access_token);
+            }
+        }
+        catch (e) {
+            // ignore
+        }
+        const identity = {
+            sub: userInfo?.sub || claims.sub || null,
+            preferred_username: userInfo?.preferred_username || userInfo?.username || userInfo?.email || claims.preferred_username || claims.email,
+            email: userInfo?.email || claims.email,
+            raw: { tokenSet, userInfo, claims },
+        };
+        // Sync identity to local user (create if needed)
+        const domainUser = await this.syncIdentityHandler.execute(identity);
+        // ensure active/not deleted
+        if (!domainUser.isActive)
+            throw new common_1.UnauthorizedException('User is not active');
+        if (domainUser.deletedAt)
+            throw new common_1.UnauthorizedException('User is deleted');
+        // create internal JWT
+        const jwtPayload = {
+            sub: domainUser.id,
+            preferred_username: domainUser.username,
+            email: domainUser.email,
+        };
+        const expiresIn = Number(this.config.get('RAYLAB_JWT_EXPIRES_IN') || 3600);
+        const access = this.jwtService.sign(jwtPayload, { expiresIn });
+        // create internal refresh token
+        const refreshToken = require('crypto').randomUUID();
+        const refreshTtl = Number(this.config.get('RAYLAB_REFRESH_EXPIRES_IN') || 30 * 24 * 3600); // default 30 days
+        await this.refreshStore.set(refreshToken, { userId: domainUser.id }, refreshTtl);
+        return {
+            accessToken: access,
+            refreshToken,
+            expiresIn,
+            refreshTtl,
+            user: {
+                id: domainUser.id,
+                username: domainUser.username,
+                email: domainUser.email,
+                roles: domainUser.roles || [],
+            },
+            returnTo: pkce.returnTo,
+        };
+    }
+    async refresh(refreshToken) {
+        if (!refreshToken)
+            throw new common_1.UnauthorizedException('Missing refresh token');
+        const data = await this.refreshStore.get(refreshToken);
+        if (!data)
+            throw new common_1.UnauthorizedException('Invalid refresh token');
+        const userId = data.userId;
+        // load user
+        const domainUser = await this.userRepository.getById(userId);
+        if (!domainUser)
+            throw new common_1.UnauthorizedException('User not found');
+        if (!domainUser.isActive)
+            throw new common_1.UnauthorizedException('User is not active');
+        // rotate refresh token
+        await this.refreshStore.del(refreshToken);
+        const newRefresh = require('crypto').randomUUID();
+        const refreshTtl = Number(this.config.get('RAYLAB_REFRESH_EXPIRES_IN') || 30 * 24 * 3600);
+        await this.refreshStore.set(newRefresh, { userId }, refreshTtl);
+        const expiresIn = Number(this.config.get('RAYLAB_JWT_EXPIRES_IN') || 3600);
+        const access = this.jwtService.sign({ sub: domainUser.id, preferred_username: domainUser.username, email: domainUser.email }, { expiresIn });
+        return { accessToken: access, refreshToken: newRefresh, expiresIn, refreshTtl };
+    }
+    async logout(refreshToken) {
+        if (refreshToken) {
+            await this.refreshStore.del(refreshToken);
+        }
+        const issuer = await this.getIssuer();
+        const endSession = issuer.metadata.end_session_endpoint;
+        const postLogout = this.config.get('APP_URL') || '/';
+        if (endSession) {
+            // Redirect to identity provider logout
+            const url = new URL(endSession);
+            if (postLogout)
+                url.searchParams.set('post_logout_redirect_uri', postLogout);
+            return url.toString();
+        }
+        return postLogout;
+    }
+    async me(token) {
+        if (!token)
+            throw new common_1.UnauthorizedException('Missing token');
+        try {
+            const payload = this.jwtService.verify(token);
+            const user = await this.userRepository.getById(payload.sub);
+            if (!user)
+                throw new common_1.UnauthorizedException('User not found');
+            return { id: user.id, username: user.username, email: user.email, roles: user.roles || [] };
+        }
+        catch (e) {
+            throw new common_1.UnauthorizedException('Invalid token');
+        }
+    }
+};
+exports.AuthService = AuthService;
+exports.AuthService = AuthService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(3, (0, common_1.Inject)(user_interface_1.IUser)),
+    __metadata("design:paramtypes", [config_1.ConfigService,
+        jwt_1.JwtService,
+        prisma_service_1.PrismaService,
+        user_interface_1.IUser,
+        sync_identity_handler_1.SyncIdentityHandler,
+        redis_pkce_store_1.RedisPkceStore,
+        inmemory_refresh_store_1.InMemoryRefreshStore])
+], AuthService);
+//# sourceMappingURL=auth.service.js.map
\ No newline at end of file
diff --git a/dist/modules/auth/auth.service.js.map b/dist/modules/auth/auth.service.js.map
new file mode 100644
index 0000000..9581060
--- /dev/null
+++ b/dist/modules/auth/auth.service.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../../src/modules/auth/auth.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA2E;AAC3E,2CAA+C;AAC/C,qCAAyC;AACzC,uGAAkG;AAClG,mFAAuE;AACvE,gEAA4D;AAC5D,8DAAyD;AACzD,6EAAwE;AAExE,MAAM,YAAY,GAAQ,OAAO,CAAC,eAAe,CAAC,CAAC;AAG5C,IAAM,WAAW,GAAjB,MAAM,WAAW;IAEH;IACA;IACA;IACe;IACf;IACA;IACA;IAPnB,YACmB,MAAqB,EACrB,UAAsB,EACtB,MAAqB,EACN,cAAqB,EACpC,mBAAwC,EACxC,SAAyB,EACzB,YAAkC;QANlC,WAAM,GAAN,MAAM,CAAe;QACrB,eAAU,GAAV,UAAU,CAAY;QACtB,WAAM,GAAN,MAAM,CAAe;QACN,mBAAc,GAAd,cAAc,CAAO;QACpC,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,cAAS,GAAT,SAAS,CAAgB;QACzB,iBAAY,GAAZ,YAAY,CAAsB;IAClD,CAAC;IAEI,MAAM,GAAQ,IAAI,CAAC;IACnB,MAAM,GAAQ,IAAI,CAAC;IAEnB,KAAK,CAAC,SAAS;QACrB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,kBAAkB,CAAC,CAAC;QAC9D,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,SAAS;QACrB,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC,MAAM,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,qBAAqB,CAAC,CAAC;QAChE,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,yBAAyB,CAAC,CAAC;QACxE,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,2BAA2B,CAAC,QAAiB;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,mBAAmB,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAExH,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,CAAC;QAC7C,MAAM,aAAa,GAAG,YAAY,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;QAC7D,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,UAAU,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAE9C,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QAE1E,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,CAAC;YAClC,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,yBAAyB,CAAC,IAAI,sBAAsB;YACnF,aAAa,EAAE,MAAM;YACrB,cAAc;YACd,qBAAqB,EAAE,MAAM;YAC7B,KAAK;YACL,KAAK;SACN,CAAC,CAAC;QAEH,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,KAAa;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAEvE,wBAAwB;QACxB,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEnC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,mBAAmB,CAAC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAExH,gBAAgB;QAChB,MAAM,QAAQ,GAAQ,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAEpI,iCAAiC;QACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAEjC,8BAA8B;QAC9B,IAAI,QAAQ,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC7C,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YAC1D,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG;YACf,GAAG,EAAE,QAAQ,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,IAAI,IAAI;YACxC,kBAAkB,EAAE,QAAQ,EAAE,kBAAkB,IAAI,QAAQ,EAAE,QAAQ,IAAI,QAAQ,EAAE,KAAK,IAAI,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,KAAK;YACtI,KAAK,EAAE,QAAQ,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK;YACtC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE;SAC7B,CAAC;QAET,iDAAiD;QACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,QAAe,CAAC,CAAC;QAE3E,4BAA4B;QAC5B,IAAI,CAAC,UAAU,CAAC,QAAQ;YAAE,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;QAChF,IAAI,UAAU,CAAC,SAAS;YAAE,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;QAE7E,sBAAsB;QACtB,MAAM,UAAU,GAAG;YACjB,GAAG,EAAE,UAAU,CAAC,EAAE;YAClB,kBAAkB,EAAE,UAAU,CAAC,QAAQ;YACvC,KAAK,EAAE,UAAU,CAAC,KAAK;SACjB,CAAC;QAET,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAE/D,gCAAgC;QAChC,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB;QAE7G,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,CAAC;QAEjF,OAAO;YACL,WAAW,EAAE,MAAM;YACnB,YAAY;YACZ,SAAS;YACT,UAAU;YACV,IAAI,EAAE;gBACJ,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,KAAK,EAAE,UAAU,CAAC,KAAK,IAAI,EAAE;aAC9B;YACD,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAqB;QACjC,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,YAAY;QACZ,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU;YAAE,MAAM,IAAI,8BAAqB,CAAC,gBAAgB,CAAC,CAAC;QACnE,IAAI,CAAC,UAAU,CAAC,QAAQ;YAAE,MAAM,IAAI,8BAAqB,CAAC,oBAAoB,CAAC,CAAC;QAEhF,uBAAuB;QACvB,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,CAAC;QAClD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1F,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;QAEhE,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,kBAAkB,EAAE,UAAU,CAAC,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QAE7I,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,YAAqB;QAChC,IAAI,YAAY,EAAE,CAAC;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACxD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,SAAS,CAAC,IAAI,GAAG,CAAC;QAE7D,IAAI,UAAU,EAAE,CAAC;YACf,uCAAuC;YACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAChC,IAAI,UAAU;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,EAAE,UAAU,CAAC,CAAC;YAC7E,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,EAAE,CAAC,KAAc;QACrB,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,OAAO,GAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5D,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,8BAAqB,CAAC,gBAAgB,CAAC,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;QAC9F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,8BAAqB,CAAC,eAAe,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;CACF,CAAA;AApLY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,sBAAK,CAAC,CAAA;qCAHW,sBAAa;QACT,gBAAU;QACd,8BAAa;QACU,sBAAK;QACf,2CAAmB;QAC7B,iCAAc;QACX,6CAAoB;GAR1C,WAAW,CAoLvB"}
\ No newline at end of file
diff --git a/dist/modules/auth/authentication.service.js b/dist/modules/auth/authentication.service.js
new file mode 100644
index 0000000..d95cea1
--- /dev/null
+++ b/dist/modules/auth/authentication.service.js
@@ -0,0 +1,70 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var AuthenticationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthenticationService = void 0;
+const common_1 = require("@nestjs/common");
+const oidc_service_1 = require("./oidc.service");
+const prisma_service_1 = require("../../shared/prisma.service");
+const role_sync_service_1 = require("./role-sync.service");
+const authorization_service_1 = require("../authorization/authorization.service");
+const event_bus_service_1 = require("../../core/event-bus/event-bus.service");
+let AuthenticationService = AuthenticationService_1 = class AuthenticationService {
+    oidc;
+    prisma;
+    roleSync;
+    authorization;
+    events;
+    logger = new common_1.Logger(AuthenticationService_1.name);
+    constructor(oidc, prisma, roleSync, authorization, events) {
+        this.oidc = oidc;
+        this.prisma = prisma;
+        this.roleSync = roleSync;
+        this.authorization = authorization;
+        this.events = events;
+    }
+    async authenticate(bearerToken) {
+        // Validate token (signature/iss/aud/exp)
+        const claims = await this.oidc.verifyToken(bearerToken);
+        const sub = claims.sub;
+        if (!sub)
+            throw new Error('Invalid token: missing sub');
+        // Resolve identity
+        const identity = { sub, email: claims.email, preferred_username: claims.preferred_username, raw: claims };
+        // Find or create user (materialize)
+        let user = await this.prisma.user.findUnique({ where: { authentikId: sub } });
+        if (!user) {
+            user = await this.prisma.user.create({ data: { authentikId: sub, username: identity.preferred_username || identity.email || sub, email: identity.email || null } });
+        }
+        // Synchronize roles
+        const groups = Array.isArray(claims.groups) ? claims.groups : [];
+        await this.roleSync.syncUserRolesFromAuthentik(user.id, groups);
+        // Load permissions
+        const permissions = await this.authorization.getUserPermissions(user.id);
+        // Build request context
+        const rolesRows = await this.prisma.userRole.findMany({ where: { userId: user.id } });
+        const roles = rolesRows.map((r) => r.roleId);
+        const ctx = { user, identity, roles, permissions };
+        // Publish domain event
+        this.events.publish({ id: require('crypto').randomUUID(), timestamp: new Date().toISOString(), type: 'UserAuthenticated', payload: { userId: user.id, identity } });
+        return ctx;
+    }
+};
+exports.AuthenticationService = AuthenticationService;
+exports.AuthenticationService = AuthenticationService = AuthenticationService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [oidc_service_1.OidcService,
+        prisma_service_1.PrismaService,
+        role_sync_service_1.RoleSyncService,
+        authorization_service_1.AuthorizationService,
+        event_bus_service_1.EventBus])
+], AuthenticationService);
+//# sourceMappingURL=authentication.service.js.map
\ No newline at end of file
diff --git a/dist/modules/auth/authentication.service.js.map b/dist/modules/auth/authentication.service.js.map
new file mode 100644
index 0000000..dd36d16
--- /dev/null
+++ b/dist/modules/auth/authentication.service.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"authentication.service.js","sourceRoot":"","sources":["../../../src/modules/auth/authentication.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,iDAA6C;AAC7C,gEAA4D;AAC5D,2DAAsD;AACtD,kFAA8E;AAC9E,8EAAkE;AAI3D,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAIb;IACA;IACA;IACA;IACA;IAPF,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAEjE,YACmB,IAAiB,EACjB,MAAqB,EACrB,QAAyB,EACzB,aAAmC,EACnC,MAAgB;QAJhB,SAAI,GAAJ,IAAI,CAAa;QACjB,WAAM,GAAN,MAAM,CAAe;QACrB,aAAQ,GAAR,QAAQ,CAAiB;QACzB,kBAAa,GAAb,aAAa,CAAsB;QACnC,WAAM,GAAN,MAAM,CAAU;IAChC,CAAC;IAEJ,KAAK,CAAC,YAAY,CAAC,WAAmB;QACpC,yCAAyC;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAExD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAExD,mBAAmB;QACnB,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAE1G,oCAAoC;QACpC,IAAI,IAAI,GAAG,MAAO,IAAI,CAAC,MAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAO,IAAI,CAAC,MAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,kBAAkB,IAAI,QAAQ,CAAC,KAAK,IAAI,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/K,CAAC;QAED,oBAAoB;QACpB,MAAM,MAAM,GAAa,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,CAAC,QAAQ,CAAC,0BAA0B,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAEhE,mBAAmB;QACnB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAEzE,wBAAwB;QACxB,MAAM,SAAS,GAAG,MAAO,IAAI,CAAC,MAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAElD,MAAM,GAAG,GAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAEnE,uBAAuB;QACvB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAEpK,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AA7CY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;qCAKc,0BAAW;QACT,8BAAa;QACX,mCAAe;QACV,4CAAoB;QAC3B,4BAAQ;GARxB,qBAAqB,CA6CjC"}
\ No newline at end of file
diff --git a/dist/modules/auth/dto/login.dto.js b/dist/modules/auth/dto/login.dto.js
new file mode 100644
index 0000000..72ae07d
--- /dev/null
+++ b/dist/modules/auth/dto/login.dto.js
@@ -0,0 +1,4 @@
+"use strict";
+// Login DTO removed. Password grant has been removed in favor of Authorization Code + PKCE flow.
+// Formerly contained username/password properties.
+//# sourceMappingURL=login.dto.js.map
\ No newline at end of file
diff --git a/dist/modules/auth/dto/login.dto.js.map b/dist/modules/auth/dto/login.dto.js.map
new file mode 100644
index 0000000..1cf14bb
--- /dev/null
+++ b/dist/modules/auth/dto/login.dto.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"login.dto.js","sourceRoot":"","sources":["../../../../src/modules/auth/dto/login.dto.ts"],"names":[],"mappings":";AAAA,iGAAiG;AACjG,mDAAmD"}
\ No newline at end of file
diff --git a/dist/modules/auth/group-hash.service.js b/dist/modules/auth/group-hash.service.js
new file mode 100644
index 0000000..8b2219c
--- /dev/null
+++ b/dist/modules/auth/group-hash.service.js
@@ -0,0 +1,56 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GroupHashService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto = __importStar(require("crypto"));
+let GroupHashService = class GroupHashService {
+    compute(groups) {
+        const sorted = (groups || []).slice().sort();
+        const data = sorted.join(',');
+        return crypto.createHash('sha256').update(data, 'utf8').digest('hex');
+    }
+};
+exports.GroupHashService = GroupHashService;
+exports.GroupHashService = GroupHashService = __decorate([
+    (0, common_1.Injectable)()
+], GroupHashService);
+//# sourceMappingURL=group-hash.service.js.map
\ No newline at end of file
diff --git a/dist/modules/auth/group-hash.service.js.map b/dist/modules/auth/group-hash.service.js.map
new file mode 100644
index 0000000..c5f2db7
--- /dev/null
+++ b/dist/modules/auth/group-hash.service.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"group-hash.service.js","sourceRoot":"","sources":["../../../src/modules/auth/group-hash.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4C;AAC5C,+CAAiC;AAG1B,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,OAAO,CAAC,MAAgB;QACtB,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC;CACF,CAAA;AANY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;GACA,gBAAgB,CAM5B"}
\ No newline at end of file
diff --git a/dist/modules/auth/guards/oidc.guard.js b/dist/modules/auth/guards/oidc.guard.js
new file mode 100644
index 0000000..06308ac
--- /dev/null
+++ b/dist/modules/auth/guards/oidc.guard.js
@@ -0,0 +1,48 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var OidcGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcGuard = void 0;
+const common_1 = require("@nestjs/common");
+const oidc_service_1 = require("../oidc.service");
+const authentication_service_1 = require("../authentication.service");
+let OidcGuard = OidcGuard_1 = class OidcGuard {
+    oidc;
+    authn;
+    logger = new common_1.Logger(OidcGuard_1.name);
+    constructor(oidc, authn) {
+        this.oidc = oidc;
+        this.authn = authn;
+    }
+    async canActivate(context) {
+        const req = context.switchToHttp().getRequest();
+        const auth = req.headers['authorization'] || req.headers['Authorization'];
+        if (!auth || typeof auth !== 'string' || !auth.startsWith('Bearer '))
+            throw new common_1.UnauthorizedException('Missing bearer token');
+        const token = auth.substring(7).trim();
+        try {
+            const ctx = await this.authn.authenticate(token);
+            // attach context to request under a structured key
+            req.raylabContext = ctx;
+            return true;
+        }
+        catch (e) {
+            this.logger.debug('Authentication failed', e.message);
+            throw new common_1.UnauthorizedException('Invalid token or authentication failed');
+        }
+    }
+};
+exports.OidcGuard = OidcGuard;
+exports.OidcGuard = OidcGuard = OidcGuard_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [oidc_service_1.OidcService, authentication_service_1.AuthenticationService])
+], OidcGuard);
+//# sourceMappingURL=oidc.guard.js.map
\ No newline at end of file
diff --git a/dist/modules/auth/guards/oidc.guard.js.map b/dist/modules/auth/guards/oidc.guard.js.map
new file mode 100644
index 0000000..c66917b
--- /dev/null
+++ b/dist/modules/auth/guards/oidc.guard.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"oidc.guard.js","sourceRoot":"","sources":["../../../../src/modules/auth/guards/oidc.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAkH;AAClH,kDAA8C;AAC9C,sEAAkE;AAG3D,IAAM,SAAS,iBAAf,MAAM,SAAS;IAES;IAAoC;IADhD,MAAM,GAAG,IAAI,eAAM,CAAC,WAAS,CAAC,IAAI,CAAC,CAAC;IACrD,YAA6B,IAAiB,EAAmB,KAA4B;QAAhE,SAAI,GAAJ,IAAI,CAAa;QAAmB,UAAK,GAAL,KAAK,CAAuB;IAAG,CAAC;IAEjG,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC1E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,8BAAqB,CAAC,sBAAsB,CAAC,CAAC;QAC9H,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAEvC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACjD,mDAAmD;YACnD,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAG,CAAS,CAAC,OAAO,CAAC,CAAC;YAC/D,MAAM,IAAI,8BAAqB,CAAC,wCAAwC,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;CACF,CAAA;AApBY,8BAAS;oBAAT,SAAS;IADrB,IAAA,mBAAU,GAAE;qCAGwB,0BAAW,EAA0B,8CAAqB;GAFlF,SAAS,CAoBrB"}
\ No newline at end of file
diff --git a/dist/modules/auth/oidc.service.js b/dist/modules/auth/oidc.service.js
new file mode 100644
index 0000000..cf2ba55
--- /dev/null
+++ b/dist/modules/auth/oidc.service.js
@@ -0,0 +1,89 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var OidcService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OidcService = void 0;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+let OidcService = OidcService_1 = class OidcService {
+    config;
+    jwksUri = null;
+    issuer;
+    audience;
+    logger = new common_1.Logger(OidcService_1.name);
+    constructor(config) {
+        this.config = config;
+        this.issuer = this.config.get('AUTHENTIK_ISSUER') || '';
+        this.audience = this.config.get('AUTHENTIK_AUDIENCE') || undefined;
+        const jwksUri = this.config.get('AUTHENTIK_JWKS_URI');
+        if (jwksUri)
+            this.jwksUri = jwksUri;
+        else if (this.issuer)
+            this.jwksUri = `${this.issuer.replace(/\/+$/, '')}/.well-known/jwks.json`;
+    }
+    async verifyToken(token) {
+        if (!this.jwksUri)
+            throw new Error('JWKS not configured');
+        try {
+            // dynamic import to avoid ESM loading issues in test environment
+            const jose = await Promise.resolve().then(() => __importStar(require('jose')));
+            const jwks = jose.createRemoteJWKSet(new URL(this.jwksUri));
+            const { payload } = await jose.jwtVerify(token, jwks, {
+                issuer: this.issuer || undefined,
+                audience: this.audience,
+            });
+            return payload;
+        }
+        catch (e) {
+            this.logger.debug('Token verification failed', e.message);
+            throw e;
+        }
+    }
+};
+exports.OidcService = OidcService;
+exports.OidcService = OidcService = OidcService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [config_1.ConfigService])
+], OidcService);
+//# sourceMappingURL=oidc.service.js.map
\ No newline at end of file
diff --git a/dist/modules/auth/oidc.service.js.map b/dist/modules/auth/oidc.service.js.map
new file mode 100644
index 0000000..d8e5d3b
--- /dev/null
+++ b/dist/modules/auth/oidc.service.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"oidc.service.js","sourceRoot":"","sources":["../../../src/modules/auth/oidc.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,2CAA+C;AAGxC,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAMO;IALrB,OAAO,GAAkB,IAAI,CAAC;IAC9B,MAAM,CAAS;IACf,QAAQ,CAAgC;IACxC,MAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAE9C,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAChE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,oBAAoB,CAAC,IAAI,SAAS,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAS,oBAAoB,CAAC,CAAC;QAC9D,IAAI,OAAO;YAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;aAC/B,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,wBAAwB,CAAC;IAClG,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAE1D,IAAI,CAAC;YACH,iEAAiE;YACjE,MAAM,IAAI,GAAG,wDAAa,MAAM,GAAC,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5D,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBACpD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS;gBAChC,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACjB,CAAC,CAAC;YAEV,OAAO,OAA8B,CAAC;QACxC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;YACrE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;CACF,CAAA;AAhCY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAO0B,sBAAa;GANvC,WAAW,CAgCvB"}
\ No newline at end of file
diff --git a/dist/modules/auth/pkce/redis-pkce.store.js b/dist/modules/auth/pkce/redis-pkce.store.js
new file mode 100644
index 0000000..fcf24b9
--- /dev/null
+++ b/dist/modules/auth/pkce/redis-pkce.store.js
@@ -0,0 +1,56 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisPkceStore = void 0;
+const common_1 = require("@nestjs/common");
+let RedisPkceStore = class RedisPkceStore {
+    // In-memory PKCE store replacing Redis-backed implementation
+    map = new Map();
+    cleanupInterval;
+    constructor() {
+        // periodic cleanup
+        this.cleanupInterval = setInterval(() => {
+            const now = Date.now();
+            for (const [k, v] of this.map.entries()) {
+                if (v.expiresAt <= now)
+                    this.map.delete(k);
+            }
+        }, 60 * 1000);
+    }
+    key(state) { return state; }
+    async save(state, data, ttlSeconds = 300) {
+        const expiresAt = Date.now() + ttlSeconds * 1000;
+        this.map.set(this.key(state), { ...data, expiresAt });
+    }
+    async get(state) {
+        const v = this.map.get(this.key(state));
+        if (!v)
+            return null;
+        if (v.expiresAt <= Date.now()) {
+            this.map.delete(this.key(state));
+            return null;
+        }
+        return { code_verifier: v.code_verifier, nonce: v.nonce, returnTo: v.returnTo };
+    }
+    async remove(state) {
+        this.map.delete(this.key(state));
+    }
+    onModuleDestroy() {
+        if (this.cleanupInterval)
+            clearInterval(this.cleanupInterval);
+    }
+};
+exports.RedisPkceStore = RedisPkceStore;
+exports.RedisPkceStore = RedisPkceStore = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [])
+], RedisPkceStore);
+//# sourceMappingURL=redis-pkce.store.js.map
\ No newline at end of file
diff --git a/dist/modules/auth/pkce/redis-pkce.store.js.map b/dist/modules/auth/pkce/redis-pkce.store.js.map
new file mode 100644
index 0000000..eadcf0a
--- /dev/null
+++ b/dist/modules/auth/pkce/redis-pkce.store.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"redis-pkce.store.js","sourceRoot":"","sources":["../../../../src/modules/auth/pkce/redis-pkce.store.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA6D;AAKtD,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,6DAA6D;IACrD,GAAG,GAAG,IAAI,GAAG,EAAqB,CAAC;IACnC,eAAe,CAAkB;IAEzC;QACE,mBAAmB;QACnB,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG;oBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;IAChB,CAAC;IAEO,GAAG,CAAC,KAAa,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC;IAE5C,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,IAAiE,EAAE,UAAU,GAAG,GAAG;QAC3G,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACjF,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa;QACxB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,CAAC;IAED,eAAe;QACb,IAAI,IAAI,CAAC,eAAe;YAAE,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;CACF,CAAA;AApCY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;;GACA,cAAc,CAoC1B"}
\ No newline at end of file
diff --git a/dist/modules/auth/refresh/inmemory-refresh.store.js b/dist/modules/auth/refresh/inmemory-refresh.store.js
new file mode 100644
index 0000000..5ca1a3f
--- /dev/null
+++ b/dist/modules/auth/refresh/inmemory-refresh.store.js
@@ -0,0 +1,53 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InMemoryRefreshStore = void 0;
+const common_1 = require("@nestjs/common");
+let InMemoryRefreshStore = class InMemoryRefreshStore {
+    map = new Map();
+    cleanupInterval;
+    constructor() {
+        this.cleanupInterval = setInterval(() => {
+            const now = Date.now();
+            for (const [k, v] of this.map.entries()) {
+                if (v.expiresAt <= now)
+                    this.map.delete(k);
+            }
+        }, 60 * 1000);
+    }
+    async set(token, data, ttlSeconds) {
+        const expiresAt = Date.now() + ttlSeconds * 1000;
+        this.map.set(token, { userId: data.userId, expiresAt });
+    }
+    async get(token) {
+        const v = this.map.get(token);
+        if (!v)
+            return null;
+        if (v.expiresAt <= Date.now()) {
+            this.map.delete(token);
+            return null;
+        }
+        return { userId: v.userId };
+    }
+    async del(token) {
+        this.map.delete(token);
+    }
+    onModuleDestroy() {
+        if (this.cleanupInterval)
+            clearInterval(this.cleanupInterval);
+    }
+};
+exports.InMemoryRefreshStore = InMemoryRefreshStore;
+exports.InMemoryRefreshStore = InMemoryRefreshStore = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [])
+], InMemoryRefreshStore);
+//# sourceMappingURL=inmemory-refresh.store.js.map
\ No newline at end of file
diff --git a/dist/modules/auth/refresh/inmemory-refresh.store.js.map b/dist/modules/auth/refresh/inmemory-refresh.store.js.map
new file mode 100644
index 0000000..21759c7
--- /dev/null
+++ b/dist/modules/auth/refresh/inmemory-refresh.store.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"inmemory-refresh.store.js","sourceRoot":"","sources":["../../../../src/modules/auth/refresh/inmemory-refresh.store.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA6D;AAKtD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACvB,GAAG,GAAG,IAAI,GAAG,EAAwB,CAAC;IACtC,eAAe,CAAkB;IAEzC;QACE,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG;oBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,IAAwB,EAAE,UAAkB;QACnE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;QACjD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;QACvE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa;QACrB,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,eAAe;QACb,IAAI,IAAI,CAAC,eAAe;YAAE,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAChE,CAAC;CACF,CAAA;AAhCY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;;GACA,oBAAoB,CAgChC"}
\ No newline at end of file
diff --git a/dist/modules/auth/role-sync.service.js b/dist/modules/auth/role-sync.service.js
new file mode 100644
index 0000000..e9db195
--- /dev/null
+++ b/dist/modules/auth/role-sync.service.js
@@ -0,0 +1,88 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var RoleSyncService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleSyncService = void 0;
+const common_1 = require("@nestjs/common");
+const prisma_service_1 = require("../../shared/prisma.service");
+const event_bus_service_1 = require("../../core/event-bus/event-bus.service");
+const group_hash_service_1 = require("./group-hash.service");
+const authorization_service_1 = require("../authorization/authorization.service");
+let RoleSyncService = RoleSyncService_1 = class RoleSyncService {
+    prisma;
+    groupHash;
+    permissionCache;
+    events;
+    logger = new common_1.Logger(RoleSyncService_1.name);
+    constructor(prisma, groupHash, permissionCache, events) {
+        this.prisma = prisma;
+        this.groupHash = groupHash;
+        this.permissionCache = permissionCache;
+        this.events = events;
+    }
+    computeGroupHash(groups) {
+        return this.groupHash.compute(groups || []);
+    }
+    async mapGroupsToRoleIds(groups) {
+        if (!groups || groups.length === 0)
+            return [];
+        const mappings = await this.prisma.authGroupRoleMapping.findMany({ where: { authGroup: { in: groups } } });
+        const roleIds = mappings.map((m) => m.roleId);
+        return Array.from(new Set(roleIds));
+    }
+    async syncUserRolesFromAuthentik(userId, groups) {
+        const groupHash = this.computeGroupHash(groups || []);
+        const user = await this.prisma.user.findUnique({ where: { id: userId } });
+        if (!user)
+            throw new Error('User not found');
+        if (user.lastGroupHash === groupHash) {
+            this.logger.debug('Group hash unchanged, skipping sync');
+            return { skipped: true };
+        }
+        const roleIds = await this.mapGroupsToRoleIds(groups || []);
+        const previousRoleRows = await this.prisma.userRole.findMany({ where: { userId, source: 'AUTHENTIK' }, select: { roleId: true } });
+        const previousRoles = previousRoleRows.map((r) => r.roleId);
+        await this.prisma.$transaction(async (tx) => {
+            await tx.userRole.deleteMany({ where: { userId: userId, source: 'AUTHENTIK' } });
+            if (roleIds.length > 0) {
+                const createData = roleIds.map((rid) => ({ userId, roleId: rid, source: 'AUTHENTIK' }));
+                await tx.userRole.createMany({ data: createData, skipDuplicates: true });
+            }
+            await tx.user.update({ where: { id: userId }, data: { lastGroupHash: groupHash } });
+        });
+        // Invalidate permission cache through abstraction
+        try {
+            await this.permissionCache.invalidate(userId);
+        }
+        catch (e) {
+            this.logger.error('Failed to invalidate permission cache', e);
+        }
+        // Publish event for audit and other subscribers
+        this.events.publish({
+            id: require('crypto').randomUUID(),
+            timestamp: new Date().toISOString(),
+            type: 'RolesSynchronized',
+            payload: { userId, groups, assignedRoleIds: roleIds, previousRoles },
+        });
+        return { skipped: false, assignedRoleIds: roleIds };
+    }
+};
+exports.RoleSyncService = RoleSyncService;
+exports.RoleSyncService = RoleSyncService = RoleSyncService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Inject)(authorization_service_1.PERMISSION_CACHE)),
+    __metadata("design:paramtypes", [prisma_service_1.PrismaService,
+        group_hash_service_1.GroupHashService, Object, event_bus_service_1.EventBus])
+], RoleSyncService);
+//# sourceMappingURL=role-sync.service.js.map
\ No newline at end of file
diff --git a/dist/modules/auth/role-sync.service.js.map b/dist/modules/auth/role-sync.service.js.map
new file mode 100644
index 0000000..0865491
--- /dev/null
+++ b/dist/modules/auth/role-sync.service.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"role-sync.service.js","sourceRoot":"","sources":["../../../src/modules/auth/role-sync.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA4D;AAC5D,gEAA4D;AAE5D,8EAAkE;AAClE,6DAAwD;AACxD,kFAA0E;AAGnE,IAAM,eAAe,uBAArB,MAAM,eAAe;IAIP;IACA;IAC0B;IAC1B;IANF,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;IAE3D,YACmB,MAAqB,EACrB,SAA2B,EACD,eAAgC,EAC1D,MAAgB;QAHhB,WAAM,GAAN,MAAM,CAAe;QACrB,cAAS,GAAT,SAAS,CAAkB;QACD,oBAAe,GAAf,eAAe,CAAiB;QAC1D,WAAM,GAAN,MAAM,CAAU;IAChC,CAAC;IAEJ,gBAAgB,CAAC,MAAgB;QAC/B,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAgB;QACvC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAO,IAAI,CAAC,MAAc,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACpH,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,0BAA0B,CAAC,MAAc,EAAE,MAAgB;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAO,IAAI,CAAC,MAAc,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAE7C,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QAE5D,MAAM,gBAAgB,GAAG,MAAO,IAAI,CAAC,MAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5I,MAAM,aAAa,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAEjE,MAAO,IAAI,CAAC,MAAc,CAAC,YAAY,CAAC,KAAK,EAAE,EAAO,EAAE,EAAE;YACxD,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;YAEjF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;gBAChG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAS,CAAC,CAAC;YAClF,CAAC;YAED,MAAM,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC,CAAC,CAAC;QAEH,kDAAkD;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uCAAuC,EAAE,CAAQ,CAAC,CAAC;QACvE,CAAC;QAED,gDAAgD;QAChD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAClB,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE;YAClC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,aAAa,EAAE;SACrE,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;IACtD,CAAC;CACF,CAAA;AAjEY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,wCAAgB,CAAC,CAAA;qCAFA,8BAAa;QACV,qCAAgB,UAEnB,4BAAQ;GAPxB,eAAe,CAiE3B"}
\ No newline at end of file
diff --git a/dist/modules/authorization/application/authorization.service.js b/dist/modules/authorization/application/authorization.service.js
new file mode 100644
index 0000000..6ce7dcf
--- /dev/null
+++ b/dist/modules/authorization/application/authorization.service.js
@@ -0,0 +1,2 @@
+"use strict";
+//# sourceMappingURL=authorization.service.js.map
\ No newline at end of file
diff --git a/dist/modules/authorization/application/authorization.service.js.map b/dist/modules/authorization/application/authorization.service.js.map
new file mode 100644
index 0000000..dea3510
--- /dev/null
+++ b/dist/modules/authorization/application/authorization.service.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"authorization.service.js","sourceRoot":"","sources":["../../../../src/modules/authorization/application/authorization.service.ts"],"names":[],"mappings":""}
\ No newline at end of file
diff --git a/dist/modules/authorization/authorization.module.js b/dist/modules/authorization/authorization.module.js
new file mode 100644
index 0000000..2458ab5
--- /dev/null
+++ b/dist/modules/authorization/authorization.module.js
@@ -0,0 +1,29 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationModule = void 0;
+const common_1 = require("@nestjs/common");
+const authorization_service_1 = require("./authorization.service");
+const prisma_service_1 = require("../../shared/prisma.service");
+const redis_service_1 = require("../../shared/redis.service");
+const redis_permission_cache_service_1 = require("./cache/redis-permission-cache.service");
+let AuthorizationModule = class AuthorizationModule {
+};
+exports.AuthorizationModule = AuthorizationModule;
+exports.AuthorizationModule = AuthorizationModule = __decorate([
+    (0, common_1.Module)({
+        providers: [
+            authorization_service_1.AuthorizationService,
+            prisma_service_1.PrismaService,
+            redis_service_1.RedisService,
+            { provide: authorization_service_1.PERMISSION_CACHE, useClass: redis_permission_cache_service_1.RedisPermissionCache },
+        ],
+        exports: [authorization_service_1.AuthorizationService, authorization_service_1.PERMISSION_CACHE],
+    })
+], AuthorizationModule);
+//# sourceMappingURL=authorization.module.js.map
\ No newline at end of file
diff --git a/dist/modules/authorization/authorization.module.js.map b/dist/modules/authorization/authorization.module.js.map
new file mode 100644
index 0000000..bd807bc
--- /dev/null
+++ b/dist/modules/authorization/authorization.module.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"authorization.module.js","sourceRoot":"","sources":["../../../src/modules/authorization/authorization.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,mEAAiF;AACjF,gEAA4D;AAC5D,8DAA0D;AAC1D,2FAA8E;AAWvE,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAAG,CAAA;AAAtB,kDAAmB;8BAAnB,mBAAmB;IAT/B,IAAA,eAAM,EAAC;QACN,SAAS,EAAE;YACT,4CAAoB;YACpB,8BAAa;YACb,4BAAY;YACZ,EAAE,OAAO,EAAE,wCAAgB,EAAE,QAAQ,EAAE,qDAAoB,EAAE;SAC9D;QACD,OAAO,EAAE,CAAC,4CAAoB,EAAE,wCAAgB,CAAC;KAClD,CAAC;GACW,mBAAmB,CAAG"}
\ No newline at end of file
diff --git a/dist/modules/authorization/authorization.service.js b/dist/modules/authorization/authorization.service.js
new file mode 100644
index 0000000..2c33ba6
--- /dev/null
+++ b/dist/modules/authorization/authorization.service.js
@@ -0,0 +1,71 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AuthorizationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizationService = exports.PERMISSION_CACHE = void 0;
+const common_1 = require("@nestjs/common");
+const prisma_service_1 = require("../../shared/prisma.service");
+exports.PERMISSION_CACHE = 'PERMISSION_CACHE';
+let AuthorizationService = AuthorizationService_1 = class AuthorizationService {
+    prisma;
+    cache;
+    logger = new common_1.Logger(AuthorizationService_1.name);
+    constructor(prisma, cache) {
+        this.prisma = prisma;
+        this.cache = cache;
+    }
+    async getUserPermissions(userId) {
+        try {
+            const cached = await this.cache.get(userId);
+            if (cached)
+                return cached;
+        }
+        catch (e) {
+            this.logger.debug('PermissionCache get failed', e);
+        }
+        const rows = await this.prisma.$queryRaw `
+      SELECT p.code as code
+      FROM "UserRole" ur
+      JOIN "RolePermission" rp ON rp.role_id = ur.role_id
+      JOIN "Permission" p ON p.id = rp.permission_id
+      WHERE ur.user_id = ${userId}`;
+        const perms = Array.isArray(rows) ? rows.map((r) => r.code) : [];
+        try {
+            await this.cache.set(userId, perms);
+        }
+        catch (e) {
+            this.logger.debug('PermissionCache set failed', e);
+        }
+        return perms;
+    }
+    async hasPermission(userId, permissionCode) {
+        const perms = await this.getUserPermissions(userId);
+        return perms.includes(permissionCode);
+    }
+    async invalidateUserPermissions(userId) {
+        try {
+            await this.cache.invalidate(userId);
+        }
+        catch (e) {
+            this.logger.debug('PermissionCache invalidate failed', e);
+        }
+    }
+};
+exports.AuthorizationService = AuthorizationService;
+exports.AuthorizationService = AuthorizationService = AuthorizationService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)(exports.PERMISSION_CACHE)),
+    __metadata("design:paramtypes", [prisma_service_1.PrismaService, Object])
+], AuthorizationService);
+//# sourceMappingURL=authorization.service.js.map
\ No newline at end of file
diff --git a/dist/modules/authorization/authorization.service.js.map b/dist/modules/authorization/authorization.service.js.map
new file mode 100644
index 0000000..c548026
--- /dev/null
+++ b/dist/modules/authorization/authorization.service.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"authorization.service.js","sourceRoot":"","sources":["../../../src/modules/authorization/authorization.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA4D;AAC5D,gEAA4D;AAG/C,QAAA,gBAAgB,GAAG,kBAAkB,CAAC;AAG5C,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAGF;IAAkE;IAF9E,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEhE,YAA6B,MAAqB,EAA6C,KAAsB;QAAxF,WAAM,GAAN,MAAM,CAAe;QAA6C,UAAK,GAAL,KAAK,CAAiB;IAAG,CAAC;IAEzH,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,CAAQ,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAA;;;;;2BAKjB,MAAM,EAAE,CAAC;QAEhC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEtE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,CAAQ,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,cAAsB;QACxD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,MAAc;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,EAAE,CAAQ,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;CACF,CAAA;AA3CY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAI0C,WAAA,IAAA,eAAM,EAAC,wBAAgB,CAAC,CAAA;qCAAxC,8BAAa;GAHvC,oBAAoB,CA2ChC"}
\ No newline at end of file
diff --git a/dist/modules/authorization/cache/permission-cache.interface.js b/dist/modules/authorization/cache/permission-cache.interface.js
new file mode 100644
index 0000000..f6e02dc
--- /dev/null
+++ b/dist/modules/authorization/cache/permission-cache.interface.js
@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=permission-cache.interface.js.map
\ No newline at end of file
diff --git a/dist/modules/authorization/cache/permission-cache.interface.js.map b/dist/modules/authorization/cache/permission-cache.interface.js.map
new file mode 100644
index 0000000..cc80661
--- /dev/null
+++ b/dist/modules/authorization/cache/permission-cache.interface.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"permission-cache.interface.js","sourceRoot":"","sources":["../../../../src/modules/authorization/cache/permission-cache.interface.ts"],"names":[],"mappings":""}
\ No newline at end of file
diff --git a/dist/modules/authorization/cache/redis-permission-cache.service.js b/dist/modules/authorization/cache/redis-permission-cache.service.js
new file mode 100644
index 0000000..1ab7d5a
--- /dev/null
+++ b/dist/modules/authorization/cache/redis-permission-cache.service.js
@@ -0,0 +1,48 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisPermissionCache = void 0;
+const common_1 = require("@nestjs/common");
+const redis_service_1 = require("../../../shared/redis.service");
+let RedisPermissionCache = class RedisPermissionCache {
+    redis;
+    TTL = 60 * 5;
+    constructor(redis) {
+        this.redis = redis;
+    }
+    key(userId) {
+        const { CacheKeys } = require('../../../shared/cache-keys');
+        return CacheKeys.permission(userId);
+    }
+    async get(userId) {
+        const data = await this.redis.get(this.key(userId));
+        if (!data)
+            return null;
+        try {
+            return JSON.parse(data);
+        }
+        catch {
+            return null;
+        }
+    }
+    async set(userId, permissions, ttlSeconds) {
+        await this.redis.set(this.key(userId), JSON.stringify(permissions), ttlSeconds ?? this.TTL);
+    }
+    async invalidate(userId) {
+        await this.redis.del(this.key(userId));
+    }
+};
+exports.RedisPermissionCache = RedisPermissionCache;
+exports.RedisPermissionCache = RedisPermissionCache = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [redis_service_1.RedisService])
+], RedisPermissionCache);
+//# sourceMappingURL=redis-permission-cache.service.js.map
\ No newline at end of file
diff --git a/dist/modules/authorization/cache/redis-permission-cache.service.js.map b/dist/modules/authorization/cache/redis-permission-cache.service.js.map
new file mode 100644
index 0000000..c9a7615
--- /dev/null
+++ b/dist/modules/authorization/cache/redis-permission-cache.service.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"redis-permission-cache.service.js","sourceRoot":"","sources":["../../../../src/modules/authorization/cache/redis-permission-cache.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAE5C,iEAA6D;AAGtD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAGF;IAFZ,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC;IAE9B,YAA6B,KAAmB;QAAnB,UAAK,GAAL,KAAK,CAAc;IAAG,CAAC;IAE5C,GAAG,CAAC,MAAc;QACxB,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;QAC5D,OAAO,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAa,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc,EAAE,WAAqB,EAAE,UAAmB;QAClE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AA3BY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAIyB,4BAAY;GAHrC,oBAAoB,CA2BhC"}
\ No newline at end of file
diff --git a/dist/modules/authorization/guards/permission.guard.js b/dist/modules/authorization/guards/permission.guard.js
new file mode 100644
index 0000000..4863b8f
--- /dev/null
+++ b/dist/modules/authorization/guards/permission.guard.js
@@ -0,0 +1,52 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPermissionGuard = exports.PermissionGuard = void 0;
+const common_1 = require("@nestjs/common");
+const authorization_service_1 = require("../authorization.service");
+let PermissionGuard = class PermissionGuard {
+    authz;
+    permission;
+    constructor(authz, permission) {
+        this.authz = authz;
+        this.permission = permission;
+    }
+    async canActivate(context) {
+        const req = context.switchToHttp().getRequest();
+        const user = req.raylab?.user;
+        if (!user)
+            throw new common_1.ForbiddenException('Missing user');
+        const allowed = await this.authz.hasPermission(user.id, this.permission);
+        if (!allowed)
+            throw new common_1.ForbiddenException('Forbidden');
+        return true;
+    }
+};
+exports.PermissionGuard = PermissionGuard;
+exports.PermissionGuard = PermissionGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [authorization_service_1.AuthorizationService, String])
+], PermissionGuard);
+// Factory to create guard instances with permission string (used in decorators)
+const createPermissionGuard = (permission) => {
+    let _Guard = class _Guard extends PermissionGuard {
+        constructor(authz) {
+            super(authz, permission);
+        }
+    };
+    _Guard = __decorate([
+        (0, common_1.Injectable)(),
+        __metadata("design:paramtypes", [authorization_service_1.AuthorizationService])
+    ], _Guard);
+    return _Guard;
+};
+exports.createPermissionGuard = createPermissionGuard;
+//# sourceMappingURL=permission.guard.js.map
\ No newline at end of file
diff --git a/dist/modules/authorization/guards/permission.guard.js.map b/dist/modules/authorization/guards/permission.guard.js.map
new file mode 100644
index 0000000..0346629
--- /dev/null
+++ b/dist/modules/authorization/guards/permission.guard.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"permission.guard.js","sourceRoot":"","sources":["../../../../src/modules/authorization/guards/permission.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+F;AAC/F,oEAAgE;AAGzD,IAAM,eAAe,GAArB,MAAM,eAAe;IACG;IAA8C;IAA3E,YAA6B,KAA2B,EAAmB,UAAkB;QAAhE,UAAK,GAAL,KAAK,CAAsB;QAAmB,eAAU,GAAV,UAAU,CAAQ;IAAG,CAAC;IAEjG,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC;QAC9B,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,2BAAkB,CAAC,cAAc,CAAC,CAAC;QAExD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,2BAAkB,CAAC,WAAW,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAZY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;qCAEyB,4CAAoB;GAD7C,eAAe,CAY3B;AAED,gFAAgF;AACzE,MAAM,qBAAqB,GAAG,CAAC,UAAkB,EAAE,EAAE;IAC1D,IACM,MAAM,GADZ,MACM,MAAO,SAAQ,eAAe;QAClC,YAAY,KAA2B;YACrC,KAAK,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC3B,CAAC;KACF,CAAA;IAJK,MAAM;QADX,IAAA,mBAAU,GAAE;yCAEQ,4CAAoB;OADnC,MAAM,CAIX;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AARW,QAAA,qBAAqB,yBAQhC"}
\ No newline at end of file
diff --git a/dist/modules/authorization/presentation/decorators/permission.decorator.js b/dist/modules/authorization/presentation/decorators/permission.decorator.js
new file mode 100644
index 0000000..2547583
--- /dev/null
+++ b/dist/modules/authorization/presentation/decorators/permission.decorator.js
@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Permissions = void 0;
+const common_1 = require("@nestjs/common");
+const Permissions = (...permissions) => (0, common_1.SetMetadata)('permissions', permissions);
+exports.Permissions = Permissions;
+//# sourceMappingURL=permission.decorator.js.map
\ No newline at end of file
diff --git a/dist/modules/authorization/presentation/decorators/permission.decorator.js.map b/dist/modules/authorization/presentation/decorators/permission.decorator.js.map
new file mode 100644
index 0000000..cdad7da
--- /dev/null
+++ b/dist/modules/authorization/presentation/decorators/permission.decorator.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"permission.decorator.js","sourceRoot":"","sources":["../../../../../src/modules/authorization/presentation/decorators/permission.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAEtC,MAAM,WAAW,GAAG,CAAC,GAAG,WAAqB,EAAE,EAAE,CACtD,IAAA,oBAAW,EAAC,aAAa,EAAE,WAAW,CAAC,CAAC;AAD7B,QAAA,WAAW,eACkB"}
\ No newline at end of file
diff --git a/dist/modules/authorization/presentation/guards/permission.guard.js b/dist/modules/authorization/presentation/guards/permission.guard.js
new file mode 100644
index 0000000..4fb2446
--- /dev/null
+++ b/dist/modules/authorization/presentation/guards/permission.guard.js
@@ -0,0 +1,46 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+let PermissionGuard = class PermissionGuard {
+    reflector;
+    constructor(reflector) {
+        this.reflector = reflector;
+    }
+    canActivate(context) {
+        const permissions = this.reflector.getAllAndOverride('permissions', [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (!permissions) {
+            return true;
+        }
+        const request = context.switchToHttp().getRequest();
+        const user = request.currentUser;
+        if (!user) {
+            throw new common_1.UnauthorizedException('Current user is missing.');
+        }
+        const hasAll = permissions.every((permission) => {
+            return user.hasPermission(permission);
+        });
+        if (!hasAll)
+            throw new common_1.ForbiddenException('Insufficient permissions.');
+        return true;
+    }
+};
+exports.PermissionGuard = PermissionGuard;
+exports.PermissionGuard = PermissionGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [core_1.Reflector])
+], PermissionGuard);
+//# sourceMappingURL=permission.guard.js.map
\ No newline at end of file
diff --git a/dist/modules/authorization/presentation/guards/permission.guard.js.map b/dist/modules/authorization/presentation/guards/permission.guard.js.map
new file mode 100644
index 0000000..f868731
--- /dev/null
+++ b/dist/modules/authorization/presentation/guards/permission.guard.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"permission.guard.js","sourceRoot":"","sources":["../../../../../src/modules/authorization/presentation/guards/permission.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAMwB;AACxB,uCAAyC;AAGlC,IAAM,eAAe,GAArB,MAAM,eAAe;IAEP;IADnB,YACmB,SAAoB;QAApB,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEJ,WAAW,CAAC,OAAyB;QACnC,MAAM,WAAW,GACf,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC9B,aAAa,EACb;YACE,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CACF,CAAC;QAEJ,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAS,CAAC;QAE3D,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC;QAEjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,8BAAqB,CAAC,0BAA0B,CAAC,CAAC;QAC9D,CAAC;QAEG,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,UAAU,EAAE,EAAE;YAClD,OAAO,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,2BAAkB,CAAC,2BAA2B,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAnCY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;qCAGmB,gBAAS;GAF5B,eAAe,CAmC3B"}
\ No newline at end of file
diff --git a/dist/modules/health/health.controller.js b/dist/modules/health/health.controller.js
new file mode 100644
index 0000000..d008ea9
--- /dev/null
+++ b/dist/modules/health/health.controller.js
@@ -0,0 +1,35 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HealthController = void 0;
+const common_1 = require("@nestjs/common");
+const health_service_1 = require("./health.service");
+let HealthController = class HealthController {
+    healthService;
+    constructor(healthService) {
+        this.healthService = healthService;
+    }
+    async get() {
+        return this.healthService.getHealth();
+    }
+};
+exports.HealthController = HealthController;
+__decorate([
+    (0, common_1.Get)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], HealthController.prototype, "get", null);
+exports.HealthController = HealthController = __decorate([
+    (0, common_1.Controller)('api/health'),
+    __metadata("design:paramtypes", [health_service_1.HealthService])
+], HealthController);
+//# sourceMappingURL=health.controller.js.map
\ No newline at end of file
diff --git a/dist/modules/health/health.controller.js.map b/dist/modules/health/health.controller.js.map
new file mode 100644
index 0000000..1461be4
--- /dev/null
+++ b/dist/modules/health/health.controller.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"health.controller.js","sourceRoot":"","sources":["../../../src/modules/health/health.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAiD;AACjD,qDAAiD;AAG1C,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IACE;IAA7B,YAA6B,aAA4B;QAA5B,kBAAa,GAAb,aAAa,CAAe;IAAG,CAAC;IAGvD,AAAN,KAAK,CAAC,GAAG;QACP,OAAO,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,CAAC;IACxC,CAAC;CACF,CAAA;AAPY,4CAAgB;AAIrB;IADL,IAAA,YAAG,GAAE;;;;2CAGL;2BANU,gBAAgB;IAD5B,IAAA,mBAAU,EAAC,YAAY,CAAC;qCAEqB,8BAAa;GAD9C,gBAAgB,CAO5B"}
\ No newline at end of file
diff --git a/dist/modules/health/health.module.js b/dist/modules/health/health.module.js
new file mode 100644
index 0000000..2ff3522
--- /dev/null
+++ b/dist/modules/health/health.module.js
@@ -0,0 +1,23 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HealthModule = void 0;
+const common_1 = require("@nestjs/common");
+const health_controller_1 = require("./health.controller");
+const health_service_1 = require("./health.service");
+let HealthModule = class HealthModule {
+};
+exports.HealthModule = HealthModule;
+exports.HealthModule = HealthModule = __decorate([
+    (0, common_1.Module)({
+        controllers: [health_controller_1.HealthController],
+        providers: [health_service_1.HealthService],
+        exports: [health_service_1.HealthService],
+    })
+], HealthModule);
+//# sourceMappingURL=health.module.js.map
\ No newline at end of file
diff --git a/dist/modules/health/health.module.js.map b/dist/modules/health/health.module.js.map
new file mode 100644
index 0000000..5fab47e
--- /dev/null
+++ b/dist/modules/health/health.module.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"health.module.js","sourceRoot":"","sources":["../../../src/modules/health/health.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,2DAAuD;AACvD,qDAAiD;AAO1C,IAAM,YAAY,GAAlB,MAAM,YAAY;CAAG,CAAA;AAAf,oCAAY;uBAAZ,YAAY;IALxB,IAAA,eAAM,EAAC;QACN,WAAW,EAAE,CAAC,oCAAgB,CAAC;QAC/B,SAAS,EAAE,CAAC,8BAAa,CAAC;QAC1B,OAAO,EAAE,CAAC,8BAAa,CAAC;KACzB,CAAC;GACW,YAAY,CAAG"}
\ No newline at end of file
diff --git a/dist/modules/health/health.service.js b/dist/modules/health/health.service.js
new file mode 100644
index 0000000..bd95e68
--- /dev/null
+++ b/dist/modules/health/health.service.js
@@ -0,0 +1,24 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HealthService = void 0;
+const common_1 = require("@nestjs/common");
+let HealthService = class HealthService {
+    async getHealth() {
+        return {
+            status: 'ok',
+            timestamp: new Date().toISOString(),
+            service: 'raylab-core',
+        };
+    }
+};
+exports.HealthService = HealthService;
+exports.HealthService = HealthService = __decorate([
+    (0, common_1.Injectable)()
+], HealthService);
+//# sourceMappingURL=health.service.js.map
\ No newline at end of file
diff --git a/dist/modules/health/health.service.js.map b/dist/modules/health/health.service.js.map
new file mode 100644
index 0000000..14ed2a4
--- /dev/null
+++ b/dist/modules/health/health.service.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"health.service.js","sourceRoot":"","sources":["../../../src/modules/health/health.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4C;AAGrC,IAAM,aAAa,GAAnB,MAAM,aAAa;IACxB,KAAK,CAAC,SAAS;QACb,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,OAAO,EAAE,aAAa;SACvB,CAAC;IACJ,CAAC;CACF,CAAA;AARY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;GACA,aAAa,CAQzB"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/config/env-auth-config.js b/dist/modules/identity/application/config/env-auth-config.js
new file mode 100644
index 0000000..726f871
--- /dev/null
+++ b/dist/modules/identity/application/config/env-auth-config.js
@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnvAuthConfig = void 0;
+class EnvAuthConfig {
+    autoCreateUser() {
+        return (process.env.AUTH_AUTO_CREATE_USER ?? 'true') === 'true';
+    }
+    syncEmail() {
+        return (process.env.AUTH_SYNC_EMAIL ?? 'true') === 'true';
+    }
+    syncUsername() {
+        return (process.env.AUTH_SYNC_USERNAME ?? 'false') === 'true';
+    }
+}
+exports.EnvAuthConfig = EnvAuthConfig;
+//# sourceMappingURL=env-auth-config.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/config/env-auth-config.js.map b/dist/modules/identity/application/config/env-auth-config.js.map
new file mode 100644
index 0000000..0323378
--- /dev/null
+++ b/dist/modules/identity/application/config/env-auth-config.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"env-auth-config.js","sourceRoot":"","sources":["../../../../../src/modules/identity/application/config/env-auth-config.ts"],"names":[],"mappings":";;;AAEA,MAAa,aAAa;IACxB,cAAc;QACZ,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,MAAM,CAAC,KAAK,MAAM,CAAC;IAClE,CAAC;IAED,SAAS;QACP,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,MAAM,CAAC,KAAK,MAAM,CAAC;IAC5D,CAAC;IAED,YAAY;QACV,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,KAAK,MAAM,CAAC;IAChE,CAAC;CACF;AAZD,sCAYC"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/config/i-auth-config.js b/dist/modules/identity/application/config/i-auth-config.js
new file mode 100644
index 0000000..8ed71cd
--- /dev/null
+++ b/dist/modules/identity/application/config/i-auth-config.js
@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IAuthConfig = void 0;
+class IAuthConfig {
+}
+exports.IAuthConfig = IAuthConfig;
+//# sourceMappingURL=i-auth-config.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/config/i-auth-config.js.map b/dist/modules/identity/application/config/i-auth-config.js.map
new file mode 100644
index 0000000..9c3285a
--- /dev/null
+++ b/dist/modules/identity/application/config/i-auth-config.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"i-auth-config.js","sourceRoot":"","sources":["../../../../../src/modules/identity/application/config/i-auth-config.ts"],"names":[],"mappings":";;;AAAA,MAAsB,WAAW;CAIhC;AAJD,kCAIC"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/permission/create-permission.handler.js b/dist/modules/identity/application/handlers/permission/create-permission.handler.js
new file mode 100644
index 0000000..57980c4
--- /dev/null
+++ b/dist/modules/identity/application/handlers/permission/create-permission.handler.js
@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreatePermissionHandler = void 0;
+const common_1 = require("@nestjs/common");
+const permission_interface_1 = require("../../../domain/repositories/permission.interface");
+const permission_entity_1 = require("../../../domain/entities/permission.entity");
+const event_bus_service_1 = require("../../../../../core/event-bus/event-bus.service");
+const crypto = require('crypto');
+let CreatePermissionHandler = class CreatePermissionHandler {
+    permissionRepository;
+    events;
+    constructor(permissionRepository, events) {
+        this.permissionRepository = permissionRepository;
+        this.events = events;
+    }
+    async execute(dto) {
+        if (!dto.name || !dto.code)
+            throw new common_1.ConflictException('Missing required fields');
+        const perm = permission_entity_1.PermissionData.restore({
+            id: crypto.randomUUID(),
+            code: dto.code || dto.name,
+            name: dto.name,
+            displayName: dto.displayName || dto.name,
+            description: dto.description || '',
+            createdAt: new Date(),
+            updatedAt: new Date(),
+        });
+        const created = await this.permissionRepository.create(perm);
+        this.events.publish({ id: require('crypto').randomUUID(), timestamp: new Date().toISOString(), type: 'PermissionCreated', payload: { permissionId: created.id } });
+        return created;
+    }
+};
+exports.CreatePermissionHandler = CreatePermissionHandler;
+exports.CreatePermissionHandler = CreatePermissionHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [permission_interface_1.IPermission, event_bus_service_1.EventBus])
+], CreatePermissionHandler);
+//# sourceMappingURL=create-permission.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/permission/create-permission.handler.js.map b/dist/modules/identity/application/handlers/permission/create-permission.handler.js.map
new file mode 100644
index 0000000..96dc5a0
--- /dev/null
+++ b/dist/modules/identity/application/handlers/permission/create-permission.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"create-permission.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/permission/create-permission.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,4FAAgF;AAChF,kFAA4E;AAC5E,uFAA2E;AAE3E,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAG1B,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IACL;IAAoD;IAAjF,YAA6B,oBAAiC,EAAmB,MAAgB;QAApE,yBAAoB,GAApB,oBAAoB,CAAa;QAAmB,WAAM,GAAN,MAAM,CAAU;IAAG,CAAC;IAErG,KAAK,CAAC,OAAO,CAAC,GAAQ;QACpB,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,yBAAyB,CAAC,CAAC;QAEnF,MAAM,IAAI,GAAG,kCAAc,CAAC,OAAO,CAAC;YAClC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;YACvB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI;YAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,IAAI;YACxC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;YAClC,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;SACf,CAAC,CAAC;QAEV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnK,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AApBY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAEwC,kCAAW,EAA2B,4BAAQ;GADtF,uBAAuB,CAoBnC"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/permission/delete-permission.handler.js b/dist/modules/identity/application/handlers/permission/delete-permission.handler.js
new file mode 100644
index 0000000..68f7f61
--- /dev/null
+++ b/dist/modules/identity/application/handlers/permission/delete-permission.handler.js
@@ -0,0 +1,54 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeletePermissionHandler = void 0;
+const common_1 = require("@nestjs/common");
+const permission_interface_1 = require("../../../domain/repositories/permission.interface");
+const role_interface_1 = require("../../../domain/repositories/role.interface");
+const authorization_service_1 = require("../../../../authorization/authorization.service");
+const event_bus_service_1 = require("../../../../../core/event-bus/event-bus.service");
+let DeletePermissionHandler = class DeletePermissionHandler {
+    permissionRepository;
+    roleRepository;
+    authorizationService;
+    events;
+    constructor(permissionRepository, roleRepository, authorizationService, events) {
+        this.permissionRepository = permissionRepository;
+        this.roleRepository = roleRepository;
+        this.authorizationService = authorizationService;
+        this.events = events;
+    }
+    async execute(id) {
+        const p = await this.permissionRepository.getById(id);
+        if (!p)
+            throw new common_1.NotFoundException('Permission not found.');
+        // find roles that reference this permission
+        const rolesWithPerm = await this.permissionRepository.findRoleIdsByPermission(id);
+        // delete permission
+        await this.permissionRepository.delete(id);
+        // invalidate caches for users who have affected roles
+        const userSet = new Set();
+        for (const rid of rolesWithPerm) {
+            const uids = await this.roleRepository.getAssignedUserIds(rid);
+            uids.forEach(u => userSet.add(u));
+        }
+        for (const uid of Array.from(userSet))
+            await this.authorizationService.invalidateUserPermissions(uid);
+        this.events.publish({ id: require('crypto').randomUUID(), timestamp: new Date().toISOString(), type: 'PermissionDeleted', payload: { permissionId: id, affectedRoles: rolesWithPerm } });
+        return;
+    }
+};
+exports.DeletePermissionHandler = DeletePermissionHandler;
+exports.DeletePermissionHandler = DeletePermissionHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [permission_interface_1.IPermission, role_interface_1.IRole, authorization_service_1.AuthorizationService, event_bus_service_1.EventBus])
+], DeletePermissionHandler);
+//# sourceMappingURL=delete-permission.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/permission/delete-permission.handler.js.map b/dist/modules/identity/application/handlers/permission/delete-permission.handler.js.map
new file mode 100644
index 0000000..9f54506
--- /dev/null
+++ b/dist/modules/identity/application/handlers/permission/delete-permission.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"delete-permission.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/permission/delete-permission.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,4FAAgF;AAChF,gFAAoE;AACpE,2FAAuF;AACvF,uFAA2E;AAGpE,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IACL;IAAoD;IAAwC;IAA6D;IAAtL,YAA6B,oBAAiC,EAAmB,cAAqB,EAAmB,oBAA0C,EAAmB,MAAgB;QAAzK,yBAAoB,GAApB,oBAAoB,CAAa;QAAmB,mBAAc,GAAd,cAAc,CAAO;QAAmB,yBAAoB,GAApB,oBAAoB,CAAsB;QAAmB,WAAM,GAAN,MAAM,CAAU;IAAG,CAAC;IAE1M,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;QAE7D,4CAA4C;QAC5C,MAAM,aAAa,GAAG,MAAO,IAAI,CAAC,oBAA4B,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAE3F,oBAAoB;QACpB,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAE3C,sDAAsD;QACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAEtG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,aAAa,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAEzL,OAAO;IACT,CAAC;CACF,CAAA;AA1BY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAEwC,kCAAW,EAAmC,sBAAK,EAAyC,4CAAoB,EAA2B,4BAAQ;GAD3L,uBAAuB,CA0BnC"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/permission/get-permission.handler.js b/dist/modules/identity/application/handlers/permission/get-permission.handler.js
new file mode 100644
index 0000000..12e92c1
--- /dev/null
+++ b/dist/modules/identity/application/handlers/permission/get-permission.handler.js
@@ -0,0 +1,29 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetPermissionHandler = void 0;
+const common_1 = require("@nestjs/common");
+const permission_interface_1 = require("../../../domain/repositories/permission.interface");
+let GetPermissionHandler = class GetPermissionHandler {
+    permissionRepository;
+    constructor(permissionRepository) {
+        this.permissionRepository = permissionRepository;
+    }
+    async execute(id) {
+        return this.permissionRepository.getById(id);
+    }
+};
+exports.GetPermissionHandler = GetPermissionHandler;
+exports.GetPermissionHandler = GetPermissionHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [permission_interface_1.IPermission])
+], GetPermissionHandler);
+//# sourceMappingURL=get-permission.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/permission/get-permission.handler.js.map b/dist/modules/identity/application/handlers/permission/get-permission.handler.js.map
new file mode 100644
index 0000000..e0308b5
--- /dev/null
+++ b/dist/modules/identity/application/handlers/permission/get-permission.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"get-permission.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/permission/get-permission.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,4FAAgF;AAGzE,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACF;IAA7B,YAA6B,oBAAiC;QAAjC,yBAAoB,GAApB,oBAAoB,CAAa;IAAG,CAAC;IAElE,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;CACF,CAAA;AANY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAEwC,kCAAW;GADnD,oBAAoB,CAMhC"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/permission/get-permissions.handler.js b/dist/modules/identity/application/handlers/permission/get-permissions.handler.js
new file mode 100644
index 0000000..d86ca2c
--- /dev/null
+++ b/dist/modules/identity/application/handlers/permission/get-permissions.handler.js
@@ -0,0 +1,29 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetPermissionsHandler = void 0;
+const common_1 = require("@nestjs/common");
+const permission_interface_1 = require("../../../domain/repositories/permission.interface");
+let GetPermissionsHandler = class GetPermissionsHandler {
+    permissionRepository;
+    constructor(permissionRepository) {
+        this.permissionRepository = permissionRepository;
+    }
+    async execute(query) {
+        return this.permissionRepository.find({ page: query.page, limit: query.limit, search: query.search || null });
+    }
+};
+exports.GetPermissionsHandler = GetPermissionsHandler;
+exports.GetPermissionsHandler = GetPermissionsHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [permission_interface_1.IPermission])
+], GetPermissionsHandler);
+//# sourceMappingURL=get-permissions.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/permission/get-permissions.handler.js.map b/dist/modules/identity/application/handlers/permission/get-permissions.handler.js.map
new file mode 100644
index 0000000..ac7e3a5
--- /dev/null
+++ b/dist/modules/identity/application/handlers/permission/get-permissions.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"get-permissions.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/permission/get-permissions.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,4FAAgF;AAGzE,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IACH;IAA7B,YAA6B,oBAAiC;QAAjC,yBAAoB,GAApB,oBAAoB,CAAa;IAAG,CAAC;IAElE,KAAK,CAAC,OAAO,CAAC,KAAyD;QACrE,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IAChH,CAAC;CACF,CAAA;AANY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;qCAEwC,kCAAW;GADnD,qBAAqB,CAMjC"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/permission/update-permission.handler.js b/dist/modules/identity/application/handlers/permission/update-permission.handler.js
new file mode 100644
index 0000000..d7c86dc
--- /dev/null
+++ b/dist/modules/identity/application/handlers/permission/update-permission.handler.js
@@ -0,0 +1,58 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdatePermissionHandler = void 0;
+const common_1 = require("@nestjs/common");
+const permission_interface_1 = require("../../../domain/repositories/permission.interface");
+const role_interface_1 = require("../../../domain/repositories/role.interface");
+const authorization_service_1 = require("../../../../authorization/authorization.service");
+const event_bus_service_1 = require("../../../../../core/event-bus/event-bus.service");
+let UpdatePermissionHandler = class UpdatePermissionHandler {
+    permissionRepository;
+    roleRepository;
+    authorizationService;
+    events;
+    constructor(permissionRepository, roleRepository, authorizationService, events) {
+        this.permissionRepository = permissionRepository;
+        this.roleRepository = roleRepository;
+        this.authorizationService = authorizationService;
+        this.events = events;
+    }
+    async execute(id, dto) {
+        const perm = await this.permissionRepository.getById(id);
+        if (!perm)
+            throw new common_1.NotFoundException('Permission not found.');
+        if (dto.name)
+            perm.changeName(dto.name);
+        if (dto.description !== undefined)
+            perm.changeDescription(dto.description);
+        if (dto.code)
+            perm.changeCode(dto.code);
+        const updated = await this.permissionRepository.update(perm);
+        // invalidate caches for users who belong to roles that reference this permission
+        const roleIds = await this.permissionRepository.findRoleIdsByPermission(id);
+        const userSet = new Set();
+        for (const rid of roleIds) {
+            const uids = await this.roleRepository.getAssignedUserIds(rid);
+            uids.forEach(u => userSet.add(u));
+        }
+        for (const uid of Array.from(userSet))
+            await this.authorizationService.invalidateUserPermissions(uid);
+        this.events.publish({ id: require('crypto').randomUUID(), timestamp: new Date().toISOString(), type: 'PermissionUpdated', payload: { permissionId: id } });
+        return updated;
+    }
+};
+exports.UpdatePermissionHandler = UpdatePermissionHandler;
+exports.UpdatePermissionHandler = UpdatePermissionHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [permission_interface_1.IPermission, role_interface_1.IRole, authorization_service_1.AuthorizationService, event_bus_service_1.EventBus])
+], UpdatePermissionHandler);
+//# sourceMappingURL=update-permission.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/permission/update-permission.handler.js.map b/dist/modules/identity/application/handlers/permission/update-permission.handler.js.map
new file mode 100644
index 0000000..01dc6ed
--- /dev/null
+++ b/dist/modules/identity/application/handlers/permission/update-permission.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"update-permission.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/permission/update-permission.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,4FAAgF;AAChF,gFAAoE;AACpE,2FAAuF;AACvF,uFAA2E;AAGpE,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IACL;IAAoD;IAAwC;IAA6D;IAAtL,YAA6B,oBAAiC,EAAmB,cAAqB,EAAmB,oBAA0C,EAAmB,MAAgB;QAAzK,yBAAoB,GAApB,oBAAoB,CAAa;QAAmB,mBAAc,GAAd,cAAc,CAAO;QAAmB,yBAAoB,GAApB,oBAAoB,CAAsB;QAAmB,WAAM,GAAN,MAAM,CAAU;IAAG,CAAC;IAE1M,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,GAAQ;QAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;QAEhE,IAAI,GAAG,CAAC,IAAI;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC3E,IAAI,GAAG,CAAC,IAAI;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAExC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE7D,iFAAiF;QACjF,MAAM,OAAO,GAAG,MAAO,IAAI,CAAC,oBAA4B,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;QACrF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAElC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;YAC/D,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAEtG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAE3J,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AA5BY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAEwC,kCAAW,EAAmC,sBAAK,EAAyC,4CAAoB,EAA2B,4BAAQ;GAD3L,uBAAuB,CA4BnC"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/role/assign-permission.handler.js b/dist/modules/identity/application/handlers/role/assign-permission.handler.js
new file mode 100644
index 0000000..7ec4e30
--- /dev/null
+++ b/dist/modules/identity/application/handlers/role/assign-permission.handler.js
@@ -0,0 +1,56 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleAssignPermissionHandler = void 0;
+const common_1 = require("@nestjs/common");
+const role_interface_1 = require("../../../domain/repositories/role.interface");
+const permission_interface_1 = require("../../../domain/repositories/permission.interface");
+const authorization_service_1 = require("../../../../authorization/authorization.service");
+const event_bus_service_1 = require("../../../../../core/event-bus/event-bus.service");
+let RoleAssignPermissionHandler = class RoleAssignPermissionHandler {
+    roleRepository;
+    permissionRepository;
+    authorizationService;
+    events;
+    constructor(roleRepository, permissionRepository, authorizationService, events) {
+        this.roleRepository = roleRepository;
+        this.permissionRepository = permissionRepository;
+        this.authorizationService = authorizationService;
+        this.events = events;
+    }
+    async execute(roleId, permissionId) {
+        const role = await this.roleRepository.findById(roleId);
+        if (!role)
+            throw new common_1.NotFoundException('Role not found.');
+        const perm = await this.permissionRepository.getById(permissionId);
+        if (!perm)
+            throw new common_1.NotFoundException('Permission not found.');
+        role.assignPermission(perm);
+        const updated = await this.roleRepository.update(role);
+        // Invalidate permissions cache for users who have this role
+        const userIds = await this.roleRepository.getAssignedUserIds(roleId);
+        for (const uid of userIds) {
+            await this.authorizationService.invalidateUserPermissions(uid);
+        }
+        // Publish role.updated event
+        this.events.publish({ id: require('crypto').randomUUID(), timestamp: new Date().toISOString(), type: 'RoleUpdated', payload: { roleId, permissionId } });
+        return updated;
+    }
+};
+exports.RoleAssignPermissionHandler = RoleAssignPermissionHandler;
+exports.RoleAssignPermissionHandler = RoleAssignPermissionHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [role_interface_1.IRole,
+        permission_interface_1.IPermission,
+        authorization_service_1.AuthorizationService,
+        event_bus_service_1.EventBus])
+], RoleAssignPermissionHandler);
+//# sourceMappingURL=assign-permission.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/role/assign-permission.handler.js.map b/dist/modules/identity/application/handlers/role/assign-permission.handler.js.map
new file mode 100644
index 0000000..1ab4742
--- /dev/null
+++ b/dist/modules/identity/application/handlers/role/assign-permission.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"assign-permission.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/role/assign-permission.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAuE;AACvE,gFAAoE;AACpE,4FAAgF;AAChF,2FAAuF;AACvF,uFAA2E;AAGpE,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IAEnB;IACA;IACA;IACA;IAJnB,YACmB,cAAqB,EACrB,oBAAiC,EACjC,oBAA0C,EAC1C,MAAgB;QAHhB,mBAAc,GAAd,cAAc,CAAO;QACrB,yBAAoB,GAApB,oBAAoB,CAAa;QACjC,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,WAAM,GAAN,MAAM,CAAU;IAChC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,YAAoB;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QAE1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;QAEhE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEvD,4DAA4D;QAC5D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;QACjE,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAEzJ,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AA9BY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;qCAGwB,sBAAK;QACC,kCAAW;QACX,4CAAoB;QAClC,4BAAQ;GALxB,2BAA2B,CA8BvC"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/role/create-role.handler.js b/dist/modules/identity/application/handlers/role/create-role.handler.js
new file mode 100644
index 0000000..c61e3d9
--- /dev/null
+++ b/dist/modules/identity/application/handlers/role/create-role.handler.js
@@ -0,0 +1,54 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateRoleHandler = void 0;
+const common_1 = require("@nestjs/common");
+const role_interface_1 = require("../../../domain/repositories/role.interface");
+const role_entity_1 = require("../../../domain/entities/role.entity");
+const event_bus_service_1 = require("../../../../../core/event-bus/event-bus.service");
+const crypto = require('crypto');
+let CreateRoleHandler = class CreateRoleHandler {
+    roleRepository;
+    events;
+    constructor(roleRepository, events) {
+        this.roleRepository = roleRepository;
+        this.events = events;
+    }
+    async execute(dto) {
+        // basic validation
+        if (!dto.code || !dto.name)
+            throw new common_1.ConflictException('Missing required fields');
+        try {
+            const role = role_entity_1.RoleData.restore({
+                id: crypto.randomUUID(),
+                code: dto.code,
+                name: dto.name,
+                description: dto.description || '',
+                permissions: [],
+                isDefault: dto.isDefault || false,
+                createdAt: new Date(),
+                updatedAt: new Date(),
+            });
+            const created = await this.roleRepository.create(role);
+            this.events.publish({ id: require('crypto').randomUUID(), timestamp: new Date().toISOString(), type: 'RoleCreated', payload: { roleId: created.id } });
+            return created;
+        }
+        catch (e) {
+            throw new common_1.ConflictException('Role creation failed.');
+        }
+    }
+};
+exports.CreateRoleHandler = CreateRoleHandler;
+exports.CreateRoleHandler = CreateRoleHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [role_interface_1.IRole, event_bus_service_1.EventBus])
+], CreateRoleHandler);
+//# sourceMappingURL=create-role.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/role/create-role.handler.js.map b/dist/modules/identity/application/handlers/role/create-role.handler.js.map
new file mode 100644
index 0000000..d6382d7
--- /dev/null
+++ b/dist/modules/identity/application/handlers/role/create-role.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"create-role.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/role/create-role.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,gFAAoE;AACpE,sEAAgE;AAChE,uFAA2E;AAE3E,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;AAG1B,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IACC;IAAwC;IAArE,YAA6B,cAAqB,EAAmB,MAAgB;QAAxD,mBAAc,GAAd,cAAc,CAAO;QAAmB,WAAM,GAAN,MAAM,CAAU;IAAG,CAAC;IAEzF,KAAK,CAAC,OAAO,CAAC,GAAQ;QACpB,mBAAmB;QACnB,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,yBAAyB,CAAC,CAAC;QAEnF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,sBAAQ,CAAC,OAAO,CAAC;gBAC5B,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE;gBACvB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;gBAClC,WAAW,EAAE,EAAE;gBACf,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,KAAK;gBACjC,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,SAAS,EAAE,IAAI,IAAI,EAAE;aACf,CAAC,CAAC;YAEV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAEvD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAEvJ,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;CACF,CAAA;AA5BY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAEkC,sBAAK,EAA2B,4BAAQ;GAD1E,iBAAiB,CA4B7B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/role/delete-role.handler.js b/dist/modules/identity/application/handlers/role/delete-role.handler.js
new file mode 100644
index 0000000..364e58b
--- /dev/null
+++ b/dist/modules/identity/application/handlers/role/delete-role.handler.js
@@ -0,0 +1,45 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeleteRoleHandler = void 0;
+const common_1 = require("@nestjs/common");
+const role_interface_1 = require("../../../domain/repositories/role.interface");
+const authorization_service_1 = require("../../../../authorization/authorization.service");
+const event_bus_service_1 = require("../../../../../core/event-bus/event-bus.service");
+let DeleteRoleHandler = class DeleteRoleHandler {
+    roleRepository;
+    authorizationService;
+    events;
+    constructor(roleRepository, authorizationService, events) {
+        this.roleRepository = roleRepository;
+        this.authorizationService = authorizationService;
+        this.events = events;
+    }
+    async execute(id) {
+        const role = await this.roleRepository.findById(id);
+        if (!role)
+            throw new common_1.NotFoundException('Role not found.');
+        // get affected users before delete
+        const userIds = await this.roleRepository.getAssignedUserIds(id);
+        await this.roleRepository.delete(id);
+        // invalidate caches
+        for (const uid of userIds)
+            await this.authorizationService.invalidateUserPermissions(uid);
+        this.events.publish({ id: require('crypto').randomUUID(), timestamp: new Date().toISOString(), type: 'RoleDeleted', payload: { roleId: id } });
+        return;
+    }
+};
+exports.DeleteRoleHandler = DeleteRoleHandler;
+exports.DeleteRoleHandler = DeleteRoleHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [role_interface_1.IRole, authorization_service_1.AuthorizationService, event_bus_service_1.EventBus])
+], DeleteRoleHandler);
+//# sourceMappingURL=delete-role.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/role/delete-role.handler.js.map b/dist/modules/identity/application/handlers/role/delete-role.handler.js.map
new file mode 100644
index 0000000..cb54805
--- /dev/null
+++ b/dist/modules/identity/application/handlers/role/delete-role.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"delete-role.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/role/delete-role.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,gFAAoE;AACpE,2FAAuF;AACvF,uFAA2E;AAGpE,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IACC;IAAwC;IAA6D;IAAlI,YAA6B,cAAqB,EAAmB,oBAA0C,EAAmB,MAAgB;QAArH,mBAAc,GAAd,cAAc,CAAO;QAAmB,yBAAoB,GAApB,oBAAoB,CAAsB;QAAmB,WAAM,GAAN,MAAM,CAAU;IAAG,CAAC;IAEtJ,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QAE1D,mCAAmC;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAEjE,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAErC,oBAAoB;QACpB,KAAK,MAAM,GAAG,IAAI,OAAO;YAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAE1F,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAE/I,OAAO;IACT,CAAC;CACF,CAAA;AAnBY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAEkC,sBAAK,EAAyC,4CAAoB,EAA2B,4BAAQ;GADvI,iBAAiB,CAmB7B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/role/get-role.handler.js b/dist/modules/identity/application/handlers/role/get-role.handler.js
new file mode 100644
index 0000000..52296bd
--- /dev/null
+++ b/dist/modules/identity/application/handlers/role/get-role.handler.js
@@ -0,0 +1,29 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetRoleHandler = void 0;
+const common_1 = require("@nestjs/common");
+const role_interface_1 = require("../../../domain/repositories/role.interface");
+let GetRoleHandler = class GetRoleHandler {
+    roleRepository;
+    constructor(roleRepository) {
+        this.roleRepository = roleRepository;
+    }
+    async execute(id) {
+        return this.roleRepository.findById(id);
+    }
+};
+exports.GetRoleHandler = GetRoleHandler;
+exports.GetRoleHandler = GetRoleHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [role_interface_1.IRole])
+], GetRoleHandler);
+//# sourceMappingURL=get-role.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/role/get-role.handler.js.map b/dist/modules/identity/application/handlers/role/get-role.handler.js.map
new file mode 100644
index 0000000..d43f1e7
--- /dev/null
+++ b/dist/modules/identity/application/handlers/role/get-role.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"get-role.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/role/get-role.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,gFAAoE;AAG7D,IAAM,cAAc,GAApB,MAAM,cAAc;IACI;IAA7B,YAA6B,cAAqB;QAArB,mBAAc,GAAd,cAAc,CAAO;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AANY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;qCAEkC,sBAAK;GADvC,cAAc,CAM1B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/role/get-roles.handler.js b/dist/modules/identity/application/handlers/role/get-roles.handler.js
new file mode 100644
index 0000000..1994d0c
--- /dev/null
+++ b/dist/modules/identity/application/handlers/role/get-roles.handler.js
@@ -0,0 +1,29 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetRolesHandler = void 0;
+const common_1 = require("@nestjs/common");
+const role_interface_1 = require("../../../domain/repositories/role.interface");
+let GetRolesHandler = class GetRolesHandler {
+    roleRepository;
+    constructor(roleRepository) {
+        this.roleRepository = roleRepository;
+    }
+    async execute(query) {
+        return this.roleRepository.find({ page: query.page, limit: query.limit, search: query.search || null });
+    }
+};
+exports.GetRolesHandler = GetRolesHandler;
+exports.GetRolesHandler = GetRolesHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [role_interface_1.IRole])
+], GetRolesHandler);
+//# sourceMappingURL=get-roles.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/role/get-roles.handler.js.map b/dist/modules/identity/application/handlers/role/get-roles.handler.js.map
new file mode 100644
index 0000000..25c135a
--- /dev/null
+++ b/dist/modules/identity/application/handlers/role/get-roles.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"get-roles.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/role/get-roles.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,gFAAoE;AAG7D,IAAM,eAAe,GAArB,MAAM,eAAe;IACG;IAA7B,YAA6B,cAAqB;QAArB,mBAAc,GAAd,cAAc,CAAO;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,KAAyD;QACrE,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IAC1G,CAAC;CACF,CAAA;AANY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;qCAEkC,sBAAK;GADvC,eAAe,CAM3B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/role/remove-permission.handler.js b/dist/modules/identity/application/handlers/role/remove-permission.handler.js
new file mode 100644
index 0000000..40382ed
--- /dev/null
+++ b/dist/modules/identity/application/handlers/role/remove-permission.handler.js
@@ -0,0 +1,46 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleRemovePermissionHandler = void 0;
+const common_1 = require("@nestjs/common");
+const role_interface_1 = require("../../../domain/repositories/role.interface");
+const authorization_service_1 = require("../../../../authorization/authorization.service");
+const event_bus_service_1 = require("../../../../../core/event-bus/event-bus.service");
+let RoleRemovePermissionHandler = class RoleRemovePermissionHandler {
+    roleRepository;
+    authorizationService;
+    events;
+    constructor(roleRepository, authorizationService, events) {
+        this.roleRepository = roleRepository;
+        this.authorizationService = authorizationService;
+        this.events = events;
+    }
+    async execute(roleId, permissionId) {
+        const role = await this.roleRepository.findById(roleId);
+        if (!role)
+            throw new common_1.NotFoundException('Role not found.');
+        role.removePermission(permissionId);
+        const updated = await this.roleRepository.update(role);
+        // Invalidate caches for users with the role
+        const userIds = await this.roleRepository.getAssignedUserIds(roleId);
+        for (const uid of userIds)
+            await this.authorizationService.invalidateUserPermissions(uid);
+        // Publish event
+        this.events.publish({ id: require('crypto').randomUUID(), timestamp: new Date().toISOString(), type: 'RoleUpdated', payload: { roleId, removedPermissionId: permissionId } });
+        return updated;
+    }
+};
+exports.RoleRemovePermissionHandler = RoleRemovePermissionHandler;
+exports.RoleRemovePermissionHandler = RoleRemovePermissionHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [role_interface_1.IRole, authorization_service_1.AuthorizationService, event_bus_service_1.EventBus])
+], RoleRemovePermissionHandler);
+//# sourceMappingURL=remove-permission.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/role/remove-permission.handler.js.map b/dist/modules/identity/application/handlers/role/remove-permission.handler.js.map
new file mode 100644
index 0000000..d788e58
--- /dev/null
+++ b/dist/modules/identity/application/handlers/role/remove-permission.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"remove-permission.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/role/remove-permission.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,gFAAoE;AACpE,2FAAuF;AACvF,uFAA2E;AAGpE,IAAM,2BAA2B,GAAjC,MAAM,2BAA2B;IACT;IAAwC;IAA6D;IAAlI,YAA6B,cAAqB,EAAmB,oBAA0C,EAAmB,MAAgB;QAArH,mBAAc,GAAd,cAAc,CAAO;QAAmB,yBAAoB,GAApB,oBAAoB,CAAsB;QAAmB,WAAM,GAAN,MAAM,CAAU;IAAG,CAAC;IAEtJ,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,YAAoB;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QAE1D,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAEpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEvD,4CAA4C;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACrE,KAAK,MAAM,GAAG,IAAI,OAAO;YAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAE1F,gBAAgB;QAChB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QAE9K,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AApBY,kEAA2B;sCAA3B,2BAA2B;IADvC,IAAA,mBAAU,GAAE;qCAEkC,sBAAK,EAAyC,4CAAoB,EAA2B,4BAAQ;GADvI,2BAA2B,CAoBvC"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/role/update-role.handler.js b/dist/modules/identity/application/handlers/role/update-role.handler.js
new file mode 100644
index 0000000..e763d40
--- /dev/null
+++ b/dist/modules/identity/application/handlers/role/update-role.handler.js
@@ -0,0 +1,53 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateRoleHandler = void 0;
+const common_1 = require("@nestjs/common");
+const role_interface_1 = require("../../../domain/repositories/role.interface");
+const authorization_service_1 = require("../../../../authorization/authorization.service");
+const event_bus_service_1 = require("../../../../../core/event-bus/event-bus.service");
+let UpdateRoleHandler = class UpdateRoleHandler {
+    roleRepository;
+    authorizationService;
+    events;
+    constructor(roleRepository, authorizationService, events) {
+        this.roleRepository = roleRepository;
+        this.authorizationService = authorizationService;
+        this.events = events;
+    }
+    async execute(id, dto) {
+        const role = await this.roleRepository.findById(id);
+        if (!role)
+            throw new common_1.NotFoundException('Role not found.');
+        // validation
+        if (dto.name && dto.name.length < 2)
+            throw new common_1.BadRequestException('Name too short');
+        if (dto.name)
+            role.changeName(dto.name);
+        if (dto.description !== undefined)
+            role.changeDescription(dto.description);
+        if (dto.isDefault !== undefined)
+            role.setDefault(!!dto.isDefault);
+        const updated = await this.roleRepository.update(role);
+        // invalidate caches for users with this role
+        const userIds = await this.roleRepository.getAssignedUserIds(id);
+        for (const uid of userIds)
+            await this.authorizationService.invalidateUserPermissions(uid);
+        this.events.publish({ id: require('crypto').randomUUID(), timestamp: new Date().toISOString(), type: 'RoleUpdated', payload: { roleId: id } });
+        return updated;
+    }
+};
+exports.UpdateRoleHandler = UpdateRoleHandler;
+exports.UpdateRoleHandler = UpdateRoleHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [role_interface_1.IRole, authorization_service_1.AuthorizationService, event_bus_service_1.EventBus])
+], UpdateRoleHandler);
+//# sourceMappingURL=update-role.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/role/update-role.handler.js.map b/dist/modules/identity/application/handlers/role/update-role.handler.js.map
new file mode 100644
index 0000000..f285491
--- /dev/null
+++ b/dist/modules/identity/application/handlers/role/update-role.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"update-role.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/role/update-role.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAoF;AACpF,gFAAoE;AACpE,2FAAuF;AACvF,uFAA2E;AAGpE,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IACC;IAAwC;IAA6D;IAAlI,YAA6B,cAAqB,EAAmB,oBAA0C,EAAmB,MAAgB;QAArH,mBAAc,GAAd,cAAc,CAAO;QAAmB,yBAAoB,GAApB,oBAAoB,CAAsB;QAAmB,WAAM,GAAN,MAAM,CAAU;IAAG,CAAC;IAEtJ,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,GAAQ;QAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QAE1D,aAAa;QACb,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,CAAC,CAAC;QAErF,IAAI,GAAG,CAAC,IAAI;YAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC3E,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAElE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEvD,6CAA6C;QAC7C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACjE,KAAK,MAAM,GAAG,IAAI,OAAO;YAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAE1F,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAE/I,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AAxBY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAEkC,sBAAK,EAAyC,4CAAoB,EAA2B,4BAAQ;GADvI,iBAAiB,CAwB7B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/assign-permission.handler.js b/dist/modules/identity/application/handlers/user/assign-permission.handler.js
new file mode 100644
index 0000000..ebbfad0
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/assign-permission.handler.js
@@ -0,0 +1,42 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AssignPermissionHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_interface_1 = require("../../../domain/repositories/user.interface");
+const permission_entity_1 = require("../../../domain/entities/permission.entity");
+let AssignPermissionHandler = class AssignPermissionHandler {
+    userRepository;
+    constructor(userRepository) {
+        this.userRepository = userRepository;
+    }
+    async execute(userId, permissionId) {
+        const user = await this.userRepository.getById(userId);
+        if (!user)
+            throw new common_1.NotFoundException('User not found.');
+        // Permission repository is not available; create a minimal PermissionData
+        const perm = permission_entity_1.PermissionData.restore({
+            id: permissionId,
+            name: permissionId,
+            description: '',
+            createdAt: new Date(),
+            updatedAt: new Date(),
+        });
+        user.assignPermission(perm);
+        return this.userRepository.update(user);
+    }
+};
+exports.AssignPermissionHandler = AssignPermissionHandler;
+exports.AssignPermissionHandler = AssignPermissionHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_interface_1.IUser])
+], AssignPermissionHandler);
+//# sourceMappingURL=assign-permission.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/assign-permission.handler.js.map b/dist/modules/identity/application/handlers/user/assign-permission.handler.js.map
new file mode 100644
index 0000000..69bfd0d
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/assign-permission.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"assign-permission.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/user/assign-permission.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,gFAAoE;AACpE,kFAA4E;AAGrE,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IACL;IAA7B,YAA6B,cAAqB;QAArB,mBAAc,GAAd,cAAc,CAAO;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,YAAoB;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QAE1D,0EAA0E;QAC1E,MAAM,IAAI,GAAG,kCAAc,CAAC,OAAO,CAAC;YAClC,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,YAAY;YAClB,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5B,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AApBY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAEkC,sBAAK;GADvC,uBAAuB,CAoBnC"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/assign-role.handler.js b/dist/modules/identity/application/handlers/user/assign-role.handler.js
new file mode 100644
index 0000000..b0f6e6d
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/assign-role.handler.js
@@ -0,0 +1,40 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AssignRoleHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_interface_1 = require("../../../domain/repositories/user.interface");
+const role_interface_1 = require("../../../domain/repositories/role.interface");
+let AssignRoleHandler = class AssignRoleHandler {
+    userRepository;
+    roleRepository;
+    constructor(userRepository, roleRepository) {
+        this.userRepository = userRepository;
+        this.roleRepository = roleRepository;
+    }
+    async execute(userId, roleId) {
+        const user = await this.userRepository.getById(userId);
+        if (!user)
+            throw new common_1.NotFoundException('User not found.');
+        const role = await this.roleRepository.findById(roleId);
+        if (!role)
+            throw new common_1.NotFoundException('Role not found.');
+        user.assignRole(role);
+        return this.userRepository.update(user);
+    }
+};
+exports.AssignRoleHandler = AssignRoleHandler;
+exports.AssignRoleHandler = AssignRoleHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_interface_1.IUser,
+        role_interface_1.IRole])
+], AssignRoleHandler);
+//# sourceMappingURL=assign-role.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/assign-role.handler.js.map b/dist/modules/identity/application/handlers/user/assign-role.handler.js.map
new file mode 100644
index 0000000..7998815
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/assign-role.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"assign-role.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/user/assign-role.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,gFAAoE;AACpE,gFAAoE;AAG7D,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAET;IACA;IAFnB,YACmB,cAAqB,EACrB,cAAqB;QADrB,mBAAc,GAAd,cAAc,CAAO;QACrB,mBAAc,GAAd,cAAc,CAAO;IACrC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,MAAc;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QAE1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QAE1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAEtB,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AAjBY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAGwB,sBAAK;QACL,sBAAK;GAH7B,iBAAiB,CAiB7B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/create-user.handler.js b/dist/modules/identity/application/handlers/user/create-user.handler.js
new file mode 100644
index 0000000..5c860df
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/create-user.handler.js
@@ -0,0 +1,39 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateUserHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_interface_1 = require("../../../domain/repositories/user.interface");
+const user_service_1 = require("../../services/user.service");
+let CreateUserHandler = class CreateUserHandler {
+    userRepository;
+    userService;
+    constructor(userRepository, userService) {
+        this.userRepository = userRepository;
+        this.userService = userService;
+    }
+    async execute(dto) {
+        const exists = await this.userRepository.existByEmail(dto.email);
+        if (exists) {
+            throw new common_1.ConflictException('Email already exists.');
+        }
+        // Provisioning disabled: Do not create users in external IdP from RayLab.
+        // Reject attempts to create users via API to enforce creation-at-Authentik policy.
+        throw new common_1.BadRequestException('User creation via RayLab API is disabled. Create users in Authentik and then login to sync.');
+    }
+};
+exports.CreateUserHandler = CreateUserHandler;
+exports.CreateUserHandler = CreateUserHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_interface_1.IUser,
+        user_service_1.UserService])
+], CreateUserHandler);
+//# sourceMappingURL=create-user.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/create-user.handler.js.map b/dist/modules/identity/application/handlers/user/create-user.handler.js.map
new file mode 100644
index 0000000..fae7a16
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/create-user.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"create-user.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/user/create-user.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAIwB;AAGxB,gFAAoE;AAEpE,8DAA0D;AAGnD,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAET;IACA;IAFnB,YACmB,cAAqB,EACrB,WAAwB;QADxB,mBAAc,GAAd,cAAc,CAAO;QACrB,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,GAAkB;QAE9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAEjE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,0BAAiB,CAAC,uBAAuB,CAAC,CAAC;QACvD,CAAC;QAED,0EAA0E;QAC1E,mFAAmF;QACnF,MAAM,IAAI,4BAAmB,CAAC,6FAA6F,CAAC,CAAC;IAC/H,CAAC;CACF,CAAA;AAlBY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAGwB,sBAAK;QACR,0BAAW;GAHhC,iBAAiB,CAkB7B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/delete-user.handler.js b/dist/modules/identity/application/handlers/user/delete-user.handler.js
new file mode 100644
index 0000000..f7e24b5
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/delete-user.handler.js
@@ -0,0 +1,32 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeleteUserHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_interface_1 = require("../../../domain/repositories/user.interface");
+let DeleteUserHandler = class DeleteUserHandler {
+    userRepository;
+    constructor(userRepository) {
+        this.userRepository = userRepository;
+    }
+    async execute(id) {
+        const exists = await this.userRepository.existsById(id);
+        if (!exists)
+            throw new common_1.NotFoundException('User not found.');
+        await this.userRepository.softDelete(id);
+    }
+};
+exports.DeleteUserHandler = DeleteUserHandler;
+exports.DeleteUserHandler = DeleteUserHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_interface_1.IUser])
+], DeleteUserHandler);
+//# sourceMappingURL=delete-user.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/delete-user.handler.js.map b/dist/modules/identity/application/handlers/user/delete-user.handler.js.map
new file mode 100644
index 0000000..572dd11
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/delete-user.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"delete-user.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/user/delete-user.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,gFAAoE;AAG7D,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IACC;IAA7B,YAA6B,cAAqB;QAArB,mBAAc,GAAd,cAAc,CAAO;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QAE5D,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC3C,CAAC;CACF,CAAA;AATY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAEkC,sBAAK;GADvC,iBAAiB,CAS7B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/disable-user.handler.js b/dist/modules/identity/application/handlers/user/disable-user.handler.js
new file mode 100644
index 0000000..193959b
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/disable-user.handler.js
@@ -0,0 +1,32 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DisableUserHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_interface_1 = require("../../../domain/repositories/user.interface");
+let DisableUserHandler = class DisableUserHandler {
+    userRepository;
+    constructor(userRepository) {
+        this.userRepository = userRepository;
+    }
+    async execute(id) {
+        const exists = await this.userRepository.existsById(id);
+        if (!exists)
+            throw new common_1.NotFoundException('User not found.');
+        return this.userRepository.disable(id);
+    }
+};
+exports.DisableUserHandler = DisableUserHandler;
+exports.DisableUserHandler = DisableUserHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_interface_1.IUser])
+], DisableUserHandler);
+//# sourceMappingURL=disable-user.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/disable-user.handler.js.map b/dist/modules/identity/application/handlers/user/disable-user.handler.js.map
new file mode 100644
index 0000000..8aa2cea
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/disable-user.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"disable-user.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/user/disable-user.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,gFAAoE;AAG7D,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IACA;IAA7B,YAA6B,cAAqB;QAArB,mBAAc,GAAd,cAAc,CAAO;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QAE5D,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AATY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAEkC,sBAAK;GADvC,kBAAkB,CAS9B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/enable-user.handler.js b/dist/modules/identity/application/handlers/user/enable-user.handler.js
new file mode 100644
index 0000000..cebcbe8
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/enable-user.handler.js
@@ -0,0 +1,32 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EnableUserHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_interface_1 = require("../../../domain/repositories/user.interface");
+let EnableUserHandler = class EnableUserHandler {
+    userRepository;
+    constructor(userRepository) {
+        this.userRepository = userRepository;
+    }
+    async execute(id) {
+        const exists = await this.userRepository.existsById(id);
+        if (!exists)
+            throw new common_1.NotFoundException('User not found.');
+        return this.userRepository.enable(id);
+    }
+};
+exports.EnableUserHandler = EnableUserHandler;
+exports.EnableUserHandler = EnableUserHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_interface_1.IUser])
+], EnableUserHandler);
+//# sourceMappingURL=enable-user.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/enable-user.handler.js.map b/dist/modules/identity/application/handlers/user/enable-user.handler.js.map
new file mode 100644
index 0000000..9b501d8
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/enable-user.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"enable-user.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/user/enable-user.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,gFAAoE;AAG7D,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IACC;IAA7B,YAA6B,cAAqB;QAArB,mBAAc,GAAd,cAAc,CAAO;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QAE5D,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC;CACF,CAAA;AATY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAEkC,sBAAK;GADvC,iBAAiB,CAS7B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/get-current-user.handler.js b/dist/modules/identity/application/handlers/user/get-current-user.handler.js
new file mode 100644
index 0000000..39c215e
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/get-current-user.handler.js
@@ -0,0 +1,21 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetCurrentUserHandler = void 0;
+const common_1 = require("@nestjs/common");
+let GetCurrentUserHandler = class GetCurrentUserHandler {
+    async execute(currentUser) {
+        // currentUser is already domain user attached by CurrentUserGuard
+        return currentUser;
+    }
+};
+exports.GetCurrentUserHandler = GetCurrentUserHandler;
+exports.GetCurrentUserHandler = GetCurrentUserHandler = __decorate([
+    (0, common_1.Injectable)()
+], GetCurrentUserHandler);
+//# sourceMappingURL=get-current-user.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/get-current-user.handler.js.map b/dist/modules/identity/application/handlers/user/get-current-user.handler.js.map
new file mode 100644
index 0000000..e7a5319
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/get-current-user.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"get-current-user.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/user/get-current-user.handler.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4C;AAIrC,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,KAAK,CAAC,OAAO,CAAC,WAAqB;QACjC,kEAAkE;QAClE,OAAO,WAAW,CAAC;IACrB,CAAC;CACF,CAAA;AALY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;GACA,qBAAqB,CAKjC"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/get-user.handler.js b/dist/modules/identity/application/handlers/user/get-user.handler.js
new file mode 100644
index 0000000..29b5ea2
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/get-user.handler.js
@@ -0,0 +1,29 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetUserHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_interface_1 = require("../../../domain/repositories/user.interface");
+let GetUserHandler = class GetUserHandler {
+    userRepository;
+    constructor(userRepository) {
+        this.userRepository = userRepository;
+    }
+    async execute(id) {
+        return this.userRepository.getById(id);
+    }
+};
+exports.GetUserHandler = GetUserHandler;
+exports.GetUserHandler = GetUserHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_interface_1.IUser])
+], GetUserHandler);
+//# sourceMappingURL=get-user.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/get-user.handler.js.map b/dist/modules/identity/application/handlers/user/get-user.handler.js.map
new file mode 100644
index 0000000..3c5bb24
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/get-user.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"get-user.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/user/get-user.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,gFAAoE;AAG7D,IAAM,cAAc,GAApB,MAAM,cAAc;IACI;IAA7B,YAA6B,cAAqB;QAArB,mBAAc,GAAd,cAAc,CAAO;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AANY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;qCAEkC,sBAAK;GADvC,cAAc,CAM1B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/get-users.handler.js b/dist/modules/identity/application/handlers/user/get-users.handler.js
new file mode 100644
index 0000000..1c4587d
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/get-users.handler.js
@@ -0,0 +1,37 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetUsersHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_interface_1 = require("../../../domain/repositories/user.interface");
+let GetUsersHandler = class GetUsersHandler {
+    userRepository;
+    constructor(userRepository) {
+        this.userRepository = userRepository;
+    }
+    async execute(query) {
+        const res = await this.userRepository.find({
+            page: query.page,
+            limit: query.limit,
+            search: query.search || null,
+            isActive: query.isActive !== undefined ? query.isActive : null,
+            deleted: query.deleted !== undefined ? query.deleted : null,
+            roleId: query.roleId || null,
+        });
+        return res;
+    }
+};
+exports.GetUsersHandler = GetUsersHandler;
+exports.GetUsersHandler = GetUsersHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_interface_1.IUser])
+], GetUsersHandler);
+//# sourceMappingURL=get-users.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/get-users.handler.js.map b/dist/modules/identity/application/handlers/user/get-users.handler.js.map
new file mode 100644
index 0000000..3b2604e
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/get-users.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"get-users.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/user/get-users.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,gFAAoE;AAG7D,IAAM,eAAe,GAArB,MAAM,eAAe;IACG;IAA7B,YAA6B,cAAqB;QAArB,mBAAc,GAAd,cAAc,CAAO;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,KAOb;QACC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;YACzC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;YAC9D,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;YAC3D,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;SAC7B,CAAC,CAAC;QAEH,OAAO,GAAG,CAAC;IACb,CAAC;CACF,CAAA;AAtBY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;qCAEkC,sBAAK;GADvC,eAAe,CAsB3B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/remove-permission.handler.js b/dist/modules/identity/application/handlers/user/remove-permission.handler.js
new file mode 100644
index 0000000..936c638
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/remove-permission.handler.js
@@ -0,0 +1,33 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemovePermissionHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_interface_1 = require("../../../domain/repositories/user.interface");
+let RemovePermissionHandler = class RemovePermissionHandler {
+    userRepository;
+    constructor(userRepository) {
+        this.userRepository = userRepository;
+    }
+    async execute(userId, permissionId) {
+        const user = await this.userRepository.getById(userId);
+        if (!user)
+            throw new common_1.NotFoundException('User not found.');
+        user.removePermission(permissionId);
+        return this.userRepository.update(user);
+    }
+};
+exports.RemovePermissionHandler = RemovePermissionHandler;
+exports.RemovePermissionHandler = RemovePermissionHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_interface_1.IUser])
+], RemovePermissionHandler);
+//# sourceMappingURL=remove-permission.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/remove-permission.handler.js.map b/dist/modules/identity/application/handlers/user/remove-permission.handler.js.map
new file mode 100644
index 0000000..5110506
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/remove-permission.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"remove-permission.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/user/remove-permission.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,gFAAoE;AAG7D,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IACL;IAA7B,YAA6B,cAAqB;QAArB,mBAAc,GAAd,cAAc,CAAO;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,YAAoB;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QAE1D,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QAEpC,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AAXY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAEkC,sBAAK;GADvC,uBAAuB,CAWnC"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/remove-role.handler.js b/dist/modules/identity/application/handlers/user/remove-role.handler.js
new file mode 100644
index 0000000..93010d3
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/remove-role.handler.js
@@ -0,0 +1,33 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemoveRoleHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_interface_1 = require("../../../domain/repositories/user.interface");
+let RemoveRoleHandler = class RemoveRoleHandler {
+    userRepository;
+    constructor(userRepository) {
+        this.userRepository = userRepository;
+    }
+    async execute(userId, roleId) {
+        const user = await this.userRepository.getById(userId);
+        if (!user)
+            throw new common_1.NotFoundException('User not found.');
+        user.removeRole(roleId);
+        return this.userRepository.update(user);
+    }
+};
+exports.RemoveRoleHandler = RemoveRoleHandler;
+exports.RemoveRoleHandler = RemoveRoleHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_interface_1.IUser])
+], RemoveRoleHandler);
+//# sourceMappingURL=remove-role.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/remove-role.handler.js.map b/dist/modules/identity/application/handlers/user/remove-role.handler.js.map
new file mode 100644
index 0000000..750bb57
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/remove-role.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"remove-role.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/user/remove-role.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,gFAAoE;AAG7D,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IACC;IAA7B,YAA6B,cAAqB;QAArB,mBAAc,GAAd,cAAc,CAAO;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,MAAc;QAC1C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QAE1D,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAExB,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AAXY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAEkC,sBAAK;GADvC,iBAAiB,CAW7B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/restore-user.handler.js b/dist/modules/identity/application/handlers/user/restore-user.handler.js
new file mode 100644
index 0000000..0b0cd79
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/restore-user.handler.js
@@ -0,0 +1,32 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RestoreUserHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_interface_1 = require("../../../domain/repositories/user.interface");
+let RestoreUserHandler = class RestoreUserHandler {
+    userRepository;
+    constructor(userRepository) {
+        this.userRepository = userRepository;
+    }
+    async execute(id) {
+        const exists = await this.userRepository.existsById(id);
+        if (!exists)
+            throw new common_1.NotFoundException('User not found.');
+        return this.userRepository.restore(id);
+    }
+};
+exports.RestoreUserHandler = RestoreUserHandler;
+exports.RestoreUserHandler = RestoreUserHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_interface_1.IUser])
+], RestoreUserHandler);
+//# sourceMappingURL=restore-user.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/restore-user.handler.js.map b/dist/modules/identity/application/handlers/user/restore-user.handler.js.map
new file mode 100644
index 0000000..9a5b0c1
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/restore-user.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"restore-user.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/user/restore-user.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+D;AAC/D,gFAAoE;AAG7D,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IACA;IAA7B,YAA6B,cAAqB;QAArB,mBAAc,GAAd,cAAc,CAAO;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QAE5D,OAAO,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;CACF,CAAA;AATY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAEkC,sBAAK;GADvC,kBAAkB,CAS9B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/sync-identity.handler.js b/dist/modules/identity/application/handlers/user/sync-identity.handler.js
new file mode 100644
index 0000000..cc1980f
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/sync-identity.handler.js
@@ -0,0 +1,92 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SyncIdentityHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_interface_1 = require("../../../domain/repositories/user.interface");
+const role_interface_1 = require("../../../domain/repositories/role.interface");
+const i_auth_config_1 = require("../../config/i-auth-config");
+const user_entity_1 = require("../../../domain/entities/user.entity");
+let SyncIdentityHandler = class SyncIdentityHandler {
+    userRepository;
+    roleRepository;
+    authConfig;
+    constructor(userRepository, roleRepository, authConfig) {
+        this.userRepository = userRepository;
+        this.roleRepository = roleRepository;
+        this.authConfig = authConfig;
+    }
+    async execute(identity) {
+        const { sub, preferred_username, email } = identity;
+        if (!sub)
+            throw new common_1.UnauthorizedException('Invalid identity payload.');
+        // Try find by authentikId
+        let user = await this.userRepository.findByAuthentikId(sub);
+        const syncEmail = this.authConfig.syncEmail();
+        const syncUsername = this.authConfig.syncUsername();
+        if (!user) {
+            // User does not exist locally: create minimal local record per new architecture
+            const username = preferred_username || email || sub;
+            const userEntity = user_entity_1.UserData.create({ username, email: email || '', authentikId: sub });
+            // assign default role if available
+            try {
+                const defaultRole = await this.roleRepository.getDefaultRole();
+                if (defaultRole) {
+                    userEntity.assignRole(defaultRole);
+                }
+            }
+            catch (e) {
+                // ignore if role repo not available or no default role
+            }
+            // persist local user
+            user = await this.userRepository.create(userEntity);
+            // return freshly created user
+            return user;
+        }
+        else {
+            let changed = false;
+            if (syncEmail && email && user.email !== email) {
+                user.changeEmail(email);
+                changed = true;
+                // prepare event class instance if needed (no dispatch)
+            }
+            if (syncUsername && preferred_username && user.username !== preferred_username) {
+                user.changeUsername(preferred_username);
+                changed = true;
+                // prepare event class instance if needed (no dispatch)
+            }
+            // update last seen
+            user.touchLastSeen();
+            changed = true;
+            if (changed) {
+                user = await this.userRepository.update(user);
+            }
+        }
+        // Validations
+        if (!user.isActive) {
+            // Authentication succeeded but user is disabled
+            throw new common_1.ForbiddenException('User is not active.');
+        }
+        if (user.deletedAt) {
+            throw new common_1.ForbiddenException('User is deleted.');
+        }
+        // Ensure roles/permissions loaded (repo should return includes)
+        return user;
+    }
+};
+exports.SyncIdentityHandler = SyncIdentityHandler;
+exports.SyncIdentityHandler = SyncIdentityHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_interface_1.IUser,
+        role_interface_1.IRole,
+        i_auth_config_1.IAuthConfig])
+], SyncIdentityHandler);
+//# sourceMappingURL=sync-identity.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/sync-identity.handler.js.map b/dist/modules/identity/application/handlers/user/sync-identity.handler.js.map
new file mode 100644
index 0000000..3431800
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/sync-identity.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"sync-identity.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/user/sync-identity.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA+F;AAC/F,gFAAoE;AACpE,gFAAoE;AACpE,8DAAyD;AACzD,sEAAgE;AAIzD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAEX;IACA;IACA;IAHnB,YACmB,cAAqB,EACrB,cAAqB,EACrB,UAAuB;QAFvB,mBAAc,GAAd,cAAc,CAAO;QACrB,mBAAc,GAAd,cAAc,CAAO;QACrB,eAAU,GAAV,UAAU,CAAa;IACvC,CAAC;IAEJ,KAAK,CAAC,OAAO,CAAC,QAAsB;QAClC,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,QAAe,CAAC;QAE3D,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;QAEvE,0BAA0B;QAC1B,IAAI,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAE5D,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,CAAC;QAEpD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,gFAAgF;YAChF,MAAM,QAAQ,GAAG,kBAAkB,IAAI,KAAK,IAAI,GAAG,CAAC;YACpD,MAAM,UAAU,GAAG,sBAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC;YAEvF,mCAAmC;YACnC,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,CAAC;gBAC/D,IAAI,WAAW,EAAE,CAAC;oBAChB,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,uDAAuD;YACzD,CAAC;YAED,qBAAqB;YACrB,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAEpD,8BAA8B;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;aAAM,CAAC;YACN,IAAI,OAAO,GAAG,KAAK,CAAC;YAEpB,IAAI,SAAS,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC/C,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBACxB,OAAO,GAAG,IAAI,CAAC;gBAEf,uDAAuD;YACzD,CAAC;YAED,IAAI,YAAY,IAAI,kBAAkB,IAAI,IAAI,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;gBAC/E,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAC;gBACxC,OAAO,GAAG,IAAI,CAAC;gBAEf,uDAAuD;YACzD,CAAC;YAED,mBAAmB;YACnB,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC;YAEf,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;QAED,cAAc;QACd,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,gDAAgD;YAChD,MAAM,IAAI,2BAAkB,CAAC,qBAAqB,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,2BAAkB,CAAC,kBAAkB,CAAC,CAAC;QACnD,CAAC;QAED,gEAAgE;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA7EY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;qCAGwB,sBAAK;QACL,sBAAK;QACT,2BAAW;GAJ/B,mBAAmB,CA6E/B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/update-user.handler.js b/dist/modules/identity/application/handlers/user/update-user.handler.js
new file mode 100644
index 0000000..e80e2da
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/update-user.handler.js
@@ -0,0 +1,45 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateUserHandler = void 0;
+const common_1 = require("@nestjs/common");
+const user_interface_1 = require("../../../domain/repositories/user.interface");
+let UpdateUserHandler = class UpdateUserHandler {
+    userRepository;
+    constructor(userRepository) {
+        this.userRepository = userRepository;
+    }
+    async execute(id, dto) {
+        // Password management is not allowed in RayLab Core
+        if (dto.password)
+            throw new common_1.BadRequestException('Password management is not allowed.');
+        const user = await this.userRepository.getById(id);
+        if (!user)
+            throw new common_1.NotFoundException('User not found.');
+        // Only allow updating profile fields: name, email, metadata, storage settings
+        if (dto.name !== undefined)
+            user.changeUsername(dto.name);
+        if (dto.email !== undefined)
+            user.changeEmail(dto.email);
+        // metadata field not handled at domain level yet
+        if (dto.storageQuota !== undefined)
+            user.setStorageQuota(dto.storageQuota);
+        if (dto.storageUsed !== undefined)
+            user.setStorageUsed(dto.storageUsed);
+        return this.userRepository.update(user);
+    }
+};
+exports.UpdateUserHandler = UpdateUserHandler;
+exports.UpdateUserHandler = UpdateUserHandler = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [user_interface_1.IUser])
+], UpdateUserHandler);
+//# sourceMappingURL=update-user.handler.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/handlers/user/update-user.handler.js.map b/dist/modules/identity/application/handlers/user/update-user.handler.js.map
new file mode 100644
index 0000000..4687313
--- /dev/null
+++ b/dist/modules/identity/application/handlers/user/update-user.handler.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"update-user.handler.js","sourceRoot":"","sources":["../../../../../../src/modules/identity/application/handlers/user/update-user.handler.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAoF;AACpF,gFAAoE;AAI7D,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IACC;IAA7B,YAA6B,cAAqB;QAArB,mBAAc,GAAd,cAAc,CAAO;IAAG,CAAC;IAEtD,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,GAAkB;QAC1C,oDAAoD;QACpD,IAAK,GAAW,CAAC,QAAQ;YAAE,MAAM,IAAI,4BAAmB,CAAC,qCAAqC,CAAC,CAAC;QAEhG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,iBAAiB,CAAC,CAAC;QAE1D,8EAA8E;QAC9E,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzD,iDAAiD;QACjD,IAAK,GAAW,CAAC,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,eAAe,CAAE,GAAW,CAAC,YAAY,CAAC,CAAC;QAC7F,IAAK,GAAW,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,cAAc,CAAE,GAAW,CAAC,WAAW,CAAC,CAAC;QAE1F,OAAO,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AAnBY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAEkC,sBAAK;GADvC,iBAAiB,CAmB7B"}
\ No newline at end of file
diff --git a/dist/modules/identity/application/services/user.service.js b/dist/modules/identity/application/services/user.service.js
new file mode 100644
index 0000000..74f5ebf
--- /dev/null
+++ b/dist/modules/identity/application/services/user.service.js
@@ -0,0 +1,37 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var UserService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserService = void 0;
+const common_1 = require("@nestjs/common");
+const prisma_service_1 = require("../../../../shared/prisma.service");
+const user_interface_1 = require("../../domain/repositories/user.interface");
+let UserService = UserService_1 = class UserService {
+    prisma;
+    userRepository;
+    logger = new common_1.Logger(UserService_1.name);
+    constructor(prisma, userRepository) {
+        this.prisma = prisma;
+        this.userRepository = userRepository;
+    }
+    async createUser(input) {
+        // Provisioning to external Identity Provider (Authentik) has been disabled.
+        // All users must be created in Authentik first. RayLab will create local record on first successful login.
+        throw new common_1.BadRequestException('Provisioning disabled: create users in Authentik and login to sync to RayLab');
+    }
+};
+exports.UserService = UserService;
+exports.UserService = UserService = UserService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [prisma_service_1.PrismaService,
+        user_interface_1.IUser])
+], UserService);
+//# sourceMappingURL=user.service.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/application/services/user.service.js.map b/dist/modules/identity/application/services/user.service.js.map
new file mode 100644
index 0000000..b3e3655
--- /dev/null
+++ b/dist/modules/identity/application/services/user.service.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"user.service.js","sourceRoot":"","sources":["../../../../../src/modules/identity/application/services/user.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAyE;AACzE,sEAAkE;AAClE,6EAAiE;AAI1D,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAIH;IACA;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAEvD,YACmB,MAAqB,EACrB,cAAqB;QADrB,WAAM,GAAN,MAAM,CAAe;QACrB,mBAAc,GAAd,cAAc,CAAO;IACrC,CAAC;IAEJ,KAAK,CAAC,UAAU,CAAC,KAAgF;QAC/F,4EAA4E;QAC5E,2GAA2G;QAC3G,MAAM,IAAI,4BAAmB,CAAC,8EAA8E,CAAC,CAAC;IAChH,CAAC;CACF,CAAA;AAbY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;qCAKgB,8BAAa;QACL,sBAAK;GAL7B,WAAW,CAavB"}
\ No newline at end of file
diff --git a/dist/modules/identity/domain/entities/permission.entity.js b/dist/modules/identity/domain/entities/permission.entity.js
new file mode 100644
index 0000000..f1238a0
--- /dev/null
+++ b/dist/modules/identity/domain/entities/permission.entity.js
@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionData = void 0;
+class PermissionData {
+    id;
+    code;
+    name;
+    description;
+    createdAt;
+    updatedAt;
+    constructor(id, code, name, description, createdAt, updatedAt) {
+        this.id = id;
+        this.code = code;
+        this.name = name;
+        this.description = description;
+        this.createdAt = createdAt;
+        this.updatedAt = updatedAt;
+    }
+    changeName(name) {
+        this.name = name;
+    }
+    changeDescription(description) {
+        this.description = description;
+    }
+    changeCode(code) {
+        this.code = code;
+    }
+    static restore(props) {
+        return new PermissionData(props.id, props.code || props.name, props.name, props.description, props.createdAt, props.updatedAt);
+    }
+}
+exports.PermissionData = PermissionData;
+//# sourceMappingURL=permission.entity.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/domain/entities/permission.entity.js.map b/dist/modules/identity/domain/entities/permission.entity.js.map
new file mode 100644
index 0000000..cb03fd7
--- /dev/null
+++ b/dist/modules/identity/domain/entities/permission.entity.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"permission.entity.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/entities/permission.entity.ts"],"names":[],"mappings":";;;AAAA,MAAa,cAAc;IAEP;IACT;IACA;IACA;IACA;IACA;IANT,YACkB,EAAU,EACnB,IAAY,EACZ,IAAY,EACZ,WAAmB,EACnB,SAAe,EACf,SAAe;QALN,OAAE,GAAF,EAAE,CAAQ;QACnB,SAAI,GAAJ,IAAI,CAAQ;QACZ,SAAI,GAAJ,IAAI,CAAQ;QACZ,gBAAW,GAAX,WAAW,CAAQ;QACnB,cAAS,GAAT,SAAS,CAAM;QACf,cAAS,GAAT,SAAS,CAAM;IACrB,CAAC;IAEJ,UAAU,CAAC,IAAY;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,iBAAiB,CAAC,WAAmB;QACnC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,KAOd;QACC,OAAO,IAAI,cAAc,CACvB,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EACxB,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,SAAS,CAChB,CAAC;IACJ,CAAC;CACF;AAvCD,wCAuCC"}
\ No newline at end of file
diff --git a/dist/modules/identity/domain/entities/role.entity.js b/dist/modules/identity/domain/entities/role.entity.js
new file mode 100644
index 0000000..5234e7d
--- /dev/null
+++ b/dist/modules/identity/domain/entities/role.entity.js
@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleData = void 0;
+class RoleData {
+    id;
+    code;
+    name;
+    description;
+    permissions;
+    isDefault;
+    createdAt;
+    updatedAt;
+    constructor(id, code, name, description, permissions, isDefault, createdAt, updatedAt) {
+        this.id = id;
+        this.code = code;
+        this.name = name;
+        this.description = description;
+        this.permissions = permissions;
+        this.isDefault = isDefault;
+        this.createdAt = createdAt;
+        this.updatedAt = updatedAt;
+    }
+    hasPermissions(permissionId) {
+        return this.permissions.some(x => x.id.toLowerCase() === permissionId.toLowerCase());
+    }
+    assignPermission(permissionData) {
+        if (this.hasPermissions(permissionData.id))
+            throw new Error("Permission sudah dimiliki.");
+        this.permissions.push(permissionData);
+    }
+    removePermission(permissionId) {
+        const idx = this.permissions.findIndex(p => p.id.toLowerCase() === permissionId.toLowerCase());
+        if (idx === -1)
+            throw new Error('Permission tidak ditemukan pada role.');
+        this.permissions.splice(idx, 1);
+    }
+    changeName(name) {
+        this.name = name;
+    }
+    changeDescription(description) {
+        this.description = description;
+    }
+    setDefault(isDefault) {
+        this.isDefault = isDefault;
+    }
+    static restore(props) {
+        return new RoleData(props.id, props.code, props.name, props.description, props.permissions || [], props.isDefault ?? false, props.createdAt, props.updatedAt);
+    }
+}
+exports.RoleData = RoleData;
+//# sourceMappingURL=role.entity.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/domain/entities/role.entity.js.map b/dist/modules/identity/domain/entities/role.entity.js.map
new file mode 100644
index 0000000..22436e0
--- /dev/null
+++ b/dist/modules/identity/domain/entities/role.entity.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"role.entity.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/entities/role.entity.ts"],"names":[],"mappings":";;;AAEA,MAAa,QAAQ;IAED;IACT;IACA;IACA;IACA;IACA;IACA;IACA;IART,YACkB,EAAU,EACnB,IAAY,EACZ,IAAY,EACZ,WAAmB,EACnB,WAA6B,EAC7B,SAAkB,EAClB,SAAe,EACf,SAAe;QAPN,OAAE,GAAF,EAAE,CAAQ;QACnB,SAAI,GAAJ,IAAI,CAAQ;QACZ,SAAI,GAAJ,IAAI,CAAQ;QACZ,gBAAW,GAAX,WAAW,CAAQ;QACnB,gBAAW,GAAX,WAAW,CAAkB;QAC7B,cAAS,GAAT,SAAS,CAAS;QAClB,cAAS,GAAT,SAAS,CAAM;QACf,cAAS,GAAT,SAAS,CAAM;IACrB,CAAC;IAEJ,cAAc,CAAC,YAAoB;QACjC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,gBAAgB,CAAC,cAA8B;QAC7C,IAAI,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAE1F,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAED,gBAAgB,CAAC,YAAoB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/F,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,iBAAiB,CAAC,WAAmB;QACnC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,UAAU,CAAC,SAAkB;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,KASd;QACC,OAAO,IAAI,QAAQ,CACjB,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,WAAW,IAAI,EAAE,EACvB,KAAK,CAAC,SAAS,IAAI,KAAK,EACxB,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,SAAS,CAChB,CAAC;IACJ,CAAC;CACF;AA7DD,4BA6DC"}
\ No newline at end of file
diff --git a/dist/modules/identity/domain/entities/user.entity.js b/dist/modules/identity/domain/entities/user.entity.js
new file mode 100644
index 0000000..9b244a8
--- /dev/null
+++ b/dist/modules/identity/domain/entities/user.entity.js
@@ -0,0 +1,143 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserData = void 0;
+class UserData {
+    id;
+    authentikId;
+    username;
+    email;
+    password;
+    roles;
+    permissions;
+    isActive;
+    deletedAt;
+    lastSeenAt;
+    storageQuota;
+    storageUsed;
+    constructor(id, authentikId, username, email, password, roles, permissions, isActive, deletedAt, lastSeenAt, storageQuota, storageUsed) {
+        this.id = id;
+        this.authentikId = authentikId;
+        this.username = username;
+        this.email = email;
+        this.password = password;
+        this.roles = roles;
+        this.permissions = permissions;
+        this.isActive = isActive;
+        this.deletedAt = deletedAt;
+        this.lastSeenAt = lastSeenAt;
+        this.storageQuota = storageQuota;
+        this.storageUsed = storageUsed;
+    }
+    //#region Create
+    static create(data) {
+        const quota = data.storageQuota !== undefined ? data.storageQuota : 10737418240; // 10 GB
+        const used = data.storageUsed !== undefined ? data.storageUsed : 0;
+        return new UserData(crypto.randomUUID(), data.authentikId || null, data.username, data.email, data.password ?? null, [], [], true, null, null, quota, used);
+    }
+    //#endregion
+    //#region Read
+    hasRole(roleId) {
+        return this.roles.some(x => x.id.toLowerCase() === roleId.toLowerCase());
+    }
+    assignRole(roleData) {
+        if (this.hasRole(roleData.id))
+            throw new Error("Role Sudah dimiliki.");
+        this.roles.push(roleData);
+    }
+    hasPermissions(permissionId) {
+        return this.permissions.some(x => x.id.toLowerCase() === permissionId.toLowerCase());
+    }
+    hasPermission(permission) {
+        const byPerm = this.permissions.some(x => x.id.toLowerCase() === permission.toLowerCase() || x.name.toLowerCase() === permission.toLowerCase());
+        if (byPerm)
+            return true;
+        // check roles
+        return this.roles.some(r => r.permissions.some(p => p.id.toLowerCase() === permission.toLowerCase() || p.name.toLowerCase() === permission.toLowerCase()));
+    }
+    assignPermission(permissionData) {
+        if (this.hasPermissions(permissionData.id))
+            throw new Error("Permission sudah dimiliki.");
+        this.permissions.push(permissionData);
+    }
+    //#endregion
+    //#region Update
+    changeEmail(email) {
+        this.email = email;
+    }
+    changeUsername(username) {
+        this.username = username;
+    }
+    touchLastSeen() {
+        this.lastSeenAt = new Date();
+    }
+    enable() {
+        this.isActive = true;
+    }
+    disable() {
+        this.isActive = false;
+    }
+    //#endregion
+    //#region Delete
+    softDelete() {
+        this.deletedAt = new Date();
+        this.isActive = false;
+    }
+    restoreInstance() {
+        this.deletedAt = null;
+    }
+    //#endregion
+    static restore(props) {
+        return new UserData(props.id, props.authentikId || null, props.username, props.email, props.password, props.roles || [], props.permissions || [], props.isActive !== undefined ? props.isActive : true, props.deletedAt || null, props.lastSeenAt || null, props.storageQuota !== undefined && props.storageQuota !== null ? props.storageQuota : 10737418240, props.storageUsed !== undefined && props.storageUsed !== null ? props.storageUsed : 0);
+    }
+    removeRole(roleId) {
+        const idx = this.roles.findIndex(r => r.id.toLowerCase() === roleId.toLowerCase());
+        if (idx === -1)
+            throw new Error('Role tidak ditemukan pada user.');
+        this.roles.splice(idx, 1);
+    }
+    removePermission(permissionId) {
+        const idx = this.permissions.findIndex(p => p.id.toLowerCase() === permissionId.toLowerCase());
+        if (idx === -1)
+            throw new Error('Permission tidak ditemukan pada user.');
+        this.permissions.splice(idx, 1);
+    }
+    // Storage helpers
+    setStorageQuota(bytes) {
+        if (bytes < 0)
+            throw new Error('storageQuota must be >= 0');
+        if (this.storageUsed > bytes)
+            throw new Error('storageQuota cannot be less than storageUsed');
+        this.storageQuota = bytes;
+    }
+    setStorageUsed(bytes) {
+        if (bytes < 0)
+            throw new Error('storageUsed must be >= 0');
+        if (bytes > this.storageQuota)
+            throw new Error('storageUsed cannot exceed storageQuota');
+        this.storageUsed = bytes;
+    }
+    // Response helper for API
+    toResponse() {
+        const remaining = this.storageQuota - this.storageUsed;
+        const usagePercentage = this.storageQuota > 0 ? Math.round((this.storageUsed / this.storageQuota) * 100) : 0;
+        return {
+            id: this.id,
+            authentikId: this.authentikId,
+            username: this.username,
+            email: this.email,
+            roles: this.roles,
+            permissions: this.permissions,
+            isActive: this.isActive,
+            deletedAt: this.deletedAt,
+            lastSeenAt: this.lastSeenAt,
+            storage: {
+                quota: this.storageQuota,
+                used: this.storageUsed,
+                remaining,
+                usagePercentage,
+            },
+        };
+    }
+}
+exports.UserData = UserData;
+//# sourceMappingURL=user.entity.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/domain/entities/user.entity.js.map b/dist/modules/identity/domain/entities/user.entity.js.map
new file mode 100644
index 0000000..876a488
--- /dev/null
+++ b/dist/modules/identity/domain/entities/user.entity.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"user.entity.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/entities/user.entity.ts"],"names":[],"mappings":";;;AAGA,MAAa,QAAQ;IAED;IACT;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IAZP,YACgB,EAAU,EACnB,WAA0B,EAC1B,QAAgB,EAChB,KAAa,EACb,QAAuB,EACvB,KAAiB,EACjB,WAA6B,EAC7B,QAAiB,EACjB,SAAsB,EACtB,UAAuB,EACvB,YAAoB,EACpB,WAAmB;QAXV,OAAE,GAAF,EAAE,CAAQ;QACnB,gBAAW,GAAX,WAAW,CAAe;QAC1B,aAAQ,GAAR,QAAQ,CAAQ;QAChB,UAAK,GAAL,KAAK,CAAQ;QACb,aAAQ,GAAR,QAAQ,CAAe;QACvB,UAAK,GAAL,KAAK,CAAY;QACjB,gBAAW,GAAX,WAAW,CAAkB;QAC7B,aAAQ,GAAR,QAAQ,CAAS;QACjB,cAAS,GAAT,SAAS,CAAa;QACtB,eAAU,GAAV,UAAU,CAAa;QACvB,iBAAY,GAAZ,YAAY,CAAQ;QACpB,gBAAW,GAAX,WAAW,CAAQ;IACzB,CAAC;IAEF,gBAAgB;IAEhB,MAAM,CAAC,MAAM,CAAC,IAOf;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,QAAQ;QACzF,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,OAAO,IAAI,QAAQ,CACjB,MAAM,CAAC,UAAU,EAAE,EACnB,IAAI,CAAC,WAAW,IAAI,IAAI,EACxB,IAAI,CAAC,QAAQ,EACb,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,QAAQ,IAAI,IAAI,EACrB,EAAE,EACF,EAAE,EACF,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,KAAK,EACL,IAAI,CACL,CAAC;IACJ,CAAC;IAED,YAAY;IAEZ,cAAc;IAEd,OAAO,CAAC,MAAc;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,UAAU,CAAC,QAAmB;QAC5B,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAE1C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAEC,cAAc,CAAC,YAAqB;QACpC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,WAAW,EAAE,CAAC,CAAA;IACtF,CAAC;IAED,aAAa,CAAC,UAAkB;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;QAChJ,IAAI,MAAM;YAAE,OAAO,IAAI,CAAC;QAExB,cAAc;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC7J,CAAC;IAED,gBAAgB,CAAC,cAA+B;QAC9C,IAAI,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QAE/C,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IAED,YAAY;IAEZ,gBAAgB;IACd,WAAW,CAAC,KAAa;QACzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,cAAc,CAAC,QAAgB;QAC7B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,aAAa;QACX,IAAI,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC;IAC/B,CAAC;IAEC,MAAM;QACN,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,OAAO;QACL,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,YAAY;IAEZ,gBAAgB;IAChB,UAAU;QACR,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;IACxB,CAAC;IAED,eAAe;QACb,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,YAAY;IAEH,MAAM,CAAC,OAAO,CAAC,KAavB;QAEG,OAAO,IAAI,QAAQ,CACf,KAAK,CAAC,EAAE,EACR,KAAK,CAAC,WAAW,IAAI,IAAI,EACzB,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,KAAK,IAAI,EAAE,EACjB,KAAK,CAAC,WAAW,IAAI,EAAE,EACvB,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EACpD,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,KAAK,CAAC,UAAU,IAAI,IAAI,EACxB,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,EAClG,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CACxF,CAAC;IACN,CAAC;IAED,UAAU,CAAC,MAAc;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACnE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC5B,CAAC;IAEC,gBAAgB,CAAC,YAAoB;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/F,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAClC,CAAC;IAED,kBAAkB;IAClB,eAAe,CAAC,KAAa;QAC3B,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,WAAW,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9F,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;IAC5B,CAAC;IAED,cAAc,CAAC,KAAa;QAC1B,IAAI,KAAK,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC3D,IAAI,KAAK,GAAG,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACzF,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;IAC3B,CAAC;IAED,0BAA0B;IAC1B,UAAU;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;QACvD,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7G,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE;gBACP,KAAK,EAAE,IAAI,CAAC,YAAY;gBACxB,IAAI,EAAE,IAAI,CAAC,WAAW;gBACtB,SAAS;gBACT,eAAe;aAChB;SACF,CAAC;IACJ,CAAC;CACF;AAhMD,4BAgMC"}
\ No newline at end of file
diff --git a/dist/modules/identity/domain/events/user-created.event.js b/dist/modules/identity/domain/events/user-created.event.js
new file mode 100644
index 0000000..f9edf2c
--- /dev/null
+++ b/dist/modules/identity/domain/events/user-created.event.js
@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserCreatedEvent = void 0;
+class UserCreatedEvent {
+    payload;
+    name = 'UserCreated';
+    occurredAt = new Date();
+    constructor(payload) {
+        this.payload = payload;
+    }
+}
+exports.UserCreatedEvent = UserCreatedEvent;
+//# sourceMappingURL=user-created.event.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/domain/events/user-created.event.js.map b/dist/modules/identity/domain/events/user-created.event.js.map
new file mode 100644
index 0000000..32401a7
--- /dev/null
+++ b/dist/modules/identity/domain/events/user-created.event.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"user-created.event.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/events/user-created.event.ts"],"names":[],"mappings":";;;AAEA,MAAa,gBAAgB;IAGC;IAFnB,IAAI,GAAG,aAAa,CAAC;IACrB,UAAU,GAAS,IAAI,IAAI,EAAE,CAAC;IACvC,YAA4B,OAAiF;QAAjF,YAAO,GAAP,OAAO,CAA0E;IAAG,CAAC;CAClH;AAJD,4CAIC"}
\ No newline at end of file
diff --git a/dist/modules/identity/domain/events/user-disabled.event.js b/dist/modules/identity/domain/events/user-disabled.event.js
new file mode 100644
index 0000000..8d3546b
--- /dev/null
+++ b/dist/modules/identity/domain/events/user-disabled.event.js
@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserDisabledEvent = void 0;
+class UserDisabledEvent {
+    payload;
+    name = 'UserDisabled';
+    occurredAt = new Date();
+    constructor(payload) {
+        this.payload = payload;
+    }
+}
+exports.UserDisabledEvent = UserDisabledEvent;
+//# sourceMappingURL=user-disabled.event.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/domain/events/user-disabled.event.js.map b/dist/modules/identity/domain/events/user-disabled.event.js.map
new file mode 100644
index 0000000..dec6363
--- /dev/null
+++ b/dist/modules/identity/domain/events/user-disabled.event.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"user-disabled.event.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/events/user-disabled.event.ts"],"names":[],"mappings":";;;AAEA,MAAa,iBAAiB;IAGA;IAFnB,IAAI,GAAG,cAAc,CAAC;IACtB,UAAU,GAAS,IAAI,IAAI,EAAE,CAAC;IACvC,YAA4B,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;CAC5D;AAJD,8CAIC"}
\ No newline at end of file
diff --git a/dist/modules/identity/domain/events/user-email-changed.event.js b/dist/modules/identity/domain/events/user-email-changed.event.js
new file mode 100644
index 0000000..c5d1ddb
--- /dev/null
+++ b/dist/modules/identity/domain/events/user-email-changed.event.js
@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserEmailChangedEvent = void 0;
+class UserEmailChangedEvent {
+    payload;
+    name = 'UserEmailChanged';
+    occurredAt = new Date();
+    constructor(payload) {
+        this.payload = payload;
+    }
+}
+exports.UserEmailChangedEvent = UserEmailChangedEvent;
+//# sourceMappingURL=user-email-changed.event.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/domain/events/user-email-changed.event.js.map b/dist/modules/identity/domain/events/user-email-changed.event.js.map
new file mode 100644
index 0000000..a57fb24
--- /dev/null
+++ b/dist/modules/identity/domain/events/user-email-changed.event.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"user-email-changed.event.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/events/user-email-changed.event.ts"],"names":[],"mappings":";;;AAEA,MAAa,qBAAqB;IAGJ;IAFnB,IAAI,GAAG,kBAAkB,CAAC;IAC1B,UAAU,GAAS,IAAI,IAAI,EAAE,CAAC;IACvC,YAA4B,OAA+D;QAA/D,YAAO,GAAP,OAAO,CAAwD;IAAG,CAAC;CAChG;AAJD,sDAIC"}
\ No newline at end of file
diff --git a/dist/modules/identity/domain/events/user-enabled.event.js b/dist/modules/identity/domain/events/user-enabled.event.js
new file mode 100644
index 0000000..81a05d9
--- /dev/null
+++ b/dist/modules/identity/domain/events/user-enabled.event.js
@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserEnabledEvent = void 0;
+class UserEnabledEvent {
+    payload;
+    name = 'UserEnabled';
+    occurredAt = new Date();
+    constructor(payload) {
+        this.payload = payload;
+    }
+}
+exports.UserEnabledEvent = UserEnabledEvent;
+//# sourceMappingURL=user-enabled.event.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/domain/events/user-enabled.event.js.map b/dist/modules/identity/domain/events/user-enabled.event.js.map
new file mode 100644
index 0000000..dec602b
--- /dev/null
+++ b/dist/modules/identity/domain/events/user-enabled.event.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"user-enabled.event.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/events/user-enabled.event.ts"],"names":[],"mappings":";;;AAEA,MAAa,gBAAgB;IAGC;IAFnB,IAAI,GAAG,aAAa,CAAC;IACrB,UAAU,GAAS,IAAI,IAAI,EAAE,CAAC;IACvC,YAA4B,OAA2B;QAA3B,YAAO,GAAP,OAAO,CAAoB;IAAG,CAAC;CAC5D;AAJD,4CAIC"}
\ No newline at end of file
diff --git a/dist/modules/identity/domain/events/user-username-changed.event.js b/dist/modules/identity/domain/events/user-username-changed.event.js
new file mode 100644
index 0000000..dd9949a
--- /dev/null
+++ b/dist/modules/identity/domain/events/user-username-changed.event.js
@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserUsernameChangedEvent = void 0;
+class UserUsernameChangedEvent {
+    payload;
+    name = 'UserUsernameChanged';
+    occurredAt = new Date();
+    constructor(payload) {
+        this.payload = payload;
+    }
+}
+exports.UserUsernameChangedEvent = UserUsernameChangedEvent;
+//# sourceMappingURL=user-username-changed.event.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/domain/events/user-username-changed.event.js.map b/dist/modules/identity/domain/events/user-username-changed.event.js.map
new file mode 100644
index 0000000..fc35c36
--- /dev/null
+++ b/dist/modules/identity/domain/events/user-username-changed.event.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"user-username-changed.event.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/events/user-username-changed.event.ts"],"names":[],"mappings":";;;AAEA,MAAa,wBAAwB;IAGP;IAFnB,IAAI,GAAG,qBAAqB,CAAC;IAC7B,UAAU,GAAS,IAAI,IAAI,EAAE,CAAC;IACvC,YAA4B,OAAqE;QAArE,YAAO,GAAP,OAAO,CAA8D;IAAG,CAAC;CACtG;AAJD,4DAIC"}
\ No newline at end of file
diff --git a/dist/modules/identity/domain/repositories/permission.interface.js b/dist/modules/identity/domain/repositories/permission.interface.js
new file mode 100644
index 0000000..11c253e
--- /dev/null
+++ b/dist/modules/identity/domain/repositories/permission.interface.js
@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IPermission = void 0;
+class IPermission {
+}
+exports.IPermission = IPermission;
+//# sourceMappingURL=permission.interface.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/domain/repositories/permission.interface.js.map b/dist/modules/identity/domain/repositories/permission.interface.js.map
new file mode 100644
index 0000000..534e501
--- /dev/null
+++ b/dist/modules/identity/domain/repositories/permission.interface.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"permission.interface.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/repositories/permission.interface.ts"],"names":[],"mappings":";;;AAEA,MAAsB,WAAW;CAShC;AATD,kCASC"}
\ No newline at end of file
diff --git a/dist/modules/identity/domain/repositories/role.interface.js b/dist/modules/identity/domain/repositories/role.interface.js
new file mode 100644
index 0000000..9119f3b
--- /dev/null
+++ b/dist/modules/identity/domain/repositories/role.interface.js
@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IRole = void 0;
+class IRole {
+}
+exports.IRole = IRole;
+//# sourceMappingURL=role.interface.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/domain/repositories/role.interface.js.map b/dist/modules/identity/domain/repositories/role.interface.js.map
new file mode 100644
index 0000000..27bc8fe
--- /dev/null
+++ b/dist/modules/identity/domain/repositories/role.interface.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"role.interface.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/repositories/role.interface.ts"],"names":[],"mappings":";;;AAEA,MAAsB,KAAK;CAY1B;AAZD,sBAYC"}
\ No newline at end of file
diff --git a/dist/modules/identity/domain/repositories/user.interface.js b/dist/modules/identity/domain/repositories/user.interface.js
new file mode 100644
index 0000000..3315c95
--- /dev/null
+++ b/dist/modules/identity/domain/repositories/user.interface.js
@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IUser = void 0;
+class IUser {
+}
+exports.IUser = IUser;
+//# sourceMappingURL=user.interface.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/domain/repositories/user.interface.js.map b/dist/modules/identity/domain/repositories/user.interface.js.map
new file mode 100644
index 0000000..e657448
--- /dev/null
+++ b/dist/modules/identity/domain/repositories/user.interface.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"user.interface.js","sourceRoot":"","sources":["../../../../../src/modules/identity/domain/repositories/user.interface.ts"],"names":[],"mappings":";;;AAEA,MAAsB,KAAK;CA0B1B;AA1BD,sBA0BC"}
\ No newline at end of file
diff --git a/dist/modules/identity/identity.module.js b/dist/modules/identity/identity.module.js
new file mode 100644
index 0000000..8899f4e
--- /dev/null
+++ b/dist/modules/identity/identity.module.js
@@ -0,0 +1,113 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityModule = void 0;
+const common_1 = require("@nestjs/common");
+const users_controller_1 = require("./presentation/controllers/users.controller");
+const roles_controller_1 = require("./presentation/controllers/roles.controller");
+const permissions_controller_1 = require("./presentation/controllers/permissions.controller");
+const prisma_service_1 = require("../../shared/prisma.service");
+const user_service_1 = require("./application/services/user.service");
+const prisma_user_repository_1 = require("./infrastructure/repositories/prisma-user.repository");
+const user_interface_1 = require("./domain/repositories/user.interface");
+const jwt_auth_guard_1 = require("../../core/auth/guards/jwt-auth.guard");
+const permission_guard_1 = require("../authorization/presentation/guards/permission.guard");
+const core_1 = require("@nestjs/core");
+const sync_identity_handler_1 = require("./application/handlers/user/sync-identity.handler");
+const current_user_guard_1 = require("./presentation/guards/current-user.guard");
+const prisma_role_repository_1 = require("./infrastructure/repositories/prisma-role.repository");
+const prisma_permission_repository_1 = require("./infrastructure/repositories/prisma-permission.repository");
+const role_interface_1 = require("./domain/repositories/role.interface");
+const permission_interface_1 = require("./domain/repositories/permission.interface");
+const i_auth_config_1 = require("./application/config/i-auth-config");
+const env_auth_config_1 = require("./application/config/env-auth-config");
+const auth_module_1 = require("../auth/auth.module");
+const authorization_module_1 = require("../authorization/authorization.module");
+const get_users_handler_1 = require("./application/handlers/user/get-users.handler");
+const get_user_handler_1 = require("./application/handlers/user/get-user.handler");
+const get_current_user_handler_1 = require("./application/handlers/user/get-current-user.handler");
+const enable_user_handler_1 = require("./application/handlers/user/enable-user.handler");
+const disable_user_handler_1 = require("./application/handlers/user/disable-user.handler");
+const delete_user_handler_1 = require("./application/handlers/user/delete-user.handler");
+const restore_user_handler_1 = require("./application/handlers/user/restore-user.handler");
+const update_user_handler_1 = require("./application/handlers/user/update-user.handler");
+const get_roles_handler_1 = require("./application/handlers/role/get-roles.handler");
+const get_role_handler_1 = require("./application/handlers/role/get-role.handler");
+const create_role_handler_1 = require("./application/handlers/role/create-role.handler");
+const update_role_handler_1 = require("./application/handlers/role/update-role.handler");
+const delete_role_handler_1 = require("./application/handlers/role/delete-role.handler");
+const assign_permission_handler_1 = require("./application/handlers/role/assign-permission.handler");
+const remove_permission_handler_1 = require("./application/handlers/role/remove-permission.handler");
+const get_permissions_handler_1 = require("./application/handlers/permission/get-permissions.handler");
+const get_permission_handler_1 = require("./application/handlers/permission/get-permission.handler");
+const create_permission_handler_1 = require("./application/handlers/permission/create-permission.handler");
+const update_permission_handler_1 = require("./application/handlers/permission/update-permission.handler");
+const delete_permission_handler_1 = require("./application/handlers/permission/delete-permission.handler");
+let IdentityModule = class IdentityModule {
+};
+exports.IdentityModule = IdentityModule;
+exports.IdentityModule = IdentityModule = __decorate([
+    (0, common_1.Module)({
+        imports: [auth_module_1.AuthModule, authorization_module_1.AuthorizationModule],
+        providers: [
+            //#region User 
+            // CreateUserHandler has been removed: provisioning disabled; users must be created in Authentik.
+            sync_identity_handler_1.SyncIdentityHandler,
+            get_users_handler_1.GetUsersHandler,
+            get_user_handler_1.GetUserHandler,
+            get_current_user_handler_1.GetCurrentUserHandler,
+            enable_user_handler_1.EnableUserHandler,
+            disable_user_handler_1.DisableUserHandler,
+            delete_user_handler_1.DeleteUserHandler,
+            restore_user_handler_1.RestoreUserHandler,
+            update_user_handler_1.UpdateUserHandler,
+            //#endregion
+            // role & permission handlers
+            get_roles_handler_1.GetRolesHandler,
+            get_role_handler_1.GetRoleHandler,
+            create_role_handler_1.CreateRoleHandler,
+            update_role_handler_1.UpdateRoleHandler,
+            delete_role_handler_1.DeleteRoleHandler,
+            assign_permission_handler_1.RoleAssignPermissionHandler,
+            remove_permission_handler_1.RoleRemovePermissionHandler,
+            get_permissions_handler_1.GetPermissionsHandler,
+            get_permission_handler_1.GetPermissionHandler,
+            create_permission_handler_1.CreatePermissionHandler,
+            update_permission_handler_1.UpdatePermissionHandler,
+            delete_permission_handler_1.DeletePermissionHandler,
+            jwt_auth_guard_1.JwtAuthGuard,
+            current_user_guard_1.CurrentUserGuard,
+            permission_guard_1.PermissionGuard,
+            core_1.Reflector,
+            prisma_service_1.PrismaService,
+            prisma_user_repository_1.PrismaUserRepository,
+            prisma_role_repository_1.PrismaRoleRepository,
+            prisma_permission_repository_1.PrismaPermissionRepository,
+            user_service_1.UserService,
+            update_user_handler_1.UpdateUserHandler,
+            {
+                provide: user_interface_1.IUser,
+                useClass: prisma_user_repository_1.PrismaUserRepository,
+            },
+            {
+                provide: role_interface_1.IRole,
+                useClass: prisma_role_repository_1.PrismaRoleRepository,
+            },
+            {
+                provide: permission_interface_1.IPermission,
+                useClass: prisma_permission_repository_1.PrismaPermissionRepository,
+            },
+            {
+                provide: i_auth_config_1.IAuthConfig,
+                useClass: env_auth_config_1.EnvAuthConfig,
+            },
+        ],
+        controllers: [users_controller_1.UsersController, roles_controller_1.RolesController, permissions_controller_1.PermissionsController],
+    })
+], IdentityModule);
+//# sourceMappingURL=identity.module.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/identity.module.js.map b/dist/modules/identity/identity.module.js.map
new file mode 100644
index 0000000..661d266
--- /dev/null
+++ b/dist/modules/identity/identity.module.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"identity.module.js","sourceRoot":"","sources":["../../../src/modules/identity/identity.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,kFAA8E;AAC9E,kFAA8E;AAC9E,8FAA0F;AAC1F,gEAA4D;AAC5D,sEAAkE;AAClE,iGAA4F;AAC5F,yEAA6D;AAG7D,0EAAqE;AAErE,4FAAwF;AACxF,uCAAyC;AACzC,6FAAwF;AACxF,iFAA4E;AAC5E,iGAA4F;AAC5F,6GAAwG;AACxG,yEAA6D;AAC7D,qFAAyE;AACzE,sEAAiE;AACjE,0EAAqE;AACrE,qDAAiD;AACjD,gFAA4E;AAG5E,qFAAgF;AAChF,mFAA8E;AAC9E,mGAA6F;AAC7F,yFAAoF;AACpF,2FAAsF;AACtF,yFAAoF;AACpF,2FAAsF;AACtF,yFAAoF;AAIpF,qFAAgF;AAChF,mFAA8E;AAC9E,yFAAoF;AACpF,yFAAoF;AACpF,yFAAoF;AACpF,qGAAoG;AACpG,qGAAoG;AAEpG,uGAAkG;AAClG,qGAAgG;AAChG,2GAAsG;AACtG,2GAAsG;AACtG,2GAAsG;AAmE/F,IAAM,cAAc,GAApB,MAAM,cAAc;CAAG,CAAA;AAAjB,wCAAc;yBAAd,cAAc;IAjE1B,IAAA,eAAM,EAAC;QACJ,OAAO,EAAE,CAAC,wBAAU,EAAE,0CAAmB,CAAC;QAC5C,SAAS,EAAE;YAEL,eAAe;YACnB,iGAAiG;YACjG,2CAAmB;YACnB,mCAAe;YAEf,iCAAc;YACd,gDAAqB;YACrB,uCAAiB;YACjB,yCAAkB;YAClB,uCAAiB;YACb,yCAAkB;YACtB,uCAAiB;YAEjB,YAAY;YAEZ,6BAA6B;YAC7B,mCAAe;YACf,iCAAc;YACd,uCAAiB;YACjB,uCAAiB;YACjB,uCAAiB;YACjB,uDAA2B;YAC3B,uDAA2B;YAEvB,+CAAqB;YACzB,6CAAoB;YACpB,mDAAuB;YACvB,mDAAuB;YACvB,mDAAuB;YAEvB,6BAAY;YAEZ,qCAAgB;YAChB,kCAAe;YACf,gBAAS;YACT,8BAAa;YACb,6CAAoB;YACpB,6CAAoB;YACpB,yDAA0B;YACtB,0BAAW;YACf,uCAAiB;YAEjB;gBACE,OAAO,EAAE,sBAAK;gBACd,QAAQ,EAAE,6CAAoB;aAC/B;YACD;gBACE,OAAO,EAAE,sBAAK;gBACd,QAAQ,EAAE,6CAAoB;aAC/B;YACD;gBACE,OAAO,EAAE,kCAAW;gBACpB,QAAQ,EAAE,yDAA0B;aACrC;YACD;gBACE,OAAO,EAAE,2BAAW;gBACpB,QAAQ,EAAE,+BAAa;aACxB;SACI;QACP,WAAW,EAAE,CAAC,kCAAe,EAAE,kCAAe,EAAE,8CAAqB,CAAC;KACvE,CAAC;GACW,cAAc,CAAG"}
\ No newline at end of file
diff --git a/dist/modules/identity/infrastructure/mappers/prisma-permission.mapper.js b/dist/modules/identity/infrastructure/mappers/prisma-permission.mapper.js
new file mode 100644
index 0000000..a879ac7
--- /dev/null
+++ b/dist/modules/identity/infrastructure/mappers/prisma-permission.mapper.js
@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaPermissionMapper = void 0;
+const permission_entity_1 = require("../../domain/entities/permission.entity");
+class PrismaPermissionMapper {
+    static toDomain(model) {
+        return permission_entity_1.PermissionData.restore({
+            id: model.id,
+            code: model.code || model.name,
+            name: model.name,
+            description: model.description,
+            createdAt: model.createdAt,
+            updatedAt: model.updatedAt,
+        });
+    }
+    static toPersistence(permission) {
+        return {
+            id: permission.id,
+            code: permission.code,
+            name: permission.name,
+            description: permission.description,
+        };
+    }
+}
+exports.PrismaPermissionMapper = PrismaPermissionMapper;
+//# sourceMappingURL=prisma-permission.mapper.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/infrastructure/mappers/prisma-permission.mapper.js.map b/dist/modules/identity/infrastructure/mappers/prisma-permission.mapper.js.map
new file mode 100644
index 0000000..9d55fc3
--- /dev/null
+++ b/dist/modules/identity/infrastructure/mappers/prisma-permission.mapper.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"prisma-permission.mapper.js","sourceRoot":"","sources":["../../../../../src/modules/identity/infrastructure/mappers/prisma-permission.mapper.ts"],"names":[],"mappings":";;;AAAA,+EAAyE;AAEzE,MAAa,sBAAsB;IACjC,MAAM,CAAC,QAAQ,CAAC,KAAU;QACxB,OAAO,kCAAc,CAAC,OAAO,CAAC;YAC5B,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;YAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,UAA0B;QAC7C,OAAO;YACL,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC;IACJ,CAAC;CACF;AApBD,wDAoBC"}
\ No newline at end of file
diff --git a/dist/modules/identity/infrastructure/mappers/prisma-role.mapper.js b/dist/modules/identity/infrastructure/mappers/prisma-role.mapper.js
new file mode 100644
index 0000000..846e987
--- /dev/null
+++ b/dist/modules/identity/infrastructure/mappers/prisma-role.mapper.js
@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaRoleMapper = void 0;
+const role_entity_1 = require("../../domain/entities/role.entity");
+const permission_entity_1 = require("../../domain/entities/permission.entity");
+class PrismaRoleMapper {
+    static toDomain(model) {
+        const permissions = (model.permissions || []).map((p) => {
+            const perm = p.permission || p; // p may be RolePermission with nested permission or permission itself
+            return permission_entity_1.PermissionData.restore({
+                id: perm.id,
+                name: perm.name,
+                description: perm.description,
+                createdAt: perm.createdAt,
+                updatedAt: perm.updatedAt,
+            });
+        });
+        return role_entity_1.RoleData.restore({
+            id: model.id,
+            code: model.code,
+            name: model.name,
+            description: model.description,
+            permissions,
+            isDefault: model.isDefault ?? false,
+            createdAt: model.createdAt,
+            updatedAt: model.updatedAt,
+        });
+    }
+}
+exports.PrismaRoleMapper = PrismaRoleMapper;
+//# sourceMappingURL=prisma-role.mapper.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/infrastructure/mappers/prisma-role.mapper.js.map b/dist/modules/identity/infrastructure/mappers/prisma-role.mapper.js.map
new file mode 100644
index 0000000..370d49b
--- /dev/null
+++ b/dist/modules/identity/infrastructure/mappers/prisma-role.mapper.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"prisma-role.mapper.js","sourceRoot":"","sources":["../../../../../src/modules/identity/infrastructure/mappers/prisma-role.mapper.ts"],"names":[],"mappings":";;;AAAA,mEAA6D;AAC7D,+EAAyE;AAEzE,MAAa,gBAAgB;IAC3B,MAAM,CAAC,QAAQ,CAAC,KAAU;QACxB,MAAM,WAAW,GAAqB,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE;YAC7E,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,sEAAsE;YACtG,OAAO,kCAAc,CAAC,OAAO,CAAC;gBAC5B,EAAE,EAAE,IAAI,CAAC,EAAE;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,sBAAQ,CAAC,OAAO,CAAC;YACtB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW;YACX,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK;YACnC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC;IACL,CAAC;CACF;AAxBD,4CAwBC"}
\ No newline at end of file
diff --git a/dist/modules/identity/infrastructure/mappers/prisma-user.mapper.js b/dist/modules/identity/infrastructure/mappers/prisma-user.mapper.js
new file mode 100644
index 0000000..65dfcb2
--- /dev/null
+++ b/dist/modules/identity/infrastructure/mappers/prisma-user.mapper.js
@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaUserMapper = void 0;
+const user_entity_1 = require("../../domain/entities/user.entity");
+const role_entity_1 = require("../../domain/entities/role.entity");
+const permission_entity_1 = require("../../domain/entities/permission.entity");
+class PrismaUserMapper {
+    static toDomain(model) {
+        const roles = (model.roles || []).map((ur) => {
+            const r = ur.role;
+            const permissions = (r?.permissions || []).map((rp) => permission_entity_1.PermissionData.restore({
+                id: rp.permission.id,
+                name: rp.permission.name,
+                description: rp.permission.description,
+                createdAt: rp.permission.createdAt,
+                updatedAt: rp.permission.updatedAt,
+            }));
+            return role_entity_1.RoleData.restore({
+                id: r.id,
+                code: r.code,
+                name: r.name,
+                description: r.description,
+                permissions,
+                createdAt: r.createdAt,
+                updatedAt: r.updatedAt,
+            });
+        });
+        const permissions = (model.permissions || []).map((up) => permission_entity_1.PermissionData.restore({
+            id: up.permission.id,
+            name: up.permission.name,
+            description: up.permission.description,
+            createdAt: up.permission.createdAt,
+            updatedAt: up.permission.updatedAt,
+        }));
+        return user_entity_1.UserData.restore({
+            id: model.id,
+            authentikId: model.authentikUserId || model.authentikId || null,
+            username: model.username || model.name || model.username,
+            email: model.email,
+            password: model.password ?? null,
+            roles,
+            permissions,
+            isActive: model.isActive ?? true,
+            deletedAt: model.deletedAt || null,
+            lastSeenAt: model.lastSeenAt || null,
+            storageQuota: model.storageQuota !== undefined && model.storageQuota !== null ? Number(model.storageQuota) : undefined,
+            storageUsed: model.storageUsed !== undefined && model.storageUsed !== null ? Number(model.storageUsed) : undefined,
+        });
+    }
+    static toPersistence(userData) {
+        return {
+            id: userData.id,
+            authentikUserId: userData.authentikUserId || userData.authentikId,
+            authentikId: userData.authentikId,
+            username: userData.username,
+            email: userData.email,
+            password: userData.password ?? null,
+            isActive: userData.isActive,
+            deletedAt: userData.deletedAt,
+            lastSeenAt: userData.lastSeenAt,
+            lastSyncedAt: userData.lastSyncedAt,
+            syncStatus: userData.syncStatus,
+            storageQuota: userData.storageQuota,
+            storageUsed: userData.storageUsed,
+        };
+    }
+}
+exports.PrismaUserMapper = PrismaUserMapper;
+//# sourceMappingURL=prisma-user.mapper.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/infrastructure/mappers/prisma-user.mapper.js.map b/dist/modules/identity/infrastructure/mappers/prisma-user.mapper.js.map
new file mode 100644
index 0000000..d9962ec
--- /dev/null
+++ b/dist/modules/identity/infrastructure/mappers/prisma-user.mapper.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"prisma-user.mapper.js","sourceRoot":"","sources":["../../../../../src/modules/identity/infrastructure/mappers/prisma-user.mapper.ts"],"names":[],"mappings":";;;AAAA,mEAA6D;AAC7D,mEAA6D;AAC7D,+EAAyE;AAEzE,MAAa,gBAAgB;IAC3B,MAAM,CAAC,QAAQ,CAAC,KAAU;QACxB,MAAM,KAAK,GAAe,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE;YACxD,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YAClB,MAAM,WAAW,GAAqB,CAAC,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE,CAC3E,kCAAc,CAAC,OAAO,CAAC;gBACrB,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;gBACpB,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI;gBACxB,WAAW,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW;gBACtC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS;gBAClC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS;aACnC,CAAC,CACH,CAAC;YAEF,OAAO,sBAAQ,CAAC,OAAO,CAAC;gBACtB,EAAE,EAAE,CAAC,CAAC,EAAE;gBACR,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW;gBACX,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEP,MAAM,WAAW,GAAqB,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE,CAC1E,kCAAc,CAAC,OAAO,CAAC;YACrB,EAAE,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;YACpB,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI;YACxB,WAAW,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW;YACtC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS;YAClC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS;SACnC,CAAC,CACH,CAAC;QAEM,OAAO,sBAAQ,CAAC,OAAO,CAAC;YAClC,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,WAAW,EAAE,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,WAAW,IAAI,IAAI;YAC/D,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ;YACxD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,KAAK;YACL,WAAW;YACX,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS;YACtH,WAAW,EAAE,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS;SACnH,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,QAAkB;QACjC,OAAO;YACL,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,eAAe,EAAG,QAAgB,CAAC,eAAe,IAAI,QAAQ,CAAC,WAAW;YAC1E,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,IAAI;YACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,YAAY,EAAG,QAAgB,CAAC,YAAY;YAC5C,UAAU,EAAG,QAAgB,CAAC,UAAU;YACxC,YAAY,EAAG,QAAgB,CAAC,YAAY;YAC5C,WAAW,EAAG,QAAgB,CAAC,WAAW;SAC3C,CAAC;IACR,CAAC;CACF;AApED,4CAoEC"}
\ No newline at end of file
diff --git a/dist/modules/identity/infrastructure/repositories/prisma-permission.repository.js b/dist/modules/identity/infrastructure/repositories/prisma-permission.repository.js
new file mode 100644
index 0000000..f31859d
--- /dev/null
+++ b/dist/modules/identity/infrastructure/repositories/prisma-permission.repository.js
@@ -0,0 +1,67 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaPermissionRepository = void 0;
+const common_1 = require("@nestjs/common");
+const prisma_service_1 = require("../../../../shared/prisma.service");
+const prisma_permission_mapper_1 = require("../mappers/prisma-permission.mapper");
+let PrismaPermissionRepository = class PrismaPermissionRepository {
+    prisma;
+    constructor(prisma) {
+        this.prisma = prisma;
+    }
+    async find(params) {
+        const page = params.page && params.page > 0 ? params.page : 1;
+        const limit = params.limit && params.limit > 0 ? params.limit : 10;
+        const where = {};
+        if (params.search) {
+            where.OR = [
+                { name: { contains: params.search, mode: 'insensitive' } },
+                { code: { contains: params.search, mode: 'insensitive' } },
+                { description: { contains: params.search, mode: 'insensitive' } },
+            ];
+        }
+        const [total, items] = await Promise.all([
+            this.prisma.permission.count({ where }),
+            this.prisma.permission.findMany({ where, skip: (page - 1) * limit, take: limit, orderBy: { createdAt: 'desc' } }),
+        ]);
+        return { data: items.map(i => prisma_permission_mapper_1.PrismaPermissionMapper.toDomain(i)), total };
+    }
+    async getById(id) {
+        const p = await this.prisma.permission.findUnique({ where: { id } });
+        if (!p)
+            throw new Error('Permission not found.');
+        return prisma_permission_mapper_1.PrismaPermissionMapper.toDomain(p);
+    }
+    async create(permission) {
+        const base = prisma_permission_mapper_1.PrismaPermissionMapper.toPersistence(permission);
+        const created = await this.prisma.permission.create({ data: base });
+        return prisma_permission_mapper_1.PrismaPermissionMapper.toDomain(created);
+    }
+    async update(permission) {
+        const base = prisma_permission_mapper_1.PrismaPermissionMapper.toPersistence(permission);
+        const updated = await this.prisma.permission.update({ where: { id: permission.id }, data: base });
+        return prisma_permission_mapper_1.PrismaPermissionMapper.toDomain(updated);
+    }
+    async delete(id) {
+        await this.prisma.permission.delete({ where: { id } });
+    }
+    async findRoleIdsByPermission(permissionId) {
+        const rows = await this.prisma.rolePermission.findMany({ where: { permissionId }, select: { roleId: true } });
+        return rows.map(r => r.roleId);
+    }
+};
+exports.PrismaPermissionRepository = PrismaPermissionRepository;
+exports.PrismaPermissionRepository = PrismaPermissionRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [prisma_service_1.PrismaService])
+], PrismaPermissionRepository);
+//# sourceMappingURL=prisma-permission.repository.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/infrastructure/repositories/prisma-permission.repository.js.map b/dist/modules/identity/infrastructure/repositories/prisma-permission.repository.js.map
new file mode 100644
index 0000000..9c8feb7
--- /dev/null
+++ b/dist/modules/identity/infrastructure/repositories/prisma-permission.repository.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"prisma-permission.repository.js","sourceRoot":"","sources":["../../../../../src/modules/identity/infrastructure/repositories/prisma-permission.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,sEAAkE;AAElE,kFAA6E;AAItE,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACR;IAA7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD,KAAK,CAAC,IAAI,CAAC,MAAiE;QAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnE,MAAM,KAAK,GAAQ,EAAE,CAAC;QACtB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,CAAC,EAAE,GAAG;gBACT,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;gBAC1D,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;gBAC1D,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;aAClE,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC;SAClH,CAAC,CAAC;QAEH,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,iDAAsB,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACjD,OAAO,iDAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAA0B;QACrC,MAAM,IAAI,GAAG,iDAAsB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,OAAO,iDAAsB,CAAC,QAAQ,CAAC,OAAO,CAAE,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAA0B;QACrC,MAAM,IAAI,GAAG,iDAAsB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAClG,OAAO,iDAAsB,CAAC,QAAQ,CAAC,OAAO,CAAE,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,YAAoB;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9G,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF,CAAA;AAlDY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,mBAAU,GAAE;qCAE0B,8BAAa;GADvC,0BAA0B,CAkDtC"}
\ No newline at end of file
diff --git a/dist/modules/identity/infrastructure/repositories/prisma-role.repository.js b/dist/modules/identity/infrastructure/repositories/prisma-role.repository.js
new file mode 100644
index 0000000..3e86090
--- /dev/null
+++ b/dist/modules/identity/infrastructure/repositories/prisma-role.repository.js
@@ -0,0 +1,110 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaRoleRepository = void 0;
+const common_1 = require("@nestjs/common");
+const prisma_service_1 = require("../../../../shared/prisma.service");
+const prisma_role_mapper_1 = require("../mappers/prisma-role.mapper");
+let PrismaRoleRepository = class PrismaRoleRepository {
+    prisma;
+    constructor(prisma) {
+        this.prisma = prisma;
+    }
+    async getDefaultRole() {
+        const role = await this.prisma.role.findFirst({
+            where: { isDefault: true },
+            include: { permissions: { include: { permission: true } } },
+        });
+        if (!role)
+            return null;
+        return prisma_role_mapper_1.PrismaRoleMapper.toDomain(role);
+    }
+    async findById(roleId) {
+        const role = await this.prisma.role.findUnique({
+            where: { id: roleId },
+            include: { permissions: { include: { permission: true } } },
+        });
+        if (!role)
+            throw new Error('Role not found.');
+        return prisma_role_mapper_1.PrismaRoleMapper.toDomain(role);
+    }
+    async find(params) {
+        const page = params.page && params.page > 0 ? params.page : 1;
+        const limit = params.limit && params.limit > 0 ? params.limit : 10;
+        const where = {};
+        if (params.search) {
+            where.OR = [
+                { name: { contains: params.search, mode: 'insensitive' } },
+                { code: { contains: params.search, mode: 'insensitive' } },
+                { description: { contains: params.search, mode: 'insensitive' } },
+            ];
+        }
+        const [total, items] = await Promise.all([
+            this.prisma.role.count({ where }),
+            this.prisma.role.findMany({ where, skip: (page - 1) * limit, take: limit, orderBy: { createdAt: 'desc' }, include: { permissions: { include: { permission: true } } } }),
+        ]);
+        return { data: items.map(i => prisma_role_mapper_1.PrismaRoleMapper.toDomain(i)), total };
+    }
+    async create(role) {
+        const base = {
+            id: role.id,
+            code: role.code,
+            name: role.name,
+            description: role.description,
+            isDefault: role.isDefault,
+        };
+        if (role.permissions && role.permissions.length > 0) {
+            base.permissions = {
+                create: role.permissions.map(p => ({ permission: { connect: { id: p.id } }, assignedBy: 'system' })),
+            };
+        }
+        const created = await this.prisma.role.create({ data: base, include: { permissions: { include: { permission: true } } } });
+        return prisma_role_mapper_1.PrismaRoleMapper.toDomain(created);
+    }
+    async update(role) {
+        const base = {
+            code: role.code,
+            name: role.name,
+            description: role.description,
+            isDefault: role.isDefault,
+        };
+        // sync permissions via transaction
+        const permIds = role.permissions ? role.permissions.map(p => p.id) : [];
+        await this.prisma.$transaction(async (prisma) => {
+            const currentPerms = await prisma.rolePermission.findMany({ where: { roleId: role.id } });
+            const currentIds = currentPerms.map(p => p.permissionId);
+            const toAdd = permIds.filter(id => !currentIds.includes(id));
+            const toRemove = currentIds.filter(id => !permIds.includes(id));
+            if (toRemove.length > 0) {
+                await prisma.rolePermission.deleteMany({ where: { roleId: role.id, permissionId: { in: toRemove } } });
+            }
+            if (toAdd.length > 0) {
+                await prisma.rolePermission.createMany({ data: toAdd.map(pid => ({ roleId: role.id, permissionId: pid, assignedBy: 'system' })), skipDuplicates: true });
+            }
+            await prisma.role.update({ where: { id: role.id }, data: base });
+        });
+        const updated = await this.prisma.role.findUnique({ where: { id: role.id }, include: { permissions: { include: { permission: true } } } });
+        return prisma_role_mapper_1.PrismaRoleMapper.toDomain(updated);
+    }
+    async delete(roleId) {
+        await this.prisma.role.delete({ where: { id: roleId } });
+    }
+    async getAssignedUserIds(roleId) {
+        const rows = await this.prisma.userRole.findMany({ where: { roleId }, select: { userId: true } });
+        return rows.map(r => r.userId);
+    }
+};
+exports.PrismaRoleRepository = PrismaRoleRepository;
+exports.PrismaRoleRepository = PrismaRoleRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [prisma_service_1.PrismaService])
+], PrismaRoleRepository);
+//# sourceMappingURL=prisma-role.repository.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/infrastructure/repositories/prisma-role.repository.js.map b/dist/modules/identity/infrastructure/repositories/prisma-role.repository.js.map
new file mode 100644
index 0000000..743d10a
--- /dev/null
+++ b/dist/modules/identity/infrastructure/repositories/prisma-role.repository.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"prisma-role.repository.js","sourceRoot":"","sources":["../../../../../src/modules/identity/infrastructure/repositories/prisma-role.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,sEAAkE;AAElE,sEAAiE;AAI1D,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACF;IAA7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD,KAAK,CAAC,cAAc;QAClB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC;YAC5C,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YAC1B,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE;SAC5D,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEvB,OAAO,qCAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAc;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YAC7C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE;SAC5D,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAE9C,OAAO,qCAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAiE;QAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnE,MAAM,KAAK,GAAQ,EAAE,CAAC;QACtB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,CAAC,EAAE,GAAG;gBACT,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;gBAC1D,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;gBAC1D,EAAE,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;aAClE,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC;SACzK,CAAC,CAAC;QAEH,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,qCAAgB,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAc;QACzB,MAAM,IAAI,GAAQ;YAChB,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,WAAW,GAAG;gBACjB,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;aACrG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3H,OAAO,qCAAgB,CAAC,QAAQ,CAAC,OAAO,CAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAc;QACzB,MAAM,IAAI,GAAQ;YAChB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF,mCAAmC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAExE,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAC9C,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1F,MAAM,UAAU,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAEzD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAEhE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACzG,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;YAClK,CAAC;YAED,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3I,OAAO,qCAAgB,CAAC,QAAQ,CAAC,OAAO,CAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,MAAc;QACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF,CAAA;AA1GY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAE0B,8BAAa;GADvC,oBAAoB,CA0GhC"}
\ No newline at end of file
diff --git a/dist/modules/identity/infrastructure/repositories/prisma-user.repository.js b/dist/modules/identity/infrastructure/repositories/prisma-user.repository.js
new file mode 100644
index 0000000..8cf324e
--- /dev/null
+++ b/dist/modules/identity/infrastructure/repositories/prisma-user.repository.js
@@ -0,0 +1,216 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaUserRepository = void 0;
+const common_1 = require("@nestjs/common");
+const prisma_service_1 = require("../../../../shared/prisma.service");
+const prisma_user_mapper_1 = require("../mappers/prisma-user.mapper");
+let PrismaUserRepository = class PrismaUserRepository {
+    prisma;
+    constructor(prisma) {
+        this.prisma = prisma;
+    }
+    //#region  Create
+    async create(userData) {
+        const base = prisma_user_mapper_1.PrismaUserMapper.toPersistence(userData);
+        const data = { ...base };
+        if (userData.roles && userData.roles.length > 0) {
+            data.roles = {
+                create: userData.roles.map(r => ({ role: { connect: { id: r.id } }, assignedBy: 'system' })),
+            };
+        }
+        const created = await this.prisma.user.create({
+            data,
+            include: {
+                roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
+                permissions: { include: { permission: true } },
+            },
+        });
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(created);
+    }
+    //#endregion
+    //#region Read
+    async existsById(userId) {
+        return ((await this.prisma.user.findUnique({
+            where: { id: userId },
+            select: { id: true },
+        })) !== null);
+    }
+    async existByEmail(userEmail) {
+        return ((await this.prisma.user.findUnique({
+            where: { email: userEmail },
+            select: { email: true },
+        })) !== null);
+    }
+    async getById(userId) {
+        const userData = await this.prisma.user.findUnique({
+            where: { id: userId },
+            include: {
+                roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
+                permissions: { include: { permission: true } },
+            },
+        });
+        if (userData === null)
+            throw new Error('User tidak ditemukan.');
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(userData);
+    }
+    async getByEmail(userEmail) {
+        const userData = await this.prisma.user.findUnique({
+            where: { email: userEmail },
+            include: {
+                roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
+                permissions: { include: { permission: true } },
+            },
+        });
+        if (userData === null)
+            throw new Error('User tidak ditemukan.');
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(userData);
+    }
+    async findByAuthentikId(authentikId) {
+        const userData = await this.prisma.user.findUnique({
+            where: { authentikId },
+            include: {
+                roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
+                permissions: { include: { permission: true } },
+            },
+        });
+        if (!userData)
+            return null;
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(userData);
+    }
+    async find(params) {
+        const page = params.page && params.page > 0 ? params.page : 1;
+        const limit = params.limit && params.limit > 0 ? params.limit : 10;
+        const where = {};
+        if (params.search) {
+            where.OR = [
+                { username: { contains: params.search, mode: 'insensitive' } },
+                { email: { contains: params.search, mode: 'insensitive' } },
+            ];
+        }
+        if (params.isActive !== undefined && params.isActive !== null) {
+            where.isActive = params.isActive;
+        }
+        if (params.deleted !== undefined && params.deleted !== null) {
+            if (params.deleted)
+                where.deletedAt = { not: null };
+            else
+                where.deletedAt = null;
+        }
+        if (params.roleId) {
+            where.roles = { some: { roleId: params.roleId } };
+        }
+        const [total, items] = await Promise.all([
+            this.prisma.user.count({ where }),
+            this.prisma.user.findMany({
+                where,
+                include: {
+                    roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
+                    permissions: { include: { permission: true } },
+                },
+                skip: (page - 1) * limit,
+                take: limit,
+                orderBy: { createdAt: 'desc' },
+            }),
+        ]);
+        return { data: items.map(i => prisma_user_mapper_1.PrismaUserMapper.toDomain(i)), total };
+    }
+    async softDelete(userId) {
+        await this.prisma.user.update({ where: { id: userId }, data: { deletedAt: new Date(), isActive: false } });
+    }
+    async restore(userId) {
+        const updated = await this.prisma.user.update({
+            where: { id: userId },
+            data: { deletedAt: null },
+            include: {
+                roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
+                permissions: { include: { permission: true } },
+            },
+        });
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(updated);
+    }
+    async enable(userId) {
+        const updated = await this.prisma.user.update({
+            where: { id: userId },
+            data: { isActive: true },
+            include: {
+                roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
+                permissions: { include: { permission: true } },
+            },
+        });
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(updated);
+    }
+    async disable(userId) {
+        const updated = await this.prisma.user.update({
+            where: { id: userId },
+            data: { isActive: false },
+            include: {
+                roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
+                permissions: { include: { permission: true } },
+            },
+        });
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(updated);
+    }
+    async update(userData) {
+        const base = prisma_user_mapper_1.PrismaUserMapper.toPersistence(userData);
+        const data = { ...base };
+        // sync roles and permissions using transaction
+        const roleIds = userData.roles ? userData.roles.map(r => r.id) : [];
+        const permissionIds = userData.permissions ? userData.permissions.map(p => p.id) : [];
+        // perform transaction: delete removed relations, create missing ones, update user
+        await this.prisma.$transaction(async (prisma) => {
+            // current roles
+            const currentRoles = await prisma.userRole.findMany({ where: { userId: userData.id } });
+            const currentRoleIds = currentRoles.map(r => r.roleId);
+            const toAddRoles = roleIds.filter(id => !currentRoleIds.includes(id));
+            const toRemoveRoles = currentRoleIds.filter(id => !roleIds.includes(id));
+            if (toRemoveRoles.length > 0) {
+                await prisma.userRole.deleteMany({ where: { userId: userData.id, roleId: { in: toRemoveRoles } } });
+            }
+            if (toAddRoles.length > 0) {
+                await prisma.userRole.createMany({
+                    data: toAddRoles.map(rid => ({ userId: userData.id, roleId: rid, assignedBy: 'system' })),
+                    skipDuplicates: true,
+                });
+            }
+            // permissions
+            const currentPerms = await prisma.userPermission.findMany({ where: { userId: userData.id } });
+            const currentPermIds = currentPerms.map(p => p.permissionId);
+            const toAddPerms = permissionIds.filter(id => !currentPermIds.includes(id));
+            const toRemovePerms = currentPermIds.filter(id => !permissionIds.includes(id));
+            if (toRemovePerms.length > 0) {
+                await prisma.userPermission.deleteMany({ where: { userId: userData.id, permissionId: { in: toRemovePerms } } });
+            }
+            if (toAddPerms.length > 0) {
+                await prisma.userPermission.createMany({
+                    data: toAddPerms.map(pid => ({ userId: userData.id, permissionId: pid, assignedBy: 'system' })),
+                    skipDuplicates: true,
+                });
+            }
+            // update base user fields
+            await prisma.user.update({ where: { id: userData.id }, data });
+        });
+        const updated = await this.prisma.user.findUnique({
+            where: { id: userData.id },
+            include: {
+                roles: { include: { role: { include: { permissions: { include: { permission: true } } } } } },
+                permissions: { include: { permission: true } },
+            },
+        });
+        return prisma_user_mapper_1.PrismaUserMapper.toDomain(updated);
+    }
+};
+exports.PrismaUserRepository = PrismaUserRepository;
+exports.PrismaUserRepository = PrismaUserRepository = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [prisma_service_1.PrismaService])
+], PrismaUserRepository);
+//# sourceMappingURL=prisma-user.repository.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/infrastructure/repositories/prisma-user.repository.js.map b/dist/modules/identity/infrastructure/repositories/prisma-user.repository.js.map
new file mode 100644
index 0000000..e689eeb
--- /dev/null
+++ b/dist/modules/identity/infrastructure/repositories/prisma-user.repository.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"prisma-user.repository.js","sourceRoot":"","sources":["../../../../../src/modules/identity/infrastructure/repositories/prisma-user.repository.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,sEAAkE;AAGlE,sEAAiE;AAG1D,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACF;IAA7B,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD,iBAAiB;IAEjB,KAAK,CAAC,MAAM,CAAC,QAAkB;QAC7B,MAAM,IAAI,GAAG,qCAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;QAE9B,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,IAAI,CAAC,KAAK,GAAG;gBACX,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;aAC7F,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YAC5C,IAAI;YACJ,OAAO,EAAE;gBACP,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;gBAC7F,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;aAC/C;SACF,CAAC,CAAC;QAEH,OAAO,qCAAgB,CAAC,QAAQ,CAAC,OAAO,CAAE,CAAC;IAC7C,CAAC;IAED,YAAY;IAEZ,cAAc;IAEd,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,OAAO,CACL,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACjC,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC,KAAK,IAAI,CACb,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAiB;QAClC,OAAO,CACL,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACjC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;YAC3B,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;SACxB,CAAC,CAAC,KAAK,IAAI,CACb,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,OAAO,EAAE;gBACP,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;gBAC7F,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;aAC/C;SACF,CAAC,CAAC;QAEH,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAEhE,OAAO,qCAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACjD,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;YAC3B,OAAO,EAAE;gBACP,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;gBAC7F,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;aAC/C;SACF,CAAC,CAAC;QAEH,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAEhE,OAAO,qCAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,WAAmB;QACzC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YACjD,KAAK,EAAE,EAAE,WAAW,EAAE;YACtB,OAAO,EAAE;gBACP,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;gBAC7F,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;aAC/C;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAE3B,OAAO,qCAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAOV;QACC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAEnE,MAAM,KAAK,GAAQ,EAAE,CAAC;QAEtB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,CAAC,EAAE,GAAG;gBACT,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;gBAC9D,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;aAC5D,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC9D,KAAK,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACnC,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC5D,IAAI,MAAM,CAAC,OAAO;gBAAE,KAAK,CAAC,SAAS,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;;gBAC/C,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;QAC9B,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,KAAK,CAAC,KAAK,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpD,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACxB,KAAK;gBACL,OAAO,EAAE;oBACP,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;oBAC7F,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;iBAC/C;gBACD,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,KAAK;gBACxB,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;aAC/B,CAAC;SACH,CAAC,CAAC;QAEH,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,qCAAgB,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7G,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YACzB,OAAO,EAAE;gBACP,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;gBAC7F,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;aAC/C;SACF,CAAC,CAAC;QAEH,OAAO,qCAAgB,CAAC,QAAQ,CAAC,OAAO,CAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,MAAc;QACzB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YACxB,OAAO,EAAE;gBACP,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;gBAC7F,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;aAC/C;SACF,CAAC,CAAC;QAEH,OAAO,qCAAgB,CAAC,QAAQ,CAAC,OAAO,CAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAc;QAC1B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YAC5C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;YACrB,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;YACzB,OAAO,EAAE;gBACP,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;gBAC7F,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;aAC/C;SACF,CAAC,CAAC;QAEH,OAAO,qCAAgB,CAAC,QAAQ,CAAC,OAAO,CAAE,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAkB;QAC7B,MAAM,IAAI,GAAG,qCAAgB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAEtD,MAAM,IAAI,GAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;QAE9B,+CAA+C;QAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,aAAa,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEtF,kFAAkF;QAClF,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAC9C,gBAAgB;YAChB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACxF,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAEvD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YACtE,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAEzE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;YACtG,CAAC;YAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAC/B,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAQ;oBAChG,cAAc,EAAE,IAAI;iBACrB,CAAC,CAAC;YACL,CAAC;YAED,cAAc;YACd,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9F,MAAM,cAAc,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;YAE7D,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5E,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;YAE/E,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC;YAClH,CAAC;YAED,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC;oBACrC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAQ;oBACtG,cAAc,EAAE,IAAI;iBACrB,CAAC,CAAC;YACL,CAAC;YAED,0BAA0B;YAC1B,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;YAChD,KAAK,EAAE,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE;YAC1B,OAAO,EAAE;gBACP,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;gBAC7F,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;aAC/C;SACF,CAAC,CAAC;QAEH,OAAO,qCAAgB,CAAC,QAAQ,CAAC,OAAO,CAAE,CAAC;IAC7C,CAAC;CAGF,CAAA;AAvPY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAE0B,8BAAa;GADvC,oBAAoB,CAuPhC"}
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/controllers/permissions.controller.js b/dist/modules/identity/presentation/controllers/permissions.controller.js
new file mode 100644
index 0000000..f1bf211
--- /dev/null
+++ b/dist/modules/identity/presentation/controllers/permissions.controller.js
@@ -0,0 +1,119 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionsController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const jwt_auth_guard_1 = require("../../../../core/auth/guards/jwt-auth.guard");
+const permission_guard_1 = require("../../../authorization/presentation/guards/permission.guard");
+const current_user_guard_1 = require("../guards/current-user.guard");
+const permission_decorator_1 = require("../../../authorization/presentation/decorators/permission.decorator");
+const permission_constants_1 = require("../../../../common/constants/permission.constants");
+const get_permissions_handler_1 = require("../../application/handlers/permission/get-permissions.handler");
+const get_permission_handler_1 = require("../../application/handlers/permission/get-permission.handler");
+const create_permission_handler_1 = require("../../application/handlers/permission/create-permission.handler");
+const update_permission_handler_1 = require("../../application/handlers/permission/update-permission.handler");
+const delete_permission_handler_1 = require("../../application/handlers/permission/delete-permission.handler");
+let PermissionsController = class PermissionsController {
+    getPermissionsHandler;
+    getPermissionHandler;
+    createPermissionHandler;
+    updatePermissionHandler;
+    deletePermissionHandler;
+    constructor(getPermissionsHandler, getPermissionHandler, createPermissionHandler, updatePermissionHandler, deletePermissionHandler) {
+        this.getPermissionsHandler = getPermissionsHandler;
+        this.getPermissionHandler = getPermissionHandler;
+        this.createPermissionHandler = createPermissionHandler;
+        this.updatePermissionHandler = updatePermissionHandler;
+        this.deletePermissionHandler = deletePermissionHandler;
+    }
+    async findAll(query) {
+        const res = await this.getPermissionsHandler.execute(query);
+        return { success: true, data: res.data, meta: { total: res.total } };
+    }
+    async findOne(id) {
+        const p = await this.getPermissionHandler.execute(id);
+        return { success: true, data: p, meta: {} };
+    }
+    async create(body) {
+        const created = await this.createPermissionHandler.execute(body);
+        return { success: true, data: created, meta: {} };
+    }
+    async update(id, body) {
+        const updated = await this.updatePermissionHandler.execute(id, body);
+        return { success: true, data: updated, meta: {} };
+    }
+    async remove(id) {
+        await this.deletePermissionHandler.execute(id);
+        return { success: true, data: null, meta: {} };
+    }
+};
+exports.PermissionsController = PermissionsController;
+__decorate([
+    (0, common_1.Get)(),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.PERMISSION_READ),
+    (0, swagger_1.ApiOperation)({ summary: 'List permissions' }),
+    __param(0, (0, common_1.Query)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], PermissionsController.prototype, "findAll", null);
+__decorate([
+    (0, common_1.Get)(':id'),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.PERMISSION_READ),
+    (0, swagger_1.ApiOperation)({ summary: 'Get permission' }),
+    __param(0, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], PermissionsController.prototype, "findOne", null);
+__decorate([
+    (0, common_1.Post)(),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.PERMISSION_CREATE),
+    (0, swagger_1.ApiOperation)({ summary: 'Create permission' }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], PermissionsController.prototype, "create", null);
+__decorate([
+    (0, common_1.Patch)(':id'),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.PERMISSION_UPDATE),
+    (0, swagger_1.ApiOperation)({ summary: 'Update permission' }),
+    __param(0, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], PermissionsController.prototype, "update", null);
+__decorate([
+    (0, common_1.Delete)(':id'),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.PERMISSION_DELETE),
+    (0, swagger_1.ApiOperation)({ summary: 'Delete permission' }),
+    __param(0, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], PermissionsController.prototype, "remove", null);
+exports.PermissionsController = PermissionsController = __decorate([
+    (0, swagger_1.ApiTags)('Permissions'),
+    (0, common_1.Controller)('permissions'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard, current_user_guard_1.CurrentUserGuard, permission_guard_1.PermissionGuard),
+    __metadata("design:paramtypes", [get_permissions_handler_1.GetPermissionsHandler,
+        get_permission_handler_1.GetPermissionHandler,
+        create_permission_handler_1.CreatePermissionHandler,
+        update_permission_handler_1.UpdatePermissionHandler,
+        delete_permission_handler_1.DeletePermissionHandler])
+], PermissionsController);
+//# sourceMappingURL=permissions.controller.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/controllers/permissions.controller.js.map b/dist/modules/identity/presentation/controllers/permissions.controller.js.map
new file mode 100644
index 0000000..18a3e1b
--- /dev/null
+++ b/dist/modules/identity/presentation/controllers/permissions.controller.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"permissions.controller.js","sourceRoot":"","sources":["../../../../../src/modules/identity/presentation/controllers/permissions.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAqG;AACrG,6CAAwD;AAExD,gFAA2E;AAC3E,kGAA8F;AAC9F,qEAAgE;AAChE,8GAAkG;AAClG,4FAAmF;AAEnF,2GAAsG;AACtG,yGAAoG;AACpG,+GAA0G;AAC1G,+GAA0G;AAC1G,+GAA0G;AAKnG,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAEb;IACA;IACA;IACA;IACA;IALnB,YACmB,qBAA4C,EAC5C,oBAA0C,EAC1C,uBAAgD,EAChD,uBAAgD,EAChD,uBAAgD;QAJhD,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,4BAAuB,GAAvB,uBAAuB,CAAyB;IAChE,CAAC;IAKE,AAAN,KAAK,CAAC,OAAO,CAAU,KAAU;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IACvE,CAAC;IAKK,AAAN,KAAK,CAAC,OAAO,CAAc,EAAU;QACnC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC9C,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAS,IAAS;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAc,EAAU,EAAU,IAAS;QACrD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACrE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAc,EAAU;QAClC,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjD,CAAC;CACF,CAAA;AAhDY,sDAAqB;AAY1B;IAHL,IAAA,YAAG,GAAE;IACL,IAAA,kCAAW,EAAC,qCAAc,CAAC,eAAe,CAAC;IAC3C,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC/B,WAAA,IAAA,cAAK,GAAE,CAAA;;;;oDAGrB;AAKK;IAHL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,kCAAW,EAAC,qCAAc,CAAC,eAAe,CAAC;IAC3C,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC7B,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;oDAGzB;AAKK;IAHL,IAAA,aAAI,GAAE;IACN,IAAA,kCAAW,EAAC,qCAAc,CAAC,iBAAiB,CAAC;IAC7C,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IACjC,WAAA,IAAA,aAAI,GAAE,CAAA;;;;mDAGnB;AAKK;IAHL,IAAA,cAAK,EAAC,KAAK,CAAC;IACZ,IAAA,kCAAW,EAAC,qCAAc,CAAC,iBAAiB,CAAC;IAC7C,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IACjC,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IAAc,WAAA,IAAA,aAAI,GAAE,CAAA;;;;mDAG5C;AAKK;IAHL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,kCAAW,EAAC,qCAAc,CAAC,iBAAiB,CAAC;IAC7C,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IACjC,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;mDAGxB;gCA/CU,qBAAqB;IAHjC,IAAA,iBAAO,EAAC,aAAa,CAAC;IACtB,IAAA,mBAAU,EAAC,aAAa,CAAC;IACzB,IAAA,kBAAS,EAAC,6BAAY,EAAE,qCAAgB,EAAE,kCAAe,CAAC;qCAGf,+CAAqB;QACtB,6CAAoB;QACjB,mDAAuB;QACvB,mDAAuB;QACvB,mDAAuB;GANxD,qBAAqB,CAgDjC"}
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/controllers/roles.controller.js b/dist/modules/identity/presentation/controllers/roles.controller.js
new file mode 100644
index 0000000..f9f2f60
--- /dev/null
+++ b/dist/modules/identity/presentation/controllers/roles.controller.js
@@ -0,0 +1,156 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RolesController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const jwt_auth_guard_1 = require("../../../../core/auth/guards/jwt-auth.guard");
+const permission_guard_1 = require("../../../authorization/presentation/guards/permission.guard");
+const current_user_guard_1 = require("../guards/current-user.guard");
+const permission_decorator_1 = require("../../../authorization/presentation/decorators/permission.decorator");
+const permission_constants_1 = require("../../../../common/constants/permission.constants");
+const get_roles_handler_1 = require("../../application/handlers/role/get-roles.handler");
+const get_role_handler_1 = require("../../application/handlers/role/get-role.handler");
+const create_role_handler_1 = require("../../application/handlers/role/create-role.handler");
+const update_role_handler_1 = require("../../application/handlers/role/update-role.handler");
+const delete_role_handler_1 = require("../../application/handlers/role/delete-role.handler");
+const assign_permission_handler_1 = require("../../application/handlers/role/assign-permission.handler");
+const remove_permission_handler_1 = require("../../application/handlers/role/remove-permission.handler");
+let RolesController = class RolesController {
+    getRolesHandler;
+    getRoleHandler;
+    createRoleHandler;
+    updateRoleHandler;
+    deleteRoleHandler;
+    roleAssignPermissionHandler;
+    roleRemovePermissionHandler;
+    constructor(getRolesHandler, getRoleHandler, createRoleHandler, updateRoleHandler, deleteRoleHandler, roleAssignPermissionHandler, roleRemovePermissionHandler) {
+        this.getRolesHandler = getRolesHandler;
+        this.getRoleHandler = getRoleHandler;
+        this.createRoleHandler = createRoleHandler;
+        this.updateRoleHandler = updateRoleHandler;
+        this.deleteRoleHandler = deleteRoleHandler;
+        this.roleAssignPermissionHandler = roleAssignPermissionHandler;
+        this.roleRemovePermissionHandler = roleRemovePermissionHandler;
+    }
+    async findAll(query) {
+        const res = await this.getRolesHandler.execute(query);
+        return { success: true, data: res.data, meta: { total: res.total } };
+    }
+    async findOne(id) {
+        const role = await this.getRoleHandler.execute(id);
+        return { success: true, data: role, meta: {} };
+    }
+    async create(body) {
+        const created = await this.createRoleHandler.execute(body);
+        return { success: true, data: created, meta: {} };
+    }
+    async update(id, body) {
+        const updated = await this.updateRoleHandler.execute(id, body);
+        return { success: true, data: updated, meta: {} };
+    }
+    async remove(id) {
+        await this.deleteRoleHandler.execute(id);
+        return { success: true, data: null, meta: {} };
+    }
+    async assignPermission(id, body) {
+        const permissionId = body.permissionId;
+        const updated = await this.roleAssignPermissionHandler.execute(id, permissionId);
+        return { success: true, data: updated, meta: {} };
+    }
+    async removePermission(id, permissionId) {
+        const updated = await this.roleRemovePermissionHandler.execute(id, permissionId);
+        return { success: true, data: updated, meta: {} };
+    }
+};
+exports.RolesController = RolesController;
+__decorate([
+    (0, common_1.Get)(),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.ROLE_READ),
+    (0, swagger_1.ApiOperation)({ summary: 'List roles' }),
+    __param(0, (0, common_1.Query)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], RolesController.prototype, "findAll", null);
+__decorate([
+    (0, common_1.Get)(':id'),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.ROLE_READ),
+    (0, swagger_1.ApiOperation)({ summary: 'Get role' }),
+    __param(0, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], RolesController.prototype, "findOne", null);
+__decorate([
+    (0, common_1.Post)(),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.ROLE_CREATE),
+    (0, swagger_1.ApiOperation)({ summary: 'Create role' }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], RolesController.prototype, "create", null);
+__decorate([
+    (0, common_1.Patch)(':id'),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.ROLE_UPDATE),
+    (0, swagger_1.ApiOperation)({ summary: 'Update role' }),
+    __param(0, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], RolesController.prototype, "update", null);
+__decorate([
+    (0, common_1.Delete)(':id'),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.ROLE_DELETE),
+    (0, swagger_1.ApiOperation)({ summary: 'Delete role' }),
+    __param(0, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], RolesController.prototype, "remove", null);
+__decorate([
+    (0, common_1.Post)(':id/permissions'),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.ROLE_UPDATE),
+    (0, swagger_1.ApiOperation)({ summary: 'Assign permission to role' }),
+    __param(0, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], RolesController.prototype, "assignPermission", null);
+__decorate([
+    (0, common_1.Delete)(':id/permissions/:permissionId'),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.ROLE_UPDATE),
+    (0, swagger_1.ApiOperation)({ summary: 'Remove permission from role' }),
+    __param(0, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Param)('permissionId')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:returntype", Promise)
+], RolesController.prototype, "removePermission", null);
+exports.RolesController = RolesController = __decorate([
+    (0, swagger_1.ApiTags)('Roles'),
+    (0, common_1.Controller)('roles'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard, current_user_guard_1.CurrentUserGuard, permission_guard_1.PermissionGuard),
+    __metadata("design:paramtypes", [get_roles_handler_1.GetRolesHandler,
+        get_role_handler_1.GetRoleHandler,
+        create_role_handler_1.CreateRoleHandler,
+        update_role_handler_1.UpdateRoleHandler,
+        delete_role_handler_1.DeleteRoleHandler,
+        assign_permission_handler_1.RoleAssignPermissionHandler,
+        remove_permission_handler_1.RoleRemovePermissionHandler])
+], RolesController);
+//# sourceMappingURL=roles.controller.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/controllers/roles.controller.js.map b/dist/modules/identity/presentation/controllers/roles.controller.js.map
new file mode 100644
index 0000000..95d1c04
--- /dev/null
+++ b/dist/modules/identity/presentation/controllers/roles.controller.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"roles.controller.js","sourceRoot":"","sources":["../../../../../src/modules/identity/presentation/controllers/roles.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAqG;AACrG,6CAAwD;AAExD,gFAA2E;AAC3E,kGAA8F;AAC9F,qEAAgE;AAChE,8GAAkG;AAClG,4FAAmF;AAEnF,yFAAoF;AACpF,uFAAkF;AAClF,6FAAwF;AACxF,6FAAwF;AACxF,6FAAwF;AACxF,yGAAwG;AACxG,yGAAwG;AAKjG,IAAM,eAAe,GAArB,MAAM,eAAe;IAEP;IACA;IACA;IACA;IACA;IACA;IACA;IAPnB,YACmB,eAAgC,EAChC,cAA8B,EAC9B,iBAAoC,EACpC,iBAAoC,EACpC,iBAAoC,EACpC,2BAAwD,EACxD,2BAAwD;QANxD,oBAAe,GAAf,eAAe,CAAiB;QAChC,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gCAA2B,GAA3B,2BAA2B,CAA6B;QACxD,gCAA2B,GAA3B,2BAA2B,CAA6B;IACxE,CAAC;IAKE,AAAN,KAAK,CAAC,OAAO,CAAU,KAAU;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;IACvE,CAAC;IAKK,AAAN,KAAK,CAAC,OAAO,CAAc,EAAU;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjD,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAS,IAAS;QAC5B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAc,EAAU,EAAU,IAAS;QACrD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAc,EAAU;QAClC,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjD,CAAC;IAKK,AAAN,KAAK,CAAC,gBAAgB,CAAc,EAAU,EAAU,IAAS;QAC/D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QACjF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAKK,AAAN,KAAK,CAAC,gBAAgB,CAAc,EAAU,EAAyB,YAAoB;QACzF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;QACjF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;CACF,CAAA;AAnEY,0CAAe;AAcpB;IAHL,IAAA,YAAG,GAAE;IACL,IAAA,kCAAW,EAAC,qCAAc,CAAC,SAAS,CAAC;IACrC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IACzB,WAAA,IAAA,cAAK,GAAE,CAAA;;;;8CAGrB;AAKK;IAHL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,kCAAW,EAAC,qCAAc,CAAC,SAAS,CAAC;IACrC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACvB,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;8CAGzB;AAKK;IAHL,IAAA,aAAI,GAAE;IACN,IAAA,kCAAW,EAAC,qCAAc,CAAC,WAAW,CAAC;IACvC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,aAAI,GAAE,CAAA;;;;6CAGnB;AAKK;IAHL,IAAA,cAAK,EAAC,KAAK,CAAC;IACZ,IAAA,kCAAW,EAAC,qCAAc,CAAC,WAAW,CAAC;IACvC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IAAc,WAAA,IAAA,aAAI,GAAE,CAAA;;;;6CAG5C;AAKK;IAHL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,kCAAW,EAAC,qCAAc,CAAC,WAAW,CAAC;IACvC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;6CAGxB;AAKK;IAHL,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,kCAAW,EAAC,qCAAc,CAAC,WAAW,CAAC;IACvC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC;IAC/B,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IAAc,WAAA,IAAA,aAAI,GAAE,CAAA;;;;uDAItD;AAKK;IAHL,IAAA,eAAM,EAAC,+BAA+B,CAAC;IACvC,IAAA,kCAAW,EAAC,qCAAc,CAAC,WAAW,CAAC;IACvC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IACjC,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IAAc,WAAA,IAAA,cAAK,EAAC,cAAc,CAAC,CAAA;;;;uDAGrE;0BAlEU,eAAe;IAH3B,IAAA,iBAAO,EAAC,OAAO,CAAC;IAChB,IAAA,mBAAU,EAAC,OAAO,CAAC;IACnB,IAAA,kBAAS,EAAC,6BAAY,EAAE,qCAAgB,EAAE,kCAAe,CAAC;qCAGrB,mCAAe;QAChB,iCAAc;QACX,uCAAiB;QACjB,uCAAiB;QACjB,uCAAiB;QACP,uDAA2B;QAC3B,uDAA2B;GARhE,eAAe,CAmE3B"}
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/controllers/users.controller.js b/dist/modules/identity/presentation/controllers/users.controller.js
new file mode 100644
index 0000000..0870038
--- /dev/null
+++ b/dist/modules/identity/presentation/controllers/users.controller.js
@@ -0,0 +1,173 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UsersController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const jwt_auth_guard_1 = require("../../../../core/auth/guards/jwt-auth.guard");
+const permission_guard_1 = require("../../../authorization/presentation/guards/permission.guard");
+const current_user_guard_1 = require("../guards/current-user.guard");
+const permission_decorator_1 = require("../../../authorization/presentation/decorators/permission.decorator");
+const permission_constants_1 = require("../../../../common/constants/permission.constants");
+const get_users_handler_1 = require("../../application/handlers/user/get-users.handler");
+const get_user_handler_1 = require("../../application/handlers/user/get-user.handler");
+const get_current_user_handler_1 = require("../../application/handlers/user/get-current-user.handler");
+const enable_user_handler_1 = require("../../application/handlers/user/enable-user.handler");
+const disable_user_handler_1 = require("../../application/handlers/user/disable-user.handler");
+const delete_user_handler_1 = require("../../application/handlers/user/delete-user.handler");
+const restore_user_handler_1 = require("../../application/handlers/user/restore-user.handler");
+const update_user_handler_1 = require("../../application/handlers/user/update-user.handler");
+let UsersController = class UsersController {
+    getUsersHandler;
+    getUserHandler;
+    getCurrentUserHandler;
+    enableUserHandler;
+    disableUserHandler;
+    deleteUserHandler;
+    restoreUserHandler;
+    updateUserHandler;
+    constructor(getUsersHandler, getUserHandler, getCurrentUserHandler, enableUserHandler, disableUserHandler, deleteUserHandler, restoreUserHandler, updateUserHandler) {
+        this.getUsersHandler = getUsersHandler;
+        this.getUserHandler = getUserHandler;
+        this.getCurrentUserHandler = getCurrentUserHandler;
+        this.enableUserHandler = enableUserHandler;
+        this.disableUserHandler = disableUserHandler;
+        this.deleteUserHandler = deleteUserHandler;
+        this.restoreUserHandler = restoreUserHandler;
+        this.updateUserHandler = updateUserHandler;
+    }
+    async findAll(query) {
+        const res = await this.getUsersHandler.execute(query);
+        return {
+            success: true,
+            data: res.data.map(u => u.toResponse ? u.toResponse() : u),
+            meta: { total: res.total },
+        };
+    }
+    async me(req) {
+        const user = await this.getCurrentUserHandler.execute(req.currentUser);
+        return { success: true, data: user.toResponse ? user.toResponse() : user, meta: {} };
+    }
+    async findOne(id) {
+        const user = await this.getUserHandler.execute(id);
+        return { success: true, data: user.toResponse ? user.toResponse() : user, meta: {} };
+    }
+    async enable(id) {
+        const updated = await this.enableUserHandler.execute(id);
+        return { success: true, data: updated.toResponse ? updated.toResponse() : updated, meta: {} };
+    }
+    async disable(id) {
+        const updated = await this.disableUserHandler.execute(id);
+        return { success: true, data: updated.toResponse ? updated.toResponse() : updated, meta: {} };
+    }
+    async update(id, body) {
+        const updated = await this.updateUserHandler.execute(id, body);
+        return { success: true, data: updated.toResponse ? updated.toResponse() : updated, meta: {} };
+    }
+    async remove(id) {
+        await this.deleteUserHandler.execute(id);
+        return { success: true, data: null, meta: {} };
+    }
+    async restore(id) {
+        const restored = await this.restoreUserHandler.execute(id);
+        return { success: true, data: restored.toResponse ? restored.toResponse() : restored, meta: {} };
+    }
+};
+exports.UsersController = UsersController;
+__decorate([
+    (0, common_1.Get)(),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.USER_READ),
+    (0, swagger_1.ApiOperation)({ summary: 'List users' }),
+    __param(0, (0, common_1.Query)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "findAll", null);
+__decorate([
+    (0, common_1.Get)('me'),
+    (0, swagger_1.ApiOperation)({ summary: 'Get current user' }),
+    __param(0, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "me", null);
+__decorate([
+    (0, common_1.Get)(':id'),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.USER_READ),
+    (0, swagger_1.ApiOperation)({ summary: 'Get user by id' }),
+    __param(0, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "findOne", null);
+__decorate([
+    (0, common_1.Patch)(':id/enable'),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.USER_UPDATE),
+    (0, swagger_1.ApiOperation)({ summary: 'Enable user' }),
+    __param(0, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "enable", null);
+__decorate([
+    (0, common_1.Patch)(':id/disable'),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.USER_UPDATE),
+    (0, swagger_1.ApiOperation)({ summary: 'Disable user' }),
+    __param(0, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "disable", null);
+__decorate([
+    (0, common_1.Patch)(':id'),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.USER_UPDATE),
+    (0, swagger_1.ApiOperation)({ summary: 'Update user profile' }),
+    __param(0, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "update", null);
+__decorate([
+    (0, common_1.Delete)(':id'),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.USER_DELETE),
+    (0, swagger_1.ApiOperation)({ summary: 'Soft delete user' }),
+    __param(0, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "remove", null);
+__decorate([
+    (0, common_1.Post)(':id/restore'),
+    (0, permission_decorator_1.Permissions)(permission_constants_1.PermissionType.USER_UPDATE),
+    (0, swagger_1.ApiOperation)({ summary: 'Restore user' }),
+    __param(0, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], UsersController.prototype, "restore", null);
+exports.UsersController = UsersController = __decorate([
+    (0, swagger_1.ApiTags)('Users'),
+    (0, common_1.Controller)('users'),
+    (0, common_1.UseGuards)(jwt_auth_guard_1.JwtAuthGuard, current_user_guard_1.CurrentUserGuard, permission_guard_1.PermissionGuard),
+    __metadata("design:paramtypes", [get_users_handler_1.GetUsersHandler,
+        get_user_handler_1.GetUserHandler,
+        get_current_user_handler_1.GetCurrentUserHandler,
+        enable_user_handler_1.EnableUserHandler,
+        disable_user_handler_1.DisableUserHandler,
+        delete_user_handler_1.DeleteUserHandler,
+        restore_user_handler_1.RestoreUserHandler,
+        update_user_handler_1.UpdateUserHandler])
+], UsersController);
+//# sourceMappingURL=users.controller.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/controllers/users.controller.js.map b/dist/modules/identity/presentation/controllers/users.controller.js.map
new file mode 100644
index 0000000..b096e72
--- /dev/null
+++ b/dist/modules/identity/presentation/controllers/users.controller.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"users.controller.js","sourceRoot":"","sources":["../../../../../src/modules/identity/presentation/controllers/users.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA0G;AAC1G,6CAAwD;AAExD,gFAA2E;AAC3E,kGAA8F;AAC9F,qEAAgE;AAChE,8GAAkG;AAClG,4FAAmF;AAEnF,yFAAoF;AACpF,uFAAkF;AAClF,uGAAiG;AACjG,6FAAwF;AACxF,+FAA0F;AAC1F,6FAAwF;AACxF,+FAA0F;AAC1F,6FAAwF;AAMjF,IAAM,eAAe,GAArB,MAAM,eAAe;IAEP;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IARnB,YACmB,eAAgC,EAChC,cAA8B,EAC9B,qBAA4C,EAC5C,iBAAoC,EACpC,kBAAsC,EACtC,iBAAoC,EACpC,kBAAsC,EACtC,iBAAoC;QAPpC,oBAAe,GAAf,eAAe,CAAiB;QAChC,mBAAc,GAAd,cAAc,CAAgB;QAC9B,0BAAqB,GAArB,qBAAqB,CAAuB;QAC5C,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAKE,AAAN,KAAK,CAAC,OAAO,CAAU,KAAU;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAEtD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAS,CAAC,UAAU,CAAC,CAAC,CAAE,CAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5E,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE;SAC3B,CAAC;IACJ,CAAC;IAIK,AAAN,KAAK,CAAC,EAAE,CAAQ,GAAQ;QACtB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAEvE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAG,IAAY,CAAC,UAAU,CAAC,CAAC,CAAE,IAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzG,CAAC;IAKK,AAAN,KAAK,CAAC,OAAO,CAAc,EAAU;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAG,IAAY,CAAC,UAAU,CAAC,CAAC,CAAE,IAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACzG,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAc,EAAU;QAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAG,OAAe,CAAC,UAAU,CAAC,CAAC,CAAE,OAAe,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAClH,CAAC;IAKK,AAAN,KAAK,CAAC,OAAO,CAAc,EAAU;QACnC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAG,OAAe,CAAC,UAAU,CAAC,CAAC,CAAE,OAAe,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAClH,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAc,EAAU,EAAU,IAAS;QACrD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAG,OAAe,CAAC,UAAU,CAAC,CAAC,CAAE,OAAe,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAClH,CAAC;IAKK,AAAN,KAAK,CAAC,MAAM,CAAc,EAAU;QAClC,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACjD,CAAC;IAKK,AAAN,KAAK,CAAC,OAAO,CAAc,EAAU;QACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAG,QAAgB,CAAC,UAAU,CAAC,CAAC,CAAE,QAAgB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACrH,CAAC;CAGF,CAAA;AAlFY,0CAAe;AAepB;IAHL,IAAA,YAAG,GAAE;IACL,IAAA,kCAAW,EAAC,qCAAc,CAAC,SAAS,CAAC;IACrC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IACzB,WAAA,IAAA,cAAK,GAAE,CAAA;;;;8CAQrB;AAIK;IAFL,IAAA,YAAG,EAAC,IAAI,CAAC;IACT,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IACpC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;yCAId;AAKK;IAHL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,kCAAW,EAAC,qCAAc,CAAC,SAAS,CAAC;IACrC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC7B,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;8CAGzB;AAKK;IAHL,IAAA,cAAK,EAAC,YAAY,CAAC;IACnB,IAAA,kCAAW,EAAC,qCAAc,CAAC,WAAW,CAAC;IACvC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;6CAGxB;AAKK;IAHL,IAAA,cAAK,EAAC,aAAa,CAAC;IACpB,IAAA,kCAAW,EAAC,qCAAc,CAAC,WAAW,CAAC;IACvC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC3B,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;8CAGzB;AAKK;IAHL,IAAA,cAAK,EAAC,KAAK,CAAC;IACZ,IAAA,kCAAW,EAAC,qCAAc,CAAC,WAAW,CAAC;IACvC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACnC,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IAAc,WAAA,IAAA,aAAI,GAAE,CAAA;;;;6CAG5C;AAKK;IAHL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,kCAAW,EAAC,qCAAc,CAAC,WAAW,CAAC;IACvC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAChC,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;6CAGxB;AAKK;IAHL,IAAA,aAAI,EAAC,aAAa,CAAC;IACnB,IAAA,kCAAW,EAAC,qCAAc,CAAC,WAAW,CAAC;IACvC,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC3B,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;8CAGzB;0BA/EU,eAAe;IAH3B,IAAA,iBAAO,EAAC,OAAO,CAAC;IAChB,IAAA,mBAAU,EAAC,OAAO,CAAC;IACnB,IAAA,kBAAS,EAAC,6BAAY,EAAE,qCAAgB,EAAE,kCAAe,CAAC;qCAGrB,mCAAe;QAChB,iCAAc;QACP,gDAAqB;QACzB,uCAAiB;QAChB,yCAAkB;QACnB,uCAAiB;QAChB,yCAAkB;QACnB,uCAAiB;GAT5C,eAAe,CAkF3B"}
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/dto/create-permission.dto.js b/dist/modules/identity/presentation/dto/create-permission.dto.js
new file mode 100644
index 0000000..00c6af3
--- /dev/null
+++ b/dist/modules/identity/presentation/dto/create-permission.dto.js
@@ -0,0 +1,39 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreatePermissionDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+class CreatePermissionDto {
+    code;
+    name;
+    description;
+}
+exports.CreatePermissionDto = CreatePermissionDto;
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreatePermissionDto.prototype, "code", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreatePermissionDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ required: false }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], CreatePermissionDto.prototype, "description", void 0);
+//# sourceMappingURL=create-permission.dto.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/dto/create-permission.dto.js.map b/dist/modules/identity/presentation/dto/create-permission.dto.js.map
new file mode 100644
index 0000000..f4bd483
--- /dev/null
+++ b/dist/modules/identity/presentation/dto/create-permission.dto.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"create-permission.dto.js","sourceRoot":"","sources":["../../../../../src/modules/identity/presentation/dto/create-permission.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,qDAAmE;AAEnE,MAAa,mBAAmB;IAI9B,IAAI,CAAU;IAKd,IAAI,CAAU;IAKd,WAAW,CAAU;CACtB;AAfD,kDAeC;AAXC;IAHC,IAAA,qBAAW,GAAE;IACb,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;iDACC;AAKd;IAHC,IAAA,qBAAW,GAAE;IACb,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;iDACC;AAKd;IAHC,IAAA,qBAAW,EAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;wDACU"}
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/dto/create-role.dto.js b/dist/modules/identity/presentation/dto/create-role.dto.js
new file mode 100644
index 0000000..5636063
--- /dev/null
+++ b/dist/modules/identity/presentation/dto/create-role.dto.js
@@ -0,0 +1,45 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateRoleDto = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+class CreateRoleDto {
+    code;
+    name;
+    description;
+    isDefault;
+}
+exports.CreateRoleDto = CreateRoleDto;
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateRoleDto.prototype, "code", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateRoleDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ required: false }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], CreateRoleDto.prototype, "description", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ required: false }),
+    (0, class_validator_1.IsOptional)(),
+    __metadata("design:type", Boolean)
+], CreateRoleDto.prototype, "isDefault", void 0);
+//# sourceMappingURL=create-role.dto.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/dto/create-role.dto.js.map b/dist/modules/identity/presentation/dto/create-role.dto.js.map
new file mode 100644
index 0000000..142f10b
--- /dev/null
+++ b/dist/modules/identity/presentation/dto/create-role.dto.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"create-role.dto.js","sourceRoot":"","sources":["../../../../../src/modules/identity/presentation/dto/create-role.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,qDAAmE;AAEnE,MAAa,aAAa;IAIxB,IAAI,CAAU;IAKd,IAAI,CAAU;IAKd,WAAW,CAAU;IAIrB,SAAS,CAAW;CACrB;AAnBD,sCAmBC;AAfC;IAHC,IAAA,qBAAW,GAAE;IACb,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;2CACC;AAKd;IAHC,IAAA,qBAAW,GAAE;IACb,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;2CACC;AAKd;IAHC,IAAA,qBAAW,EAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;kDACU;AAIrB;IAFC,IAAA,qBAAW,EAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChC,IAAA,4BAAU,GAAE;;gDACO"}
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/dto/create-user.dto.js b/dist/modules/identity/presentation/dto/create-user.dto.js
new file mode 100644
index 0000000..fd68ca9
--- /dev/null
+++ b/dist/modules/identity/presentation/dto/create-user.dto.js
@@ -0,0 +1,54 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateUserDto = void 0;
+const class_validator_1 = require("class-validator");
+const swagger_1 = require("@nestjs/swagger");
+class CreateUserDto {
+    username;
+    email;
+    password;
+    storageQuota;
+    storageUsed;
+}
+exports.CreateUserDto = CreateUserDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'John Doe' }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], CreateUserDto.prototype, "username", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'user@example.com' }),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], CreateUserDto.prototype, "email", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'strongpassword' }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Length)(8, 128),
+    __metadata("design:type", String)
+], CreateUserDto.prototype, "password", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ example: 10737418240 }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(0),
+    __metadata("design:type", Number)
+], CreateUserDto.prototype, "storageQuota", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ example: 0 }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(0),
+    __metadata("design:type", Number)
+], CreateUserDto.prototype, "storageUsed", void 0);
+//# sourceMappingURL=create-user.dto.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/dto/create-user.dto.js.map b/dist/modules/identity/presentation/dto/create-user.dto.js.map
new file mode 100644
index 0000000..437e888
--- /dev/null
+++ b/dist/modules/identity/presentation/dto/create-user.dto.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"create-user.dto.js","sourceRoot":"","sources":["../../../../../src/modules/identity/presentation/dto/create-user.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAgG;AAChG,6CAAmE;AAEnE,MAAa,aAAa;IAIxB,QAAQ,CAAU;IAIlB,KAAK,CAAU;IAKf,QAAQ,CAAU;IAMlB,YAAY,CAAU;IAMtB,WAAW,CAAU;CACtB;AA1BD,sCA0BC;AAtBC;IAHC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACpC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+CACK;AAIlB;IAFC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC5C,IAAA,yBAAO,GAAE;;4CACK;AAKf;IAHC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC1C,IAAA,0BAAQ,GAAE;IACV,IAAA,wBAAM,EAAC,CAAC,EAAE,GAAG,CAAC;;+CACG;AAMlB;IAJC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC7C,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,GAAE;IACP,IAAA,qBAAG,EAAC,CAAC,CAAC;;mDACe;AAMtB;IAJC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACnC,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,GAAE;IACP,IAAA,qBAAG,EAAC,CAAC,CAAC;;kDACc"}
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/dto/update-permission.dto.js b/dist/modules/identity/presentation/dto/update-permission.dto.js
new file mode 100644
index 0000000..4327f0c
--- /dev/null
+++ b/dist/modules/identity/presentation/dto/update-permission.dto.js
@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdatePermissionDto = void 0;
+const mapped_types_1 = require("@nestjs/mapped-types");
+const create_permission_dto_1 = require("./create-permission.dto");
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+class UpdatePermissionDto extends (0, mapped_types_1.PartialType)(create_permission_dto_1.CreatePermissionDto) {
+    name;
+    description;
+    code;
+}
+exports.UpdatePermissionDto = UpdatePermissionDto;
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], UpdatePermissionDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], UpdatePermissionDto.prototype, "description", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], UpdatePermissionDto.prototype, "code", void 0);
+//# sourceMappingURL=update-permission.dto.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/dto/update-permission.dto.js.map b/dist/modules/identity/presentation/dto/update-permission.dto.js.map
new file mode 100644
index 0000000..9b4514d
--- /dev/null
+++ b/dist/modules/identity/presentation/dto/update-permission.dto.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"update-permission.dto.js","sourceRoot":"","sources":["../../../../../src/modules/identity/presentation/dto/update-permission.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,uDAAmD;AACnD,mEAA8D;AAC9D,6CAAsD;AACtD,qDAAuD;AAEvD,MAAa,mBAAoB,SAAQ,IAAA,0BAAW,EAAC,2CAAmB,CAAC;IAIvE,IAAI,CAAU;IAKd,WAAW,CAAU;IAKrB,IAAI,CAAU;CACf;AAfD,kDAeC;AAXC;IAHC,IAAA,6BAAmB,GAAE;IACrB,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;iDACG;AAKd;IAHC,IAAA,6BAAmB,GAAE;IACrB,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;wDACU;AAKrB;IAHC,IAAA,6BAAmB,GAAE;IACrB,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;iDACG"}
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/dto/update-role.dto.js b/dist/modules/identity/presentation/dto/update-role.dto.js
new file mode 100644
index 0000000..b02841b
--- /dev/null
+++ b/dist/modules/identity/presentation/dto/update-role.dto.js
@@ -0,0 +1,40 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateRoleDto = void 0;
+const mapped_types_1 = require("@nestjs/mapped-types");
+const create_role_dto_1 = require("./create-role.dto");
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+class UpdateRoleDto extends (0, mapped_types_1.PartialType)(create_role_dto_1.CreateRoleDto) {
+    name;
+    description;
+    isDefault;
+}
+exports.UpdateRoleDto = UpdateRoleDto;
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], UpdateRoleDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], UpdateRoleDto.prototype, "description", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    __metadata("design:type", Boolean)
+], UpdateRoleDto.prototype, "isDefault", void 0);
+//# sourceMappingURL=update-role.dto.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/dto/update-role.dto.js.map b/dist/modules/identity/presentation/dto/update-role.dto.js.map
new file mode 100644
index 0000000..a4905b2
--- /dev/null
+++ b/dist/modules/identity/presentation/dto/update-role.dto.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"update-role.dto.js","sourceRoot":"","sources":["../../../../../src/modules/identity/presentation/dto/update-role.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,uDAAmD;AACnD,uDAAkD;AAClD,6CAAsD;AACtD,qDAAuD;AAEvD,MAAa,aAAc,SAAQ,IAAA,0BAAW,EAAC,+BAAa,CAAC;IAI3D,IAAI,CAAU;IAKd,WAAW,CAAU;IAIrB,SAAS,CAAW;CACrB;AAdD,sCAcC;AAVC;IAHC,IAAA,6BAAmB,GAAE;IACrB,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;2CACG;AAKd;IAHC,IAAA,6BAAmB,GAAE;IACrB,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;kDACU;AAIrB;IAFC,IAAA,6BAAmB,GAAE;IACrB,IAAA,4BAAU,GAAE;;gDACO"}
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/dto/update-user.dto.js b/dist/modules/identity/presentation/dto/update-user.dto.js
new file mode 100644
index 0000000..ada8a2b
--- /dev/null
+++ b/dist/modules/identity/presentation/dto/update-user.dto.js
@@ -0,0 +1,63 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateUserDto = void 0;
+const mapped_types_1 = require("@nestjs/mapped-types");
+const create_user_dto_1 = require("./create-user.dto");
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+class UpdateUserDto extends (0, mapped_types_1.PartialType)(create_user_dto_1.CreateUserDto) {
+    name;
+    email;
+    password;
+    metadata;
+    storageQuota;
+    storageUsed;
+}
+exports.UpdateUserDto = UpdateUserDto;
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], UpdateUserDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsEmail)(),
+    __metadata("design:type", String)
+], UpdateUserDto.prototype, "email", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.Length)(8, 128),
+    __metadata("design:type", String)
+], UpdateUserDto.prototype, "password", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    __metadata("design:type", Object)
+], UpdateUserDto.prototype, "metadata", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ example: 10737418240 }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(0),
+    __metadata("design:type", Number)
+], UpdateUserDto.prototype, "storageQuota", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ example: 0 }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.Min)(0),
+    __metadata("design:type", Number)
+], UpdateUserDto.prototype, "storageUsed", void 0);
+//# sourceMappingURL=update-user.dto.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/dto/update-user.dto.js.map b/dist/modules/identity/presentation/dto/update-user.dto.js.map
new file mode 100644
index 0000000..32d013b
--- /dev/null
+++ b/dist/modules/identity/presentation/dto/update-user.dto.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"update-user.dto.js","sourceRoot":"","sources":["../../../../../src/modules/identity/presentation/dto/update-user.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,uDAAmD;AACnD,uDAAkD;AAClD,6CAAsD;AACtD,qDAAoF;AAEpF,MAAa,aAAc,SAAQ,IAAA,0BAAW,EAAC,+BAAa,CAAC;IAI3D,IAAI,CAAU;IAKd,KAAK,CAAU;IAKf,QAAQ,CAAU;IAIlB,QAAQ,CAAuB;IAM/B,YAAY,CAAU;IAMtB,WAAW,CAAU;CACtB;AA/BD,sCA+BC;AA3BC;IAHC,IAAA,6BAAmB,GAAE;IACrB,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;2CACG;AAKd;IAHC,IAAA,6BAAmB,GAAE;IACrB,IAAA,4BAAU,GAAE;IACZ,IAAA,yBAAO,GAAE;;4CACK;AAKf;IAHC,IAAA,6BAAmB,GAAE;IACrB,IAAA,4BAAU,GAAE;IACZ,IAAA,wBAAM,EAAC,CAAC,EAAE,GAAG,CAAC;;+CACG;AAIlB;IAFC,IAAA,6BAAmB,GAAE;IACrB,IAAA,4BAAU,GAAE;;+CACkB;AAM/B;IAJC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC7C,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,GAAE;IACP,IAAA,qBAAG,EAAC,CAAC,CAAC;;mDACe;AAMtB;IAJC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACnC,IAAA,4BAAU,GAAE;IACZ,IAAA,uBAAK,GAAE;IACP,IAAA,qBAAG,EAAC,CAAC,CAAC;;kDACc"}
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/guards/current-user.guard.js b/dist/modules/identity/presentation/guards/current-user.guard.js
new file mode 100644
index 0000000..7d1bc03
--- /dev/null
+++ b/dist/modules/identity/presentation/guards/current-user.guard.js
@@ -0,0 +1,44 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CurrentUserGuard = void 0;
+const common_1 = require("@nestjs/common");
+const sync_identity_handler_1 = require("../../application/handlers/user/sync-identity.handler");
+let CurrentUserGuard = class CurrentUserGuard {
+    syncIdentityHandler;
+    constructor(syncIdentityHandler) {
+        this.syncIdentityHandler = syncIdentityHandler;
+    }
+    async canActivate(context) {
+        const request = context.switchToHttp().getRequest();
+        // Prefer RequestContext produced by AuthenticationService
+        const ctx = request.raylabContext;
+        if (ctx && ctx.user) {
+            request.currentUser = ctx.user;
+            return true;
+        }
+        // Fallback to legacy identity if present
+        const identity = request.identity;
+        if (!identity) {
+            throw new common_1.UnauthorizedException('Identity is missing.');
+        }
+        const user = await this.syncIdentityHandler.execute(identity);
+        // attach domain user as currentUser
+        request.currentUser = user;
+        return true;
+    }
+};
+exports.CurrentUserGuard = CurrentUserGuard;
+exports.CurrentUserGuard = CurrentUserGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [sync_identity_handler_1.SyncIdentityHandler])
+], CurrentUserGuard);
+//# sourceMappingURL=current-user.guard.js.map
\ No newline at end of file
diff --git a/dist/modules/identity/presentation/guards/current-user.guard.js.map b/dist/modules/identity/presentation/guards/current-user.guard.js.map
new file mode 100644
index 0000000..d22bdf2
--- /dev/null
+++ b/dist/modules/identity/presentation/guards/current-user.guard.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"current-user.guard.js","sourceRoot":"","sources":["../../../../../src/modules/identity/presentation/guards/current-user.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAkG;AAClG,iGAA4F;AAIrF,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAER;IADnB,YACmB,mBAAwC;QAAxC,wBAAmB,GAAnB,mBAAmB,CAAqB;IACxD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAS,CAAC;QAE3D,0DAA0D;QAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,aAAoB,CAAC;QACzC,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,CAAC,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yCAAyC;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAoC,CAAC;QAE9D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,8BAAqB,CAAC,sBAAsB,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE9D,oCAAoC;QACpC,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;QAE3B,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA7BY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAG6B,2CAAmB;GAFhD,gBAAgB,CA6B5B"}
\ No newline at end of file
diff --git a/dist/shared/cache-keys.js b/dist/shared/cache-keys.js
new file mode 100644
index 0000000..d4ddb65
--- /dev/null
+++ b/dist/shared/cache-keys.js
@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CacheKeys = void 0;
+exports.CacheKeys = {
+    permission: (userId) => `permissions:${userId}`,
+};
+//# sourceMappingURL=cache-keys.js.map
\ No newline at end of file
diff --git a/dist/shared/cache-keys.js.map b/dist/shared/cache-keys.js.map
new file mode 100644
index 0000000..2d423a2
--- /dev/null
+++ b/dist/shared/cache-keys.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"cache-keys.js","sourceRoot":"","sources":["../../src/shared/cache-keys.ts"],"names":[],"mappings":";;;AAAa,QAAA,SAAS,GAAG;IACvB,UAAU,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,eAAe,MAAM,EAAE;CACxD,CAAC"}
\ No newline at end of file
diff --git a/dist/shared/prisma.service.js b/dist/shared/prisma.service.js
new file mode 100644
index 0000000..a5f7bec
--- /dev/null
+++ b/dist/shared/prisma.service.js
@@ -0,0 +1,24 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PrismaService = void 0;
+const common_1 = require("@nestjs/common");
+const client_1 = require("@prisma/client");
+let PrismaService = class PrismaService extends client_1.PrismaClient {
+    async onModuleInit() {
+        await this.$connect();
+    }
+    async onModuleDestroy() {
+        await this.$disconnect();
+    }
+};
+exports.PrismaService = PrismaService;
+exports.PrismaService = PrismaService = __decorate([
+    (0, common_1.Injectable)()
+], PrismaService);
+//# sourceMappingURL=prisma.service.js.map
\ No newline at end of file
diff --git a/dist/shared/prisma.service.js.map b/dist/shared/prisma.service.js.map
new file mode 100644
index 0000000..0776229
--- /dev/null
+++ b/dist/shared/prisma.service.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"prisma.service.js","sourceRoot":"","sources":["../../src/shared/prisma.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA2E;AAC3E,2CAA8C;AAGvC,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,qBAAY;IAC7C,KAAK,CAAC,YAAY;QAChB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AARY,sCAAa;wBAAb,aAAa;IADzB,IAAA,mBAAU,GAAE;GACA,aAAa,CAQzB"}
\ No newline at end of file
diff --git a/dist/shared/redis.service.js b/dist/shared/redis.service.js
new file mode 100644
index 0000000..0567a3a
--- /dev/null
+++ b/dist/shared/redis.service.js
@@ -0,0 +1,121 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+var RedisService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RedisService = void 0;
+const common_1 = require("@nestjs/common");
+const ioredis_1 = __importDefault(require("ioredis"));
+let RedisService = RedisService_1 = class RedisService {
+    // Keep client typed as any to avoid tight coupling to ioredis types in tests
+    client = null;
+    logger = new common_1.Logger(RedisService_1.name);
+    lastLogAt = 0;
+    LOG_THROTTLE_MS = 5000; // throttle repeated error logs
+    onModuleInit() {
+        const enabled = (process.env.REDIS_ENABLED || 'true').toLowerCase() === 'true';
+        if (!enabled) {
+            this.logger.log('Redis disabled via REDIS_ENABLED=false');
+            return;
+        }
+        const url = process.env.REDIS_URL || 'redis://localhost:6379';
+        // Use lazyConnect so application can start even if Redis is unavailable temporarily
+        this.client = new ioredis_1.default(url, {
+            lazyConnect: true,
+            // limit retries to avoid infinite reconnect storms
+            maxRetriesPerRequest: 5,
+            // automatic reconnection strategy
+            reconnectOnError: (err) => {
+                return true;
+            },
+            enableOfflineQueue: true,
+            // optional reconnect strategy
+            retryStrategy: (times) => {
+                // exponential backoff capped at 5s
+                const delay = Math.min(50 * Math.pow(2, times), 5000);
+                return delay;
+            },
+        });
+        this.client.on('connect', () => this.logger.log('Connected to Redis'));
+        this.client.on('ready', () => this.logger.log('Redis ready'));
+        this.client.on('error', (err) => this.handleError(err));
+        this.client.on('close', () => this.logger.warn('Redis connection closed'));
+        this.client.on('reconnecting', () => this.logger.log('Redis reconnecting'));
+        // attempt to connect but do not throw if it fails
+        this.client.connect().catch((err) => {
+            this.handleError(err);
+        });
+    }
+    handleError(err) {
+        const now = Date.now();
+        if (now - this.lastLogAt > this.LOG_THROTTLE_MS) {
+            this.logger.error('Redis error', err instanceof Error ? err.message : err);
+            this.lastLogAt = now;
+        }
+    }
+    onModuleDestroy() {
+        if (this.client) {
+            try {
+                this.client.disconnect();
+            }
+            catch (e) {
+                // ignore
+            }
+        }
+    }
+    getClient() {
+        return this.client;
+    }
+    ensureClient() {
+        // returns true if client is connected/usable
+        return this.client && this.client.status && this.client.status !== 'end' && this.client.status !== 'close';
+    }
+    async get(key) {
+        if (!this.ensureClient())
+            return null;
+        try {
+            return await this.client.get(key);
+        }
+        catch (e) {
+            this.handleError(e);
+            return null;
+        }
+    }
+    async set(key, value, ttlSeconds) {
+        if (!this.ensureClient())
+            return;
+        try {
+            if (ttlSeconds) {
+                await this.client.set(key, value, 'EX', ttlSeconds);
+            }
+            else {
+                await this.client.set(key, value);
+            }
+        }
+        catch (e) {
+            this.handleError(e);
+        }
+    }
+    async del(key) {
+        if (!this.ensureClient())
+            return;
+        try {
+            await this.client.del(key);
+        }
+        catch (e) {
+            this.handleError(e);
+        }
+    }
+};
+exports.RedisService = RedisService;
+exports.RedisService = RedisService = RedisService_1 = __decorate([
+    (0, common_1.Injectable)()
+], RedisService);
+//# sourceMappingURL=redis.service.js.map
\ No newline at end of file
diff --git a/dist/shared/redis.service.js.map b/dist/shared/redis.service.js.map
new file mode 100644
index 0000000..c3ef62d
--- /dev/null
+++ b/dist/shared/redis.service.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"redis.service.js","sourceRoot":"","sources":["../../src/shared/redis.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAmF;AACnF,sDAA8B;AAGvB,IAAM,YAAY,oBAAlB,MAAM,YAAY;IACvB,6EAA6E;IACrE,MAAM,GAAQ,IAAI,CAAC;IACV,MAAM,GAAG,IAAI,eAAM,CAAC,cAAY,CAAC,IAAI,CAAC,CAAC;IAChD,SAAS,GAAG,CAAC,CAAC;IACL,eAAe,GAAG,IAAI,CAAC,CAAC,+BAA+B;IAExE,YAAY;QACV,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;QAC/E,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,wBAAwB,CAAC;QAE9D,oFAAoF;QACpF,IAAI,CAAC,MAAM,GAAG,IAAI,iBAAO,CAAC,GAAG,EAAE;YAC7B,WAAW,EAAE,IAAI;YACjB,mDAAmD;YACnD,oBAAoB,EAAE,CAAC;YACvB,kCAAkC;YAClC,gBAAgB,EAAE,CAAC,GAAQ,EAAE,EAAE;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,kBAAkB,EAAE,IAAI;YACxB,8BAA8B;YAC9B,aAAa,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,mCAAmC;gBACnC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;gBACtD,OAAO,KAAK,CAAC;YACf,CAAC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC;QAE5E,kDAAkD;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAQ,EAAE,EAAE;YACvC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,WAAW,CAAC,GAAQ;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3E,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC;QACvB,CAAC;IACH,CAAC;IAED,eAAe;QACb,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YAC3B,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAEO,YAAY;QAClB,6CAA6C;QAC7C,OAAO,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC;IAC7G,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,UAAmB;QACvD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO;QACjC,IAAI,CAAC;YACH,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;YACtD,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YAAE,OAAO;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF,CAAA;AAxGY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,mBAAU,GAAE;GACA,YAAY,CAwGxB"}
\ No newline at end of file
diff --git a/dist/shared/types/request-context.js b/dist/shared/types/request-context.js
new file mode 100644
index 0000000..8a495a4
--- /dev/null
+++ b/dist/shared/types/request-context.js
@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=request-context.js.map
\ No newline at end of file
diff --git a/dist/shared/types/request-context.js.map b/dist/shared/types/request-context.js.map
new file mode 100644
index 0000000..31d227a
--- /dev/null
+++ b/dist/shared/types/request-context.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../../../src/shared/types/request-context.ts"],"names":[],"mappings":""}
\ No newline at end of file
diff --git a/dist/shared/utils/index.js b/dist/shared/utils/index.js
new file mode 100644
index 0000000..0dc1a78
--- /dev/null
+++ b/dist/shared/utils/index.js
@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noop = noop;
+function noop() { }
+//# sourceMappingURL=index.js.map
\ No newline at end of file
diff --git a/dist/shared/utils/index.js.map b/dist/shared/utils/index.js.map
new file mode 100644
index 0000000..a39412e
--- /dev/null
+++ b/dist/shared/utils/index.js.map
@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/shared/utils/index.ts"],"names":[],"mappings":";;AAAA,oBAAyB;AAAzB,SAAgB,IAAI,KAAI,CAAC"}
\ No newline at end of file
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
index 0672dc1..491d146 100644
--- a/prisma/schema.prisma
+++ b/prisma/schema.prisma
@@ -11,28 +11,29 @@ datasource db {
 }
 
 model User {
-  id               String        @id @default(uuid()) @db.Uuid
-  authentikId      String?       @unique
-  authentikUserId  String?       @unique
-  authentikSubject String?       @unique
-  username         String?       @unique @db.VarChar(255)
-  email            String?       @unique @db.VarChar(320)
-  name             String?       @db.VarChar(255)
+  id               String           @id @default(uuid()) @db.Uuid
+  authentikId      String?          @unique
+  authentikUserId  String?          @unique
+  authentikSubject String?          @unique
+  username         String?          @unique @db.VarChar(255)
+  email            String?          @unique @db.VarChar(320)
+  name             String?          @db.VarChar(255)
   picture          String?
-  isActive         Boolean       @default(true)
+  isActive         Boolean          @default(true)
   deletedAt        DateTime?
   lastSeenAt       DateTime?
   lastSyncedAt     DateTime?
   syncStatus       String?
-  storageQuota     BigInt?       @default(10737418240)
-  storageUsed      BigInt?       @default(0)
+  storageQuota     BigInt?          @default(10737418240)
+  storageUsed      BigInt?          @default(0)
   metadata         Json?
-  userRoles        UserRole[]
+  roles            UserRole[]
+  permissions      UserPermission[]
   auditLogs        AuditLog[]
   mediaObjects     MediaObject[]
-  lastGroupHash    String?       @db.Text
-  createdAt        DateTime      @default(now())
-  updatedAt        DateTime      @updatedAt
+  lastGroupHash    String?          @db.Text
+  createdAt        DateTime         @default(now())
+  updatedAt        DateTime         @updatedAt
 
   @@index([authentikId])
   @@index([username])
@@ -40,17 +41,17 @@ model User {
 }
 
 model Role {
-  id              String                 @id @default(uuid()) @db.Uuid
-  code            String                 @unique @db.VarChar(100)
-  name            String                 @db.VarChar(255)
-  displayName     String?                @db.VarChar(255)
-  description     String?
-  isDefault       Boolean                @default(false)
-  rolePermissions RolePermission[]
-  userRoles       UserRole[]
-  mappings        AuthGroupRoleMapping[]
-  createdAt       DateTime               @default(now())
-  updatedAt       DateTime               @updatedAt
+  id          String                 @id @default(uuid()) @db.Uuid
+  code        String                 @unique @db.VarChar(100)
+  name        String                 @db.VarChar(255)
+  displayName String?                @db.VarChar(255)
+  description String?
+  isDefault   Boolean                @default(false)
+  permissions RolePermission[]
+  userRoles   UserRole[]
+  mappings    AuthGroupRoleMapping[]
+  createdAt   DateTime               @default(now())
+  updatedAt   DateTime               @updatedAt
 }
 
 model Permission {
@@ -62,6 +63,7 @@ model Permission {
   rolePermissions RolePermission[]
   createdAt       DateTime         @default(now())
   updatedAt       DateTime         @updatedAt
+  UserPermission  UserPermission[]
 }
 
 model RolePermission {
@@ -77,6 +79,20 @@ model RolePermission {
   @@index([permissionId])
 }
 
+model UserPermission {
+  id           String     @id @default(uuid()) @db.Uuid
+  user         User       @relation(fields: [userId], references: [id], onDelete: Cascade)
+  userId       String     @db.Uuid
+  permission   Permission @relation(fields: [permissionId], references: [id], onDelete: Cascade)
+  permissionId String     @db.Uuid
+  assignedBy   String?    @db.VarChar(100)
+  createdAt    DateTime   @default(now())
+
+  @@unique([userId, permissionId])
+  @@index([userId])
+  @@index([permissionId])
+}
+
 enum UserRoleSource {
   AUTHENTIK
   SYSTEM
diff --git a/src/modules/auth/auth.service.ts b/src/modules/auth/auth.service.ts
index f488309..acea84b 100644
--- a/src/modules/auth/auth.service.ts
+++ b/src/modules/auth/auth.service.ts
@@ -7,7 +7,7 @@ import { PrismaService } from '../../shared/prisma.service';
 import { RedisPkceStore } from './pkce/redis-pkce.store';
 import { InMemoryRefreshStore } from './refresh/inmemory-refresh.store';
 
-import { Issuer, generators, TokenSet } from 'openid-client';
+const openidClient: any = require('openid-client');
 
 @Injectable()
 export class AuthService {
@@ -28,7 +28,7 @@ export class AuthService {
     if (this.issuer) return this.issuer;
     const issuerUrl = this.config.get<string>('AUTHENTIK_ISSUER');
     if (!issuerUrl) throw new Error('AUTHENTIK_ISSUER not configured');
-    this.issuer = await Issuer.discover(issuerUrl);
+    this.issuer = await openidClient.Issuer.discover(issuerUrl);
     return this.issuer;
   }
 
@@ -47,9 +47,9 @@ export class AuthService {
     const redirectUri = this.config.get<string>('AUTH_CALLBACK_URL') || `${this.config.get('APP_URL') || ''}/auth/callback`;
 
     const state = require('crypto').randomUUID();
-    const code_verifier = generators.codeVerifier();
-    const code_challenge = await generators.codeChallenge(code_verifier);
-    const nonce = generators.nonce();
+    const code_verifier = openidClient.generators.codeVerifier();
+    const code_challenge = await openidClient.generators.codeChallenge(code_verifier);
+    const nonce = openidClient.generators.nonce();
 
     await this.pkceStore.save(state, { code_verifier, nonce, returnTo }, 300);
 
@@ -77,7 +77,7 @@ export class AuthService {
     const redirectUri = this.config.get<string>('AUTH_CALLBACK_URL') || `${this.config.get('APP_URL') || ''}/auth/callback`;
 
     // exchange code
-    const tokenSet: TokenSet = await client.callback(redirectUri, { code, state }, { code_verifier: pkce.code_verifier, nonce: pkce.nonce });
+    const tokenSet: any = await client.callback(redirectUri, { code, state }, { code_verifier: pkce.code_verifier, nonce: pkce.nonce });
 
     // verify id_token and get claims
     const claims = tokenSet.claims();
@@ -144,7 +144,7 @@ export class AuthService {
 
     const userId = data.userId;
     // load user
-    const domainUser = await this.userRepository.findById(userId);
+    const domainUser = await this.userRepository.getById(userId);
     if (!domainUser) throw new UnauthorizedException('User not found');
     if (!domainUser.isActive) throw new UnauthorizedException('User is not active');
 
@@ -183,7 +183,7 @@ export class AuthService {
     if (!token) throw new UnauthorizedException('Missing token');
     try {
       const payload: any = this.jwtService.verify(token);
-      const user = await this.userRepository.findById(payload.sub);
+      const user = await this.userRepository.getById(payload.sub);
       if (!user) throw new UnauthorizedException('User not found');
       return { id: user.id, username: user.username, email: user.email, roles: user.roles || [] };
     } catch (e) {
diff --git a/src/modules/identity/infrastructure/mappers/prisma-role.mapper.ts b/src/modules/identity/infrastructure/mappers/prisma-role.mapper.ts
index 133431d..71ecf55 100644
--- a/src/modules/identity/infrastructure/mappers/prisma-role.mapper.ts
+++ b/src/modules/identity/infrastructure/mappers/prisma-role.mapper.ts
@@ -3,15 +3,16 @@ import { PermissionData } from '../../domain/entities/permission.entity';
 
 export class PrismaRoleMapper {
   static toDomain(model: any): RoleData {
-    const permissions: PermissionData[] = (model.permissions || []).map((p: any) =>
-      PermissionData.restore({
-        id: p.id,
-        name: p.name,
-        description: p.description,
-        createdAt: p.createdAt,
-        updatedAt: p.updatedAt,
-      }),
-    );
+    const permissions: PermissionData[] = (model.permissions || []).map((p: any) => {
+      const perm = p.permission || p; // p may be RolePermission with nested permission or permission itself
+      return PermissionData.restore({
+        id: perm.id,
+        name: perm.name,
+        description: perm.description,
+        createdAt: perm.createdAt,
+        updatedAt: perm.updatedAt,
+      });
+    });
 
     return RoleData.restore({
       id: model.id,
diff --git a/src/modules/identity/infrastructure/repositories/prisma-role.repository.ts b/src/modules/identity/infrastructure/repositories/prisma-role.repository.ts
index 038fa3f..8d0f28e 100644
--- a/src/modules/identity/infrastructure/repositories/prisma-role.repository.ts
+++ b/src/modules/identity/infrastructure/repositories/prisma-role.repository.ts
@@ -11,7 +11,7 @@ export class PrismaRoleRepository implements IRole {
   async getDefaultRole() {
     const role = await this.prisma.role.findFirst({
       where: { isDefault: true },
-      include: { permissions: true },
+      include: { permissions: { include: { permission: true } } },
     });
 
     if (!role) return null;
@@ -22,7 +22,7 @@ export class PrismaRoleRepository implements IRole {
   async findById(roleId: string) {
     const role = await this.prisma.role.findUnique({
       where: { id: roleId },
-      include: { permissions: true },
+      include: { permissions: { include: { permission: true } } },
     });
 
     if (!role) throw new Error('Role not found.');
@@ -45,7 +45,7 @@ export class PrismaRoleRepository implements IRole {
 
     const [total, items] = await Promise.all([
       this.prisma.role.count({ where }),
-      this.prisma.role.findMany({ where, skip: (page - 1) * limit, take: limit, orderBy: { createdAt: 'desc' }, include: { permissions: true } }),
+      this.prisma.role.findMany({ where, skip: (page - 1) * limit, take: limit, orderBy: { createdAt: 'desc' }, include: { permissions: { include: { permission: true } } } }),
     ]);
 
     return { data: items.map(i => PrismaRoleMapper.toDomain(i)!), total };
@@ -66,7 +66,7 @@ export class PrismaRoleRepository implements IRole {
       };
     }
 
-    const created = await this.prisma.role.create({ data: base, include: { permissions: true } });
+    const created = await this.prisma.role.create({ data: base, include: { permissions: { include: { permission: true } } } });
     return PrismaRoleMapper.toDomain(created)!;
   }
 
@@ -99,7 +99,7 @@ export class PrismaRoleRepository implements IRole {
       await prisma.role.update({ where: { id: role.id }, data: base });
     });
 
-    const updated = await this.prisma.role.findUnique({ where: { id: role.id }, include: { permissions: true } });
+    const updated = await this.prisma.role.findUnique({ where: { id: role.id }, include: { permissions: { include: { permission: true } } } });
     return PrismaRoleMapper.toDomain(updated)!;
   }