configer the stamp

apps/edr-freight-api/src/modules/backoffice/backoffice.service.ts

@@ -59,6 +59,30 @@ export class BackofficeService {
     ];
   }
 
+  /**
+   * IAM user ids of current employees (any org) holding ANY of the given
+   * permission keys — used by the notification recipients resolver's
+   * `permissionKeys` selector for department/role-scoped targeting.
+   */
+  async getEmployeeUserIdsByPermission(
+    permissionKeys: string[],
+  ): Promise<string[]> {
+    if (!permissionKeys.length) return [];
+    const rows: { userId: string | null }[] = await this.employeeRepository
+      .createQueryBuilder("employee")
+      .innerJoin("employee.employeePositions", "employeePosition")
+      .innerJoin("employeePosition.position", "position")
+      .innerJoin("position.positionPermission", "positionPermission")
+      .innerJoin("positionPermission.permission", "permission")
+      .where("employee.isCurrent = :isCurrent", { isCurrent: true })
+      .andWhere("permission.key IN (:...permissionKeys)", { permissionKeys })
+      .select("DISTINCT employee.user_id", "userId")
+      .getRawMany();
+    return rows
+      .map((r) => r.userId)
+      .filter((id): id is string => Boolean(id));
+  }
+
   async createOrganizationUser(
     organizationId: string,
     dto: CreateOrganizationUserDto,

apps/edr-freight-api/src/modules/notification-inbox/notification-recipients.service.ts

@@ -13,9 +13,8 @@ import { ExternalProfileRepository } from "../companies/external-profile.reposit
  * - `companyId`        → all portal users linked to the company (external_profiles).
  * - `companyProfileId` → resolved to its company, then to that company's users.
  * - `organizationId`   → all current employees of the org (backoffice staff).
- *
- * NOTE: permission-scoped staff targeting is intentionally unsupported — freight
- * has no "users-by-permission" lookup. Target explicit userIds or an org instead.
+ * - `permissionKeys`   → current employees (any org) holding any of these
+ *   permission keys (e.g. department/role-scoped targeting).
  */
 @Injectable()
 export class NotificationRecipientsService {
@@ -82,6 +81,20 @@ export class NotificationRecipientsService {
       }
     }
 
+    if (recipients.permissionKeys?.length) {
+      try {
+        for (const uid of await this.backoffice.getEmployeeUserIdsByPermission(
+          recipients.permissionKeys,
+        )) {
+          ids.add(uid);
+        }
+      } catch (err) {
+        this.logger.warn(
+          `Failed to resolve permissionKeys recipients: ${(err as Error).message}`,
+        );
+      }
+    }
+
     return [...ids];
   }
 }