@actuate-media/cms-core 0.39.0 → 0.41.0

package/dist/auth/roles.js

@@ -0,0 +1,159 @@
+/**
+ * Role model for the Users / access-control subsystem.
+ *
+ * The database enum (`UserRole`) carries six values for backward compatibility:
+ * the four product-facing roles `OWNER`, `ADMIN`, `EDITOR`, `VIEWER` plus the
+ * two legacy values `AUTHOR` and `CLIENT` that predate this subsystem. The admin
+ * UI only ever speaks in the four product roles, so this module is the single
+ * source of truth for:
+ *
+ *   - mapping any stored role to a product-facing display label,
+ *   - mapping a display-label filter back to the enum values it covers,
+ *   - which roles may be *assigned* to new/updated users,
+ *   - a privilege rank used by protection checks (last-owner, self-demotion),
+ *   - the permission groups each role grants.
+ *
+ * Everything here is pure and dependency-free so it can be unit-tested in
+ * isolation and imported from the lightweight `@actuate-media/cms-core/roles`
+ * subpath without pulling the full barrel.
+ */
+/** Roles offered in the invite modal and role dropdowns, in privilege order. */
+export const ASSIGNABLE_ROLES = ['OWNER', 'ADMIN', 'EDITOR', 'VIEWER'];
+/** All product-facing display roles, used for the filter pills. */
+export const DISPLAY_ROLES = ['Owner', 'Admin', 'Editor', 'Viewer'];
+const ENUM_TO_DISPLAY = {
+    OWNER: 'Owner',
+    ADMIN: 'Admin',
+    EDITOR: 'Editor',
+    AUTHOR: 'Editor',
+    CLIENT: 'Viewer',
+    VIEWER: 'Viewer',
+};
+const DISPLAY_TO_ENUMS = {
+    Owner: ['OWNER'],
+    Admin: ['ADMIN'],
+    Editor: ['EDITOR', 'AUTHOR'],
+    Viewer: ['VIEWER', 'CLIENT'],
+};
+/**
+ * Privilege rank — higher is more privileged. Used to enforce "you cannot act on
+ * someone more privileged than you" and last-owner / self-demotion protections.
+ * Legacy roles rank with their display equivalent.
+ */
+export const ROLE_RANK = {
+    OWNER: 100,
+    ADMIN: 80,
+    EDITOR: 40,
+    AUTHOR: 40,
+    VIEWER: 10,
+    CLIENT: 10,
+};
+function normalizeEnum(role) {
+    if (!role)
+        return null;
+    const upper = role.trim().toUpperCase();
+    return upper in ENUM_TO_DISPLAY ? upper : null;
+}
+/** Map any stored role (incl. legacy) to its product-facing display label. */
+export function toDisplayRole(role) {
+    const e = normalizeEnum(role);
+    return e ? ENUM_TO_DISPLAY[e] : 'Viewer';
+}
+/** Validate + normalize a role coming from the UI for assignment. */
+export function normalizeAssignableRole(role) {
+    const e = normalizeEnum(role);
+    return e && ASSIGNABLE_ROLES.includes(e) ? e : null;
+}
+/**
+ * The enum values a display-role filter covers. Returns `null` for "all" or an
+ * unrecognized label so callers can skip filtering.
+ */
+export function enumRolesForDisplay(display) {
+    if (!display || display.toLowerCase() === 'all')
+        return null;
+    const key = DISPLAY_ROLES.find((r) => r.toLowerCase() === display.trim().toLowerCase());
+    return key ? DISPLAY_TO_ENUMS[key] : null;
+}
+export function isOwnerRole(role) {
+    return normalizeEnum(role) === 'OWNER';
+}
+/** Rank of a role (0 for unknown). */
+export function roleRank(role) {
+    const e = normalizeEnum(role);
+    return e ? ROLE_RANK[e] : 0;
+}
+// ---------------------------------------------------------------------------
+// Permission groups
+// ---------------------------------------------------------------------------
+/** Every permission scope recognised by the system. */
+export const ALL_PERMISSIONS = [
+    'dashboard.view',
+    'content.view',
+    'content.create',
+    'content.update',
+    'content.publish',
+    'content.delete',
+    'pages.manage',
+    'posts.manage',
+    'media.manage',
+    'forms.manage',
+    'seo.manage',
+    'redirects.manage',
+    'scripts.manage',
+    'users.view',
+    'users.invite',
+    'users.update',
+    'users.update_role',
+    'users.remove',
+    'users.suspend',
+    'users.reset_password',
+    'users.reset_mfa',
+    'sessions.view',
+    'sessions.revoke',
+    'api_keys.manage',
+    'settings.manage',
+    'security.manage',
+    'audit.view',
+    'billing.manage',
+    'workspace.delete',
+    'workspace.owner_actions',
+];
+const CONTENT_PERMISSIONS = [
+    'dashboard.view',
+    'content.view',
+    'content.create',
+    'content.update',
+    'content.publish',
+    'content.delete',
+    'pages.manage',
+    'posts.manage',
+    'media.manage',
+    'forms.manage',
+    'seo.manage',
+    'redirects.manage',
+];
+// Admin gets everything except the Owner-only billing/workspace/owner actions.
+const OWNER_ONLY = ['billing.manage', 'workspace.delete', 'workspace.owner_actions'];
+const ADMIN_PERMISSIONS = ALL_PERMISSIONS.filter((p) => !OWNER_ONLY.includes(p));
+/** Effective permissions granted by a role. */
+export function permissionsForRole(role) {
+    switch (normalizeEnum(role)) {
+        case 'OWNER':
+            return [...ALL_PERMISSIONS];
+        case 'ADMIN':
+            return ADMIN_PERMISSIONS;
+        case 'EDITOR':
+        case 'AUTHOR':
+            return [...CONTENT_PERMISSIONS];
+        case 'VIEWER':
+        case 'CLIENT':
+            return ['dashboard.view', 'content.view'];
+        default:
+            return [];
+    }
+}
+/** Whether a role grants a specific permission. */
+export function roleHasPermission(role, permission) {
+    return permissionsForRole(role).includes(permission);
+}
+//# sourceMappingURL=roles.js.map

package/dist/auth/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAA4B,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAE/F,mEAAmE;AACnE,MAAM,CAAC,MAAM,aAAa,GAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAE3F,MAAM,eAAe,GAAsC;IACzD,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACjB,CAAA;AAED,MAAM,gBAAgB,GAAwC;IAC5D,KAAK,EAAE,CAAC,OAAO,CAAC;IAChB,KAAK,EAAE,CAAC,OAAO,CAAC;IAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAiC;IACrD,KAAK,EAAE,GAAG;IACV,KAAK,EAAE,EAAE;IACT,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;CACX,CAAA;AAED,SAAS,aAAa,CAAC,IAA+B;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACvC,OAAO,KAAK,IAAI,eAAe,CAAC,CAAC,CAAE,KAAsB,CAAC,CAAC,CAAC,IAAI,CAAA;AAClE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,IAA+B;IAC3D,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAC7B,OAAO,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC1C,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,uBAAuB,CAAC,IAA+B;IACrE,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAC7B,OAAO,CAAC,IAAK,gBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAkC;IACpE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC5D,MAAM,GAAG,GAAI,aAAmC,CAAC,IAAI,CACnD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAC7B,CAAA;IAC5B,OAAO,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAA+B;IACzD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,OAAO,CAAA;AACxC,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,QAAQ,CAAC,IAA+B;IACtD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAC7B,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7B,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,YAAY;IACZ,kBAAkB;IAClB,gBAAgB;IAChB,YAAY;IACZ,cAAc;IACd,cAAc;IACd,mBAAmB;IACnB,cAAc;IACd,eAAe;IACf,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,kBAAkB;IAClB,yBAAyB;CACjB,CAAA;AAIV,MAAM,mBAAmB,GAAiB;IACxC,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,YAAY;IACZ,kBAAkB;CACnB,CAAA;AAED,+EAA+E;AAC/E,MAAM,UAAU,GAAiB,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,yBAAyB,CAAC,CAAA;AAClG,MAAM,iBAAiB,GAAiB,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAE9F,+CAA+C;AAC/C,MAAM,UAAU,kBAAkB,CAAC,IAA+B;IAChE,QAAQ,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,KAAK,OAAO;YACV,OAAO,CAAC,GAAG,eAAe,CAAC,CAAA;QAC7B,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAA;QAC1B,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAA;QACjC,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAA;QAC3C;YACE,OAAO,EAAE,CAAA;IACb,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,iBAAiB,CAC/B,IAA+B,EAC/B,UAAsB;IAEtB,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AACtD,CAAC"}

package/dist/auth/team.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Team / access-control read models for the Users admin tab.
+ *
+ * Pure data shaping over the Prisma client (no config or request coupling) so it
+ * unit-tests cleanly. The API layer derives `workspaceDomain` / `seatLimit` from
+ * config and passes them in.
+ *
+ *   - `listTeamMembers`  — active/suspended/locked members, de-duplicated against
+ *                          pending invites (a placeholder user for a pending
+ *                          invite is shown only as the invite row).
+ *   - `getUserStats`     — the four summary cards (members, pending, admins, seats).
+ *   - `computeAccessReview` — risk recommendations from real signals.
+ */
+import { type DisplayRole, type UserRoleEnum } from './roles.js';
+export type MemberStatus = 'active' | 'suspended' | 'locked' | 'deactivated';
+export interface TeamMember {
+    id: string;
+    name: string;
+    email: string;
+    initials: string;
+    role: UserRoleEnum;
+    roleName: DisplayRole;
+    status: MemberStatus;
+    mfaEnabled: boolean;
+    mfaRequired: boolean;
+    externalDomain: boolean;
+    authProvider: string | null;
+    lastLoginAt: string | null;
+    lastActiveAt: string | null;
+    acceptedInviteAt: string | null;
+    createdAt: string;
+    isCurrentUser: boolean;
+}
+export interface TeamOptions {
+    /** Registrable workspace domain, e.g. "actuatemedia.com". */
+    workspaceDomain?: string | null;
+    /** Seat cap; null/undefined = unlimited. */
+    seatLimit?: number | null;
+    /** Used to mark the current row + protect self-actions. */
+    currentUserId?: string;
+    /** Access-review recommendation ids the workspace has dismissed. */
+    dismissedIds?: string[];
+}
+export interface MemberFilter {
+    search?: string;
+    /** Display-role filter ("Owner"/"Admin"/"Editor"/"Viewer"/"all"). */
+    role?: string;
+    status?: string;
+}
+export declare function listTeamMembers(db: any, filter?: MemberFilter, opts?: TeamOptions): Promise<TeamMember[]>;
+export interface UserStats {
+    members: number;
+    pendingInvites: number;
+    admins: number;
+    seatsUsed: number;
+    seatLimit: number | null;
+    seatsAvailable: number | null;
+}
+export declare function getUserStats(db: any, opts?: TeamOptions): Promise<UserStats>;
+export type Severity = 'low' | 'medium' | 'high' | 'critical';
+export type RecommendationType = 'inactive_user' | 'external_domain' | 'admin_without_mfa' | 'owner_without_mfa' | 'stale_invite' | 'never_signed_in';
+export interface AccessReviewRecommendation {
+    id: string;
+    userId: string | null;
+    inviteId?: string | null;
+    severity: Severity;
+    type: RecommendationType;
+    title: string;
+    description: string;
+    recommendedAction: string;
+    status: 'open';
+}
+/**
+ * Build one primary recommendation per member (highest-risk signal), plus a
+ * recommendation per stale pending invite. Dismissed ids are filtered out and
+ * the result is sorted highest-severity first.
+ */
+export declare function buildRecommendations(members: TeamMember[], pendingInvites: Array<{
+    id: string;
+    email: string;
+    createdAt: string;
+}>, dismissed: Set<string>): AccessReviewRecommendation[];
+export declare function computeAccessReview(db: any, opts?: TeamOptions): Promise<AccessReviewRecommendation[]>;
+/** Derive the registrable workspace domain from a site URL, if any. */
+export declare function workspaceDomainFromUrl(siteUrl?: string | null): string | null;
+//# sourceMappingURL=team.d.ts.map

package/dist/auth/team.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.d.ts","sourceRoot":"","sources":["../../src/auth/team.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAiB,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAA;AAM/E,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,aAAa,CAAA;AAE5E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,YAAY,CAAA;IAClB,QAAQ,EAAE,WAAW,CAAA;IACrB,MAAM,EAAE,YAAY,CAAA;IACpB,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,OAAO,CAAA;IACpB,cAAc,EAAE,OAAO,CAAA;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,6DAA6D;IAC7D,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,2DAA2D;IAC3D,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AA0DD,wBAAsB,eAAe,CACnC,EAAE,EAAE,GAAG,EACP,MAAM,GAAE,YAAiB,EACzB,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,UAAU,EAAE,CAAC,CA8BvB;AAED,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,MAAM,EAAE,MAAM,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;CAC9B;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,GAAE,WAAgB,GAAG,OAAO,CAAC,SAAS,CAAC,CA0BtF;AAED,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAE7D,MAAM,MAAM,kBAAkB,GAC1B,eAAe,GACf,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,cAAc,GACd,iBAAiB,CAAA;AAErB,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,QAAQ,EAAE,QAAQ,CAAA;IAClB,IAAI,EAAE,kBAAkB,CAAA;IACxB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;CACf;AASD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,UAAU,EAAE,EACrB,cAAc,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,EACvE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,GACrB,0BAA0B,EAAE,CAuG9B;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,GAAG,EACP,IAAI,GAAE,WAAgB,GACrB,OAAO,CAAC,0BAA0B,EAAE,CAAC,CAevC;AAED,uEAAuE;AACvE,wBAAgB,sBAAsB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAQ7E"}

package/dist/auth/team.js

@@ -0,0 +1,270 @@
+/**
+ * Team / access-control read models for the Users admin tab.
+ *
+ * Pure data shaping over the Prisma client (no config or request coupling) so it
+ * unit-tests cleanly. The API layer derives `workspaceDomain` / `seatLimit` from
+ * config and passes them in.
+ *
+ *   - `listTeamMembers`  — active/suspended/locked members, de-duplicated against
+ *                          pending invites (a placeholder user for a pending
+ *                          invite is shown only as the invite row).
+ *   - `getUserStats`     — the four summary cards (members, pending, admins, seats).
+ *   - `computeAccessReview` — risk recommendations from real signals.
+ */
+import { toDisplayRole } from './roles.js';
+const INACTIVE_DAYS = 90;
+const STALE_INVITE_DAYS = 7;
+const DAY_MS = 24 * 60 * 60 * 1000;
+function initialsFor(name, email) {
+    const source = name?.trim() || email;
+    const parts = source.split(/\s+/).filter(Boolean);
+    if (parts.length >= 2)
+        return (parts[0][0] + parts[1][0]).toUpperCase();
+    const single = parts[0] ?? email;
+    return single.slice(0, 2).toUpperCase();
+}
+function emailDomain(email) {
+    return email.split('@')[1]?.toLowerCase() ?? '';
+}
+function iso(d) {
+    if (!d)
+        return null;
+    return d instanceof Date ? d.toISOString() : d;
+}
+function memberStatus(user) {
+    if (!user.isActive)
+        return 'deactivated';
+    if (user.lockedAt)
+        return 'locked';
+    if (user.suspendedAt)
+        return 'suspended';
+    return 'active';
+}
+function toMember(user, opts) {
+    const domain = emailDomain(user.email);
+    return {
+        id: user.id,
+        name: user.name,
+        email: user.email,
+        initials: initialsFor(user.name, user.email),
+        role: user.role,
+        roleName: toDisplayRole(user.role),
+        status: memberStatus(user),
+        mfaEnabled: !!user.totpEnabled,
+        mfaRequired: !!user.mfaRequired,
+        externalDomain: !!opts.workspaceDomain && !!domain && domain !== opts.workspaceDomain,
+        authProvider: user.authProvider ?? null,
+        lastLoginAt: iso(user.lastLoginAt),
+        lastActiveAt: iso(user.lastActiveAt ?? user.lastLoginAt),
+        acceptedInviteAt: iso(user.acceptedInviteAt),
+        createdAt: iso(user.createdAt) ?? new Date().toISOString(),
+        isCurrentUser: !!opts.currentUserId && user.id === opts.currentUserId,
+    };
+}
+/** Emails with a still-PENDING invite — excluded from the member list. */
+async function pendingInviteEmails(db) {
+    if (!db.invite?.findMany)
+        return new Set();
+    const rows = await db.invite.findMany({
+        where: { status: 'PENDING' },
+        select: { email: true },
+    });
+    return new Set(rows.map((r) => r.email.toLowerCase()));
+}
+export async function listTeamMembers(db, filter = {}, opts = {}) {
+    const [users, pending] = await Promise.all([
+        db.user.findMany({ orderBy: { createdAt: 'asc' } }),
+        pendingInviteEmails(db),
+    ]);
+    let members = users
+        .filter((u) => !pending.has(u.email.toLowerCase()))
+        .map((u) => toMember(u, opts));
+    if (filter.role && filter.role.toLowerCase() !== 'all') {
+        const want = filter.role.toLowerCase();
+        members = members.filter((m) => m.roleName.toLowerCase() === want);
+    }
+    if (filter.status && filter.status.toLowerCase() !== 'all') {
+        const want = filter.status.toLowerCase();
+        members = members.filter((m) => m.status === want);
+    }
+    if (filter.search) {
+        const q = filter.search.trim().toLowerCase();
+        members = members.filter((m) => m.name.toLowerCase().includes(q) ||
+            m.email.toLowerCase().includes(q) ||
+            m.roleName.toLowerCase().includes(q) ||
+            m.status.includes(q) ||
+            emailDomain(m.email).includes(q));
+    }
+    return members;
+}
+export async function getUserStats(db, opts = {}) {
+    const members = await listTeamMembers(db, {}, opts);
+    const active = members.filter((m) => m.status === 'active');
+    const admins = active.filter((m) => m.roleName === 'Owner' || m.roleName === 'Admin').length;
+    let pendingInvites = 0;
+    if (db.invite?.count) {
+        pendingInvites = await db.invite.count({
+            where: { status: 'PENDING', expiresAt: { gt: new Date() } },
+        });
+    }
+    // Active members + pending invites reserve seats. Suspended/locked/deactivated
+    // do not count.
+    const seatsUsed = active.length + pendingInvites;
+    const seatLimit = opts.seatLimit ?? null;
+    const seatsAvailable = seatLimit == null ? null : Math.max(0, seatLimit - seatsUsed);
+    return {
+        members: active.length,
+        pendingInvites,
+        admins,
+        seatsUsed,
+        seatLimit,
+        seatsAvailable,
+    };
+}
+const SEVERITY_RANK = { critical: 4, high: 3, medium: 2, low: 1 };
+function daysSince(d) {
+    if (!d)
+        return null;
+    return Math.floor((Date.now() - new Date(d).getTime()) / DAY_MS);
+}
+/**
+ * Build one primary recommendation per member (highest-risk signal), plus a
+ * recommendation per stale pending invite. Dismissed ids are filtered out and
+ * the result is sorted highest-severity first.
+ */
+export function buildRecommendations(members, pendingInvites, dismissed) {
+    const recs = [];
+    for (const m of members) {
+        if (m.status !== 'active')
+            continue;
+        const inactiveDays = daysSince(m.lastLoginAt);
+        const inactive = inactiveDays != null && inactiveDays >= INACTIVE_DAYS;
+        const neverSignedIn = m.lastLoginAt == null && m.acceptedInviteAt != null;
+        const isOwner = m.roleName === 'Owner';
+        const isAdmin = m.roleName === 'Admin';
+        let rec = null;
+        if (isOwner && !m.mfaEnabled) {
+            rec = {
+                id: `owner_without_mfa:${m.id}`,
+                userId: m.id,
+                severity: 'critical',
+                type: 'owner_without_mfa',
+                title: 'Owner without MFA',
+                description: `${m.name} (${m.email}) is an Owner but has not enabled multi-factor authentication.`,
+                recommendedAction: 'Require MFA',
+                status: 'open',
+            };
+        }
+        else if (isAdmin && !m.mfaEnabled) {
+            rec = {
+                id: `admin_without_mfa:${m.id}`,
+                userId: m.id,
+                severity: 'high',
+                type: 'admin_without_mfa',
+                title: 'Admin without MFA',
+                description: `${m.name} (${m.email}) has admin access but has not enabled multi-factor authentication.`,
+                recommendedAction: 'Require MFA',
+                status: 'open',
+            };
+        }
+        else if (inactive && m.externalDomain) {
+            rec = {
+                id: `inactive_user:${m.id}`,
+                userId: m.id,
+                severity: 'high',
+                type: 'inactive_user',
+                title: 'Access review',
+                description: `${m.name} (${m.email}) hasn't signed in for ${inactiveDays} days and holds an external address. Consider revoking access to reduce risk.`,
+                recommendedAction: 'Revoke access',
+                status: 'open',
+            };
+        }
+        else if (inactive) {
+            rec = {
+                id: `inactive_user:${m.id}`,
+                userId: m.id,
+                severity: 'medium',
+                type: 'inactive_user',
+                title: 'Inactive user',
+                description: `${m.name} (${m.email}) hasn't signed in for ${inactiveDays} days.`,
+                recommendedAction: 'Revoke access',
+                status: 'open',
+            };
+        }
+        else if (m.externalDomain) {
+            rec = {
+                id: `external_domain:${m.id}`,
+                userId: m.id,
+                severity: m.roleName === 'Viewer' ? 'low' : 'medium',
+                type: 'external_domain',
+                title: 'External domain',
+                description: `${m.name} (${m.email}) signs in with an external email domain.`,
+                recommendedAction: 'Review access',
+                status: 'open',
+            };
+        }
+        else if (neverSignedIn) {
+            rec = {
+                id: `never_signed_in:${m.id}`,
+                userId: m.id,
+                severity: 'medium',
+                type: 'never_signed_in',
+                title: 'Never signed in',
+                description: `${m.name} (${m.email}) has an account but has never signed in.`,
+                recommendedAction: 'Send reminder',
+                status: 'open',
+            };
+        }
+        if (rec && !dismissed.has(rec.id))
+            recs.push(rec);
+    }
+    for (const inv of pendingInvites) {
+        const age = daysSince(inv.createdAt);
+        if (age != null && age >= STALE_INVITE_DAYS) {
+            const id = `stale_invite:${inv.id}`;
+            if (!dismissed.has(id)) {
+                recs.push({
+                    id,
+                    userId: null,
+                    inviteId: inv.id,
+                    severity: 'medium',
+                    type: 'stale_invite',
+                    title: 'Stale invitation',
+                    description: `The invitation to ${inv.email} has been pending for ${age} days.`,
+                    recommendedAction: 'Resend or cancel',
+                    status: 'open',
+                });
+            }
+        }
+    }
+    return recs.sort((a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity]);
+}
+export async function computeAccessReview(db, opts = {}) {
+    const members = await listTeamMembers(db, {}, opts);
+    let pending = [];
+    if (db.invite?.findMany) {
+        const rows = await db.invite.findMany({
+            where: { status: 'PENDING' },
+            select: { id: true, email: true, createdAt: true },
+        });
+        pending = rows.map((r) => ({
+            id: r.id,
+            email: r.email,
+            createdAt: iso(r.createdAt) ?? new Date().toISOString(),
+        }));
+    }
+    return buildRecommendations(members, pending, new Set(opts.dismissedIds ?? []));
+}
+/** Derive the registrable workspace domain from a site URL, if any. */
+export function workspaceDomainFromUrl(siteUrl) {
+    if (!siteUrl)
+        return null;
+    try {
+        const host = new URL(siteUrl).hostname.toLowerCase();
+        return host.replace(/^www\./, '');
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=team.js.map

package/dist/auth/team.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.js","sourceRoot":"","sources":["../../src/auth/team.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,aAAa,EAAuC,MAAM,YAAY,CAAA;AAE/E,MAAM,aAAa,GAAG,EAAE,CAAA;AACxB,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAC3B,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAyClC,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,MAAM,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,KAAK,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACjD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC,CAAC,WAAW,EAAE,CAAA;IAC3E,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAA;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;AACjD,CAAC;AAED,SAAS,GAAG,CAAC,CAAmC;IAC9C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAChD,CAAC;AAED,SAAS,YAAY,CAAC,IAAS;IAC7B,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,aAAa,CAAA;IACxC,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAClC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,WAAW,CAAA;IACxC,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAS,EAAE,IAAiB;IAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC;QAC5C,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;QAClC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;QAC1B,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;QAC9B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW;QAC/B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,KAAK,IAAI,CAAC,eAAe;QACrF,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;QACvC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;QAClC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,WAAW,CAAC;QACxD,gBAAgB,EAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAC5C,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC1D,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,aAAa;KACtE,CAAA;AACH,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,mBAAmB,CAAC,EAAO;IACxC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ;QAAE,OAAO,IAAI,GAAG,EAAE,CAAA;IAC1C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;QACpC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;QAC5B,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;KACxB,CAAC,CAAA;IACF,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAO,EACP,SAAuB,EAAE,EACzB,OAAoB,EAAE;IAEtB,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,mBAAmB,CAAC,EAAE,CAAC;KACxB,CAAC,CAAA;IAEF,IAAI,OAAO,GAAiB,KAAK;SAC9B,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;SACvD,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;IAErC,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;QACtC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAA;IACpE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAA;QACxC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QAC5C,OAAO,GAAG,OAAO,CAAC,MAAM,CACtB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACjC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpB,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CACnC,CAAA;IACH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAWD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAO,EAAE,OAAoB,EAAE;IAChE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;IACnD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAA;IAE5F,IAAI,cAAc,GAAG,CAAC,CAAA;IACtB,IAAI,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;QACrB,cAAc,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC;YACrC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,EAAE;SAC5D,CAAC,CAAA;IACJ,CAAC;IAED,+EAA+E;IAC/E,gBAAgB;IAChB,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,cAAc,CAAA;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAA;IACxC,MAAM,cAAc,GAAG,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC,CAAA;IAEpF,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,MAAM;QACtB,cAAc;QACd,MAAM;QACN,SAAS;QACT,SAAS;QACT,cAAc;KACf,CAAA;AACH,CAAC;AAwBD,MAAM,aAAa,GAA6B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAA;AAE3F,SAAS,SAAS,CAAC,CAAgB;IACjC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,CAAA;AAClE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAqB,EACrB,cAAuE,EACvE,SAAsB;IAEtB,MAAM,IAAI,GAAiC,EAAE,CAAA;IAE7C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAQ;QACnC,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QAC7C,MAAM,QAAQ,GAAG,YAAY,IAAI,IAAI,IAAI,YAAY,IAAI,aAAa,CAAA;QACtE,MAAM,aAAa,GAAG,CAAC,CAAC,WAAW,IAAI,IAAI,IAAI,CAAC,CAAC,gBAAgB,IAAI,IAAI,CAAA;QACzE,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAA;QACtC,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAA;QAEtC,IAAI,GAAG,GAAsC,IAAI,CAAA;QACjD,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YAC7B,GAAG,GAAG;gBACJ,EAAE,EAAE,qBAAqB,CAAC,CAAC,EAAE,EAAE;gBAC/B,MAAM,EAAE,CAAC,CAAC,EAAE;gBACZ,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,mBAAmB;gBAC1B,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,gEAAgE;gBAClG,iBAAiB,EAAE,aAAa;gBAChC,MAAM,EAAE,MAAM;aACf,CAAA;QACH,CAAC;aAAM,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;YACpC,GAAG,GAAG;gBACJ,EAAE,EAAE,qBAAqB,CAAC,CAAC,EAAE,EAAE;gBAC/B,MAAM,EAAE,CAAC,CAAC,EAAE;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,mBAAmB;gBAC1B,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,qEAAqE;gBACvG,iBAAiB,EAAE,aAAa;gBAChC,MAAM,EAAE,MAAM;aACf,CAAA;QACH,CAAC;aAAM,IAAI,QAAQ,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;YACxC,GAAG,GAAG;gBACJ,EAAE,EAAE,iBAAiB,CAAC,CAAC,EAAE,EAAE;gBAC3B,MAAM,EAAE,CAAC,CAAC,EAAE;gBACZ,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,0BAA0B,YAAY,+EAA+E;gBACvJ,iBAAiB,EAAE,eAAe;gBAClC,MAAM,EAAE,MAAM;aACf,CAAA;QACH,CAAC;aAAM,IAAI,QAAQ,EAAE,CAAC;YACpB,GAAG,GAAG;gBACJ,EAAE,EAAE,iBAAiB,CAAC,CAAC,EAAE,EAAE;gBAC3B,MAAM,EAAE,CAAC,CAAC,EAAE;gBACZ,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,0BAA0B,YAAY,QAAQ;gBAChF,iBAAiB,EAAE,eAAe;gBAClC,MAAM,EAAE,MAAM;aACf,CAAA;QACH,CAAC;aAAM,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;YAC5B,GAAG,GAAG;gBACJ,EAAE,EAAE,mBAAmB,CAAC,CAAC,EAAE,EAAE;gBAC7B,MAAM,EAAE,CAAC,CAAC,EAAE;gBACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBACpD,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,iBAAiB;gBACxB,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,2CAA2C;gBAC7E,iBAAiB,EAAE,eAAe;gBAClC,MAAM,EAAE,MAAM;aACf,CAAA;QACH,CAAC;aAAM,IAAI,aAAa,EAAE,CAAC;YACzB,GAAG,GAAG;gBACJ,EAAE,EAAE,mBAAmB,CAAC,CAAC,EAAE,EAAE;gBAC7B,MAAM,EAAE,CAAC,CAAC,EAAE;gBACZ,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE,iBAAiB;gBACvB,KAAK,EAAE,iBAAiB;gBACxB,WAAW,EAAE,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,2CAA2C;gBAC7E,iBAAiB,EAAE,eAAe;gBAClC,MAAM,EAAE,MAAM;aACf,CAAA;QACH,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACpC,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,iBAAiB,EAAE,CAAC;YAC5C,MAAM,EAAE,GAAG,gBAAgB,GAAG,CAAC,EAAE,EAAE,CAAA;YACnC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC;oBACR,EAAE;oBACF,MAAM,EAAE,IAAI;oBACZ,QAAQ,EAAE,GAAG,CAAC,EAAE;oBAChB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,cAAc;oBACpB,KAAK,EAAE,kBAAkB;oBACzB,WAAW,EAAE,qBAAqB,GAAG,CAAC,KAAK,yBAAyB,GAAG,QAAQ;oBAC/E,iBAAiB,EAAE,kBAAkB;oBACrC,MAAM,EAAE,MAAM;iBACf,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;AACnF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAO,EACP,OAAoB,EAAE;IAEtB,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;IACnD,IAAI,OAAO,GAA4D,EAAE,CAAA;IACzE,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;YACpC,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;YAC5B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;SACnD,CAAC,CAAA;QACF,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;YAC9B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACxD,CAAC,CAAC,CAAA;IACL,CAAC;IACD,OAAO,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,CAAA;AACjF,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,sBAAsB,CAAC,OAAuB;IAC5D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;QACpD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/auth/user-admin.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Per-user admin read models for the User detail drawer (Overview / Security /
+ * Sessions / Activity / Permissions tabs).
+ *
+ * Pure data shaping over the Prisma client — no config or request coupling — so
+ * it unit-tests cleanly. The API layer supplies `workspaceDomain` (for the
+ * external-domain flag) and the viewer's `currentSessionId` (to mark the
+ * "this device" session). Mirrors the conventions in `team.ts`.
+ */
+import { type DisplayRole, type UserRoleEnum, type Permission } from './roles.js';
+export type MemberStatus = 'active' | 'suspended' | 'locked' | 'deactivated';
+export interface UserDetailOptions {
+    workspaceDomain?: string | null;
+    currentUserId?: string;
+}
+export interface UserDetail {
+    id: string;
+    name: string;
+    email: string;
+    avatarUrl: string | null;
+    initials: string;
+    role: UserRoleEnum;
+    roleName: DisplayRole;
+    status: MemberStatus;
+    mfaEnabled: boolean;
+    mfaRequired: boolean;
+    passwordSet: boolean;
+    forcePasswordReset: boolean;
+    failedLoginCount: number;
+    lockedAt: string | null;
+    suspendedAt: string | null;
+    authProvider: string | null;
+    oauthProviders: string[];
+    /** True when the account can only sign in via an external identity provider. */
+    ssoOnly: boolean;
+    emailVerified: boolean;
+    lastLoginAt: string | null;
+    lastActiveAt: string | null;
+    acceptedInviteAt: string | null;
+    createdAt: string;
+    invitedBy: {
+        id: string;
+        name: string;
+        email: string;
+    } | null;
+    externalDomain: boolean;
+    contentOwnedCount: number;
+    isCurrentUser: boolean;
+}
+export interface SessionInfo {
+    id: string;
+    deviceLabel: string;
+    browser: string;
+    os: string;
+    ipCountry: string | null;
+    createdAt: string;
+    lastSeenAt: string;
+    expiresAt: string;
+    revokedAt: string | null;
+    current: boolean;
+    active: boolean;
+}
+export interface ActivityEvent {
+    id: string;
+    event: string;
+    /** Whether the user was the actor or the target of the event. */
+    role: 'actor' | 'target';
+    ipAddress: string | null;
+    timestamp: string;
+    details: Record<string, unknown> | null;
+}
+export interface PermissionView {
+    role: UserRoleEnum;
+    roleName: DisplayRole;
+    permissions: Permission[];
+}
+/**
+ * Best-effort User-Agent parsing into a friendly device label. Intentionally
+ * dependency-free and conservative: an unknown UA degrades to "Unknown device"
+ * rather than guessing. This is presentational only — never used for auth.
+ */
+export declare function parseUserAgent(ua: string | null | undefined): {
+    browser: string;
+    os: string;
+    deviceLabel: string;
+};
+export declare function getUserDetail(db: any, userId: string, opts?: UserDetailOptions): Promise<UserDetail | null>;
+export declare function listUserSessions(db: any, userId: string, currentSessionId?: string): Promise<SessionInfo[]>;
+export declare function listUserActivity(db: any, userId: string, limit?: number): Promise<ActivityEvent[]>;
+export declare function getUserPermissionView(role: string): PermissionView;
+export interface TransferResult {
+    documents: number;
+    media: number;
+    templates: number;
+    total: number;
+}
+/**
+ * Count the content a user *owns* (authored documents, uploaded media,
+ * created templates). Soft-deleted documents are included so the count
+ * reflects everything a transfer would reassign — nothing is silently
+ * orphaned. Immutable history (versions, audit logs) is never counted.
+ */
+export declare function countOwnedContent(db: any, userId: string): Promise<number>;
+/**
+ * Reassign every piece of content owned by `fromUserId` to `toUserId`:
+ * authored documents (`Document.createdById`), uploaded media
+ * (`Media.uploadedById`), and created templates (`ContentTemplate.createdById`).
+ *
+ * Deliberately does NOT touch `updatedById`, version history, or audit logs —
+ * those record *who did what* and rewriting them would falsify the trail. This
+ * only moves the "owner of record" so content survives a user's removal.
+ *
+ * Returns the per-type counts actually reassigned. Each model is guarded so a
+ * trimmed Prisma schema (or test double) that lacks one of them is a no-op for
+ * that type rather than a hard failure.
+ */
+export declare function transferContentOwnership(db: any, fromUserId: string, toUserId: string): Promise<TransferResult>;
+//# sourceMappingURL=user-admin.d.ts.map

package/dist/auth/user-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-admin.d.ts","sourceRoot":"","sources":["../../src/auth/user-admin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,UAAU,EAChB,MAAM,YAAY,CAAA;AAEnB,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,aAAa,CAAA;AAE5E,MAAM,WAAW,iBAAiB;IAChC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,YAAY,CAAA;IAClB,QAAQ,EAAE,WAAW,CAAA;IACrB,MAAM,EAAE,YAAY,CAAA;IAEpB,UAAU,EAAE,OAAO,CAAA;IACnB,WAAW,EAAE,OAAO,CAAA;IACpB,WAAW,EAAE,OAAO,CAAA;IACpB,kBAAkB,EAAE,OAAO,CAAA;IAC3B,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,gFAAgF;IAChF,OAAO,EAAE,OAAO,CAAA;IAEhB,aAAa,EAAE,OAAO,CAAA;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC7D,cAAc,EAAE,OAAO,CAAA;IAEvB,iBAAiB,EAAE,MAAM,CAAA;IAEzB,aAAa,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,iEAAiE;IACjE,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAA;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACxC;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,YAAY,CAAA;IAClB,QAAQ,EAAE,WAAW,CAAA;IACrB,WAAW,EAAE,UAAU,EAAE,CAAA;CAC1B;AAkCD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG;IAC7D,OAAO,EAAE,MAAM,CAAA;IACf,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;CACpB,CAwBA;AAMD,wBAAsB,aAAa,CACjC,EAAE,EAAE,GAAG,EACP,MAAM,EAAE,MAAM,EACd,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAkE5B;AAMD,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,GAAG,EACP,MAAM,EAAE,MAAM,EACd,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,WAAW,EAAE,CAAC,CA0BxB;AAMD,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,GAAG,EACP,MAAM,EAAE,MAAM,EACd,KAAK,SAAK,GACT,OAAO,CAAC,aAAa,EAAE,CAAC,CAmC1B;AAiBD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAMlE;AAMD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;CACd;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAehF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,GAAG,EACP,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,CAAC,CAezB"}