@agilesyndrome/cf-genai-base 5.0.2 → 6.0.0

package/dist/auth/users/access.d.ts

@@ -0,0 +1,9 @@
+export interface UserAccessInput {
+    groups: readonly unknown[];
+    tenants: readonly unknown[];
+    scopes: readonly unknown[];
+}
+export declare function replaceUserAccess(env: unknown, userIdValue: unknown, input: UserAccessInput, grantedBy?: string | null, { who }?: {
+    who?: string | undefined;
+}): Promise<void>;
+//# sourceMappingURL=access.d.ts.map

package/dist/auth/users/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/auth/users/access.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,OAAO,EAAE,CAAC;IAC3B,OAAO,EAAE,SAAS,OAAO,EAAE,CAAC;IAC5B,MAAM,EAAE,SAAS,OAAO,EAAE,CAAC;CAC5B;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,OAAO,EACZ,WAAW,EAAE,OAAO,EACpB,KAAK,EAAE,eAAe,EACtB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,EAAE,GAAqB,EAAE;;CAAK,GAC7B,OAAO,CAAC,IAAI,CAAC,CA4Bf"}

package/dist/auth/users/access.js

@@ -0,0 +1,53 @@
+import { createD1 } from "../../core/database/index.js";
+import { AUTH_GRANT_TABLE } from "../constants.js";
+import { validateGroupNames } from "../groups/validation.js";
+import { validateScopeNames } from "../scopes/validation.js";
+import { validateTenantIds } from "../tenants/validation.js";
+import { validateUserId } from "./validation.js";
+export async function replaceUserAccess(env, userIdValue, input, grantedBy, { who = "system:update" } = {}) {
+    const userId = validateUserId(userIdValue);
+    const groups = validateGroupNames(input.groups);
+    const tenants = validateTenantIds(input.tenants);
+    const scopes = validateScopeNames(input.scopes);
+    const db = createD1(env, { who });
+    const [user, groupRows, tenantRows, scopeRows] = await Promise.all([
+        db.prepare("SELECT id FROM auth_users WHERE id=?").bind(userId).first(),
+        selectIds(db, "auth_groups", "name", groups),
+        selectIds(db, "auth_tenants", "id", tenants),
+        selectScopes(db, scopes),
+    ]);
+    if (!user)
+        throw new TypeError("User does not exist.");
+    if (groupRows.size !== groups.length)
+        throw new TypeError("One or more groups do not exist.");
+    if (tenantRows.size !== tenants.length)
+        throw new TypeError("One or more tenants do not exist.");
+    if (scopeRows.size !== scopes.length)
+        throw new TypeError("One or more scopes do not exist.");
+    const protectedScopes = scopes.filter((scope) => scopeRows.get(scope));
+    if (protectedScopes.length)
+        throw new TypeError(`System scopes cannot be assigned directly: ${protectedScopes.join(", ")}`);
+    await db.batch([
+        db.prepare("DELETE FROM auth_user_groups WHERE user_id=?").bind(userId),
+        db.prepare("DELETE FROM auth_user_tenants WHERE user_id=?").bind(userId),
+        db.prepare(`DELETE FROM ${AUTH_GRANT_TABLE} WHERE user_id=?`).bind(userId),
+        ...groups.map((group) => db.prepare("INSERT INTO auth_user_groups (user_id,group_name,granted_by) VALUES (?,?,?)").bind(userId, group, grantedBy || null)),
+        ...tenants.map((tenant) => db.prepare("INSERT INTO auth_user_tenants (user_id,tenant_id) VALUES (?,?)").bind(userId, tenant)),
+        ...scopes.map((scope) => db.prepare(`INSERT INTO ${AUTH_GRANT_TABLE} (user_id,scope_name,granted_by) VALUES (?,?,?)`).bind(userId, scope, grantedBy || null)),
+    ]);
+}
+async function selectIds(db, table, column, ids) {
+    if (!ids.length)
+        return new Set();
+    const placeholders = ids.map(() => "?").join(",");
+    const result = await db.prepare(`SELECT ${column} AS id FROM ${table} WHERE ${column} IN (${placeholders})`).bind(...ids).all();
+    return new Set(result.results.map((row) => row.id));
+}
+async function selectScopes(db, scopes) {
+    if (!scopes.length)
+        return new Map();
+    const placeholders = scopes.map(() => "?").join(",");
+    const result = await db.prepare(`SELECT name,system FROM auth_scopes WHERE name IN (${placeholders})`).bind(...scopes).all();
+    return new Map(result.results.map((row) => [row.name, Boolean(row.system)]));
+}
+//# sourceMappingURL=access.js.map

package/dist/auth/users/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../../src/auth/users/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAQjD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAY,EACZ,WAAoB,EACpB,KAAsB,EACtB,SAAyB,EACzB,EAAE,GAAG,GAAG,eAAe,EAAE,GAAG,EAAE;IAE9B,MAAM,MAAM,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAElC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACjE,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAkB;QACvF,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC;QAC5C,SAAS,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC;QAC5C,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC;KACzB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACvD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC9F,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IACjG,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,kCAAkC,CAAC,CAAC;IAC9F,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACvE,IAAI,eAAe,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,8CAA8C,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE5H,MAAM,EAAE,CAAC,KAAK,CAAC;QACb,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACvE,EAAE,CAAC,OAAO,CAAC,+CAA+C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACxE,EAAE,CAAC,OAAO,CAAC,eAAe,gBAAgB,kBAAkB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QAC1E,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,6EAA6E,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;QAC1J,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,gEAAgE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7H,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,eAAe,gBAAgB,iDAAiD,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,IAAI,IAAI,CAAC,CAAC;KAC9J,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,EAAc,EAAE,KAAa,EAAE,MAAc,EAAE,GAAsB;IAC5F,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,MAAM,eAAe,KAAK,UAAU,MAAM,QAAQ,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,EAAkB,CAAC;IAChJ,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,EAAc,EAAE,MAAyB;IACnE,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,sDAAsD,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,EAA8C,CAAC;IACzK,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC"}

package/dist/auth/users/d1.d.ts

@@ -0,0 +1,19 @@
+import type { AuthUser, GroupMembershipRow, ScopeGrantRow, TenantMembershipRow, UserIdentityInput, UserServiceOptions } from "./model.js";
+export interface UserListOptions {
+    email?: string;
+    active?: boolean;
+    limit?: number;
+    offset?: number;
+}
+export declare function findUserByIdentity(env: unknown, provider: string, subject: string, { who }?: UserServiceOptions): Promise<AuthUser | null>;
+export declare function getUserRow(env: unknown, userId: string, { who }?: UserServiceOptions): Promise<AuthUser | null>;
+export declare function insertUserRow(env: unknown, id: string, identity: UserIdentityInput, options?: UserServiceOptions): Promise<AuthUser | null>;
+export declare function refreshUserIdentity(env: unknown, user: AuthUser, identity: UserIdentityInput, { who }?: UserServiceOptions): Promise<AuthUser>;
+export declare function listUserRows(env: unknown, { who, email, active, limit, offset }?: UserServiceOptions & UserListOptions): Promise<{
+    users: AuthUser[];
+    grants: ScopeGrantRow[];
+    memberships: TenantMembershipRow[];
+    groups: GroupMembershipRow[];
+}>;
+export declare function userHasScope(env: unknown, userId: string, scope: string, { who }?: UserServiceOptions): Promise<boolean>;
+//# sourceMappingURL=d1.d.ts.map

package/dist/auth/users/d1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1.d.ts","sourceRoot":"","sources":["../../../src/auth/users/d1.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,QAAQ,EACR,kBAAkB,EAClB,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,eAAe;IAAG,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE;AAEtG,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,EAAE,GAAmB,EAAE,GAAE,kBAAuB,GAC/C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAK1B;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,EACd,EAAE,GAAmB,EAAE,GAAE,kBAAuB,GAC/C,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAK1B;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,OAAO,EACZ,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,iBAAiB,EAC3B,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAS1B;AAED,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,iBAAiB,EAC3B,EAAE,GAAqB,EAAE,GAAE,kBAAuB,GACjD,OAAO,CAAC,QAAQ,CAAC,CAUnB;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,OAAO,EACZ,EAAE,GAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,KAAW,EAAE,MAAU,EAAE,GAAE,kBAAkB,GAAG,eAAoB,GACzG,OAAO,CAAC;IAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAAC,MAAM,EAAE,aAAa,EAAE,CAAC;IAAC,WAAW,EAAE,mBAAmB,EAAE,CAAC;IAAC,MAAM,EAAE,kBAAkB,EAAE,CAAA;CAAE,CAAC,CAsB3H;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,EAAE,GAAmB,EAAE,GAAE,kBAAuB,GAC/C,OAAO,CAAC,OAAO,CAAC,CAKlB"}

package/dist/auth/users/d1.js

@@ -0,0 +1,68 @@
+import { createD1 } from "../../core/database/index.js";
+import { AUTH_GRANT_TABLE, AUTH_USER_TABLE } from "../constants.js";
+export async function findUserByIdentity(env, provider, subject, { who = "system:read" } = {}) {
+    return createD1(env, { who })
+        .prepare(`SELECT * FROM ${AUTH_USER_TABLE} WHERE provider=? AND subject=?`)
+        .bind(provider, subject)
+        .first();
+}
+export async function getUserRow(env, userId, { who = "system:read" } = {}) {
+    return createD1(env, { who })
+        .prepare(`SELECT * FROM ${AUTH_USER_TABLE} WHERE id=?`)
+        .bind(userId)
+        .first();
+}
+export async function insertUserRow(env, id, identity, options = {}) {
+    const provider = String(identity.auth_strategy ?? "oauth");
+    const email = String(identity.email ?? "");
+    const displayName = String(identity.name ?? (email || identity.sub));
+    const db = createD1(env, { who: options.who ?? "system:update" });
+    await db.prepare(`INSERT INTO ${AUTH_USER_TABLE} (id,provider,subject,email,display_name,is_admin) VALUES (?,?,?,?,?,0) ON CONFLICT(provider,subject) DO NOTHING`)
+        .bind(id, provider, identity.sub, email, displayName)
+        .run();
+    return getUserRow(env, id, options);
+}
+export async function refreshUserIdentity(env, user, identity, { who = "system:update" } = {}) {
+    const email = String(identity.email ?? "");
+    const displayName = String(identity.name ?? (email || identity.sub));
+    if (user.email !== email || user.display_name !== displayName) {
+        await createD1(env, { who })
+            .prepare(`UPDATE ${AUTH_USER_TABLE} SET email=?,display_name=?,updated_at=CURRENT_TIMESTAMP WHERE id=?`)
+            .bind(email, displayName, user.id)
+            .run();
+    }
+    return { ...user, email, display_name: displayName, is_admin: Boolean(user.is_admin) };
+}
+export async function listUserRows(env, { who = "system:read", email, active, limit = 100, offset = 0 } = {}) {
+    const db = createD1(env, { who });
+    const conditions = email ? ["email LIKE ?"] : [];
+    const args = email ? [`%${email}%`] : [];
+    if (active !== undefined) {
+        conditions.push("active=?");
+        args.push(active ? 1 : 0);
+    }
+    const suffix = conditions.length ? ` WHERE ${conditions.join(" AND ")}` : "";
+    const userStatement = `SELECT id,email,display_name,provider,subject,is_admin,active,created_at,updated_at FROM ${AUTH_USER_TABLE}${suffix} ORDER BY email COLLATE NOCASE`;
+    const userQuery = email || active !== undefined || limit !== 100 || offset !== 0
+        ? db.prepare(`${userStatement} LIMIT ? OFFSET ?`).bind(...args, Math.min(500, Math.max(1, Number(limit) || 100)), Math.max(0, Number(offset) || 0))
+        : db.prepare(userStatement);
+    const [users, grants, memberships, groups] = await Promise.all([
+        userQuery.all(),
+        db.prepare(`SELECT user_id,scope_name FROM ${AUTH_GRANT_TABLE} ORDER BY user_id,scope_name`).all(),
+        db.prepare("SELECT ut.user_id,t.id,t.name,t.created_at,t.updated_at FROM auth_user_tenants ut JOIN auth_tenants t ON t.id=ut.tenant_id ORDER BY ut.user_id,t.name COLLATE NOCASE").all(),
+        db.prepare("SELECT user_id,group_name,granted_at FROM auth_user_groups ORDER BY user_id,group_name").all(),
+    ]);
+    return {
+        users: users.results,
+        grants: grants.results,
+        memberships: memberships.results,
+        groups: groups.results,
+    };
+}
+export async function userHasScope(env, userId, scope, { who = "system:read" } = {}) {
+    return Boolean(await createD1(env, { who })
+        .prepare(`SELECT 1 FROM ${AUTH_GRANT_TABLE} WHERE user_id=? AND scope_name=?`)
+        .bind(userId, scope)
+        .first());
+}
+//# sourceMappingURL=d1.js.map

package/dist/auth/users/d1.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"d1.js","sourceRoot":"","sources":["../../../src/auth/users/d1.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAYpE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAY,EACZ,QAAgB,EAChB,OAAe,EACf,EAAE,GAAG,GAAG,aAAa,EAAE,GAAuB,EAAE;IAEhD,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;SAC1B,OAAO,CAAC,iBAAiB,eAAe,iCAAiC,CAAC;SAC1E,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;SACvB,KAAK,EAAY,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAY,EACZ,MAAc,EACd,EAAE,GAAG,GAAG,aAAa,EAAE,GAAuB,EAAE;IAEhD,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;SAC1B,OAAO,CAAC,iBAAiB,eAAe,aAAa,CAAC;SACtD,IAAI,CAAC,MAAM,CAAC;SACZ,KAAK,EAAY,CAAC;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAY,EACZ,EAAU,EACV,QAA2B,EAC3B,OAAO,GAAuB,EAAE;IAEhC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,eAAe,kHAAkH,CAAC;SAC/J,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC;SACpD,GAAG,EAAE,CAAC;IACT,OAAO,UAAU,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAY,EACZ,IAAc,EACd,QAA2B,EAC3B,EAAE,GAAG,GAAG,eAAe,EAAE,GAAuB,EAAE;IAElD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,IAAI,IAAI,CAAC,YAAY,KAAK,WAAW,EAAE,CAAC;QAC9D,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;aACzB,OAAO,CAAC,UAAU,eAAe,qEAAqE,CAAC;aACvG,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;aACjC,GAAG,EAAE,CAAC;IACX,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAY,EACZ,EAAE,GAAG,GAAG,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,GAAG,GAAG,EAAE,MAAM,GAAG,CAAC,EAAE,GAAyC,EAAE;IAE1G,MAAM,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,MAAM,IAAI,GAAc,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACrF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7E,MAAM,aAAa,GAAG,4FAA4F,eAAe,GAAG,MAAM,gCAAgC,CAAC;IAC3K,MAAM,SAAS,GAAG,KAAK,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC;QAC9E,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,aAAa,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACnJ,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC7D,SAAS,CAAC,GAAG,EAAY;QACzB,EAAE,CAAC,OAAO,CAAC,kCAAkC,gBAAgB,8BAA8B,CAAC,CAAC,GAAG,EAAiB;QACjH,EAAE,CAAC,OAAO,CAAC,sKAAsK,CAAC,CAAC,GAAG,EAAuB;QAC7M,EAAE,CAAC,OAAO,CAAC,wFAAwF,CAAC,CAAC,GAAG,EAAsB;KAC/H,CAAC,CAAC;IACH,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,OAAO;QACpB,MAAM,EAAE,MAAM,CAAC,OAAO;QACtB,WAAW,EAAE,WAAW,CAAC,OAAO;QAChC,MAAM,EAAE,MAAM,CAAC,OAAO;KACvB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAY,EACZ,MAAc,EACd,KAAa,EACb,EAAE,GAAG,GAAG,aAAa,EAAE,GAAuB,EAAE;IAEhD,OAAO,OAAO,CAAC,MAAM,QAAQ,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC;SACxC,OAAO,CAAC,iBAAiB,gBAAgB,mCAAmC,CAAC;SAC7E,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC;SACnB,KAAK,EAAE,CAAC,CAAC;AACd,CAAC"}

package/dist/auth/users/domain.d.ts

@@ -0,0 +1,13 @@
+import { AppDomain } from "../../domain/index.js";
+import type { IdentityState } from "../identity/index.js";
+import type { D1Environment } from "../../core/database/index.js";
+import type { AuthUser } from "./model.js";
+interface AuthUsersEnvironment extends D1Environment {
+    AUTH_SESSION_SECRET?: string;
+}
+export declare class AuthUsersDomain extends AppDomain<AuthUser, AuthUsersEnvironment, IdentityState> {
+    constructor();
+}
+export declare const authUsers: AuthUsersDomain;
+export {};
+//# sourceMappingURL=domain.d.ts.map

package/dist/auth/users/domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../../../src/auth/users/domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA6B,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAelE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C,UAAU,oBAAqB,SAAQ,aAAa;IAClD,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAGD,qBAAa,eAAgB,SAAQ,SAAS,CAAC,QAAQ,EAAE,oBAAoB,EAAE,aAAa,CAAC;IAC3F,cAuCC;CACF;AAwFD,eAAO,MAAM,SAAS,iBAAwB,CAAC"}

package/dist/auth/users/domain.js

@@ -0,0 +1,129 @@
+import { AppDomain } from "../../domain/index.js";
+import { badRequest, errorMessage, jsonWithCookie, notFound, readJsonObject, stringArrayField, } from "../../api/http.js";
+import { IMPERSONATION_COOKIE } from "../impersonation/constants.js";
+import { createImpersonationToken } from "../impersonation/service.js";
+import { listGroups, listUserGroups, replaceUserGroups } from "../groups/index.js";
+import { listUserGrants, replaceUserGrants } from "../scopes/index.js";
+import { listUserTenants, replaceUserTenants } from "../tenants/index.js";
+import { AUTH_USER_REPOSITORY } from "../repositories.js";
+import { getAuthorizationUser, listAuthorizationUsers } from "./service.js";
+import { replaceUserAccess } from "./access.js";
+export class AuthUsersDomain extends AppDomain {
+    constructor() {
+        super({
+            name: "auth.users",
+            basePath: "/api/admin/users",
+            auth: "user",
+            scopes: "users:read",
+            repositories: [AUTH_USER_REPOSITORY],
+        });
+        this.route({
+            method: "GET",
+            handler: ({ env, identity, request }) => {
+                const url = new URL(request.url);
+                const active = url.searchParams.get("active");
+                return listAuthorizationUsers(env, { who: identity.who, email: url.searchParams.get("email") || undefined, active: active === null ? undefined : active === "1", limit: Number(url.searchParams.get("limit") || 100), offset: Number(url.searchParams.get("offset") || 0) }).then((users) => Response.json({ users }));
+            },
+        });
+        this.route({
+            method: "POST",
+            path: "/:userId/impersonate",
+            csrf: true,
+            scopes: "impersonation:start",
+            handler: impersonate,
+        });
+        this.route({ method: "GET", path: "/:userId", handler: getUser });
+        this.route({ method: "PUT", path: "/:userId/access", csrf: true, scopes: "users:manage", handler: setAccess });
+        for (const relation of ["groups", "tenants", "scopes"]) {
+            this.route({
+                method: "GET",
+                path: `/:userId/${relation}`,
+                handler: (context) => getRelation(relation, context),
+            });
+            this.route({
+                method: "PUT",
+                path: `/:userId/${relation}`,
+                csrf: true,
+                scopes: "users:manage",
+                handler: (context) => setRelation(relation, context),
+            });
+        }
+    }
+}
+async function setAccess({ request, env, identity, state, params }) {
+    try {
+        const body = await readJsonObject(request);
+        const groups = stringArrayField(body, "groups");
+        const tenants = stringArrayField(body, "tenants");
+        const scopes = stringArrayField(body, "scopes");
+        if (!groups || !tenants || !scopes)
+            return badRequest("groups, tenants, and scopes must be arrays");
+        await replaceUserAccess(env, params.userId, { groups, tenants, scopes }, state.authUser?.id, { who: identity.who });
+        return Response.json({ ok: true });
+    }
+    catch (error) {
+        return badRequest(errorMessage(error));
+    }
+}
+async function getUser({ env, identity, params }) {
+    try {
+        const user = await getAuthorizationUser(env, params.userId, { who: identity.who });
+        if (!user)
+            return notFound("User not found.");
+        const options = { who: identity.who };
+        const [groups, tenants, grants, groupCatalog] = await Promise.all([
+            listUserGroups(env, user.id, options),
+            listUserTenants(env, user.id, options),
+            listUserGrants(env, user.id, options),
+            listGroups(env, options),
+        ]);
+        const scopesByGroup = new Map(groupCatalog.map((group) => [group.name, group.scopes || []]));
+        return Response.json({ user: { ...user, groups: groups.map((group) => ({ ...group, scopes: scopesByGroup.get(String(group.group_name)) || [] })), tenants, scopes: grants.map((grant) => grant.scope_name) } });
+    }
+    catch (error) {
+        return badRequest(errorMessage(error));
+    }
+}
+async function getRelation(relation, { env, identity, params }) {
+    const options = { who: identity.who };
+    if (relation === "groups") {
+        return Response.json({ groups: await listUserGroups(env, params.userId, options) });
+    }
+    if (relation === "tenants") {
+        return Response.json({ tenants: await listUserTenants(env, params.userId, options) });
+    }
+    return Response.json({ grants: await listUserGrants(env, params.userId, options) });
+}
+async function setRelation(relation, { request, env, identity, state, params }) {
+    try {
+        const values = stringArrayField(await readJsonObject(request), relation);
+        if (!values)
+            return badRequest(`${relation} must be an array`);
+        const options = { who: identity.who };
+        if (relation === "groups") {
+            const groups = await replaceUserGroups(env, params.userId, values, state.authUser?.id, options);
+            return Response.json({ groups });
+        }
+        if (relation === "tenants") {
+            return Response.json({ tenants: await replaceUserTenants(env, params.userId, values, options) });
+        }
+        const grants = await replaceUserGrants(env, params.userId, values, state.authUser?.id, options);
+        return Response.json({ grants });
+    }
+    catch (error) {
+        return badRequest(errorMessage(error));
+    }
+}
+async function impersonate({ env, identity, params }) {
+    const target = await getAuthorizationUser(env, params.userId, { who: identity.who });
+    if (!target)
+        return notFound("User not found.");
+    const token = await createImpersonationToken(env, identity.who.replace(/^user:/, ""), target.id);
+    return jsonWithCookie({
+        ok: true,
+        user: { id: target.id, email: target.email, display_name: target.display_name },
+        expires_in: 900,
+    }, `${IMPERSONATION_COOKIE}=${token}; Max-Age=900; Path=/; Secure; HttpOnly; SameSite=Lax`);
+}
+export const authUsers = new AuthUsersDomain();
+//# sourceMappingURL=domain.js.map

package/dist/auth/users/domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.js","sourceRoot":"","sources":["../../../src/auth/users/domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA6B,MAAM,uBAAuB,CAAC;AAG7E,OAAO,EACL,UAAU,EACV,YAAY,EACZ,cAAc,EACd,QAAQ,EACR,cAAc,EACd,gBAAgB,GACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAOhD,MAAM,OAAO,eAAgB,SAAQ,SAAwD;IAC3F;QACE,KAAK,CAAC;YACJ,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,kBAAkB;YAC5B,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,YAAY;YACpB,YAAY,EAAE,CAAC,oBAAoB,CAAC;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC;YACT,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE;gBACtC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC9C,OAAO,sBAAsB,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACzT,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC;YACT,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,qBAAqB;YAC7B,OAAO,EAAE,WAAW;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/G,KAAK,MAAM,QAAQ,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAU,EAAE,CAAC;YAChE,IAAI,CAAC,KAAK,CAAC;gBACT,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,YAAY,QAAQ,EAAE;gBAC5B,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC;aACrD,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC;gBACT,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,YAAY,QAAQ,EAAE;gBAC5B,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC;aACrD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED,KAAK,UAAU,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAW;IACzE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;YAAE,OAAO,UAAU,CAAC,4CAA4C,CAAC,CAAC;QACpG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACpH,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAW;IACvD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QACtC,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAChE,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC;YACrC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC;YACtC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC;YACrC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACzB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IAClN,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAyC,EACzC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAW;IAElC,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;IACtC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,QAAyC,EACzC,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAW;IAElD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM;YAAE,OAAO,UAAU,CAAC,GAAG,QAAQ,mBAAmB,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QACtC,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;YAChG,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;QAChG,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAW;IAC3D,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAC1C,GAAG,EACH,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAClC,MAAM,CAAC,EAAE,CACV,CAAC;IACF,OAAO,cAAc,CACnB;QACE,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;QAC/E,UAAU,EAAE,GAAG;KAChB,EACD,GAAG,oBAAoB,IAAI,KAAK,uDAAuD,CACxF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC"}

package/dist/auth/users/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./model.js";
+export * from "./validation.js";
+export * from "./d1.js";
+export * from "./service.js";
+export * from "./access.js";
+export * from "./domain.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/users/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/users/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC"}

package/dist/auth/users/index.js

@@ -0,0 +1,7 @@
+export * from "./model.js";
+export * from "./validation.js";
+export * from "./d1.js";
+export * from "./service.js";
+export * from "./access.js";
+export * from "./domain.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/users/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/users/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,SAAS,CAAC;AACxB,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC"}

package/dist/auth/users/model.d.ts

@@ -0,0 +1,44 @@
+import type { CanonicalAuthUser, RequestUser } from "../identity/index.js";
+export interface AuthUser extends CanonicalAuthUser {
+    provider: string;
+    subject: string;
+    created_at?: string;
+    updated_at?: string;
+    active?: boolean | number;
+}
+export interface AuthorizationUser extends AuthUser {
+    scopes: string[];
+    groups: Array<{
+        group_name: string;
+        granted_at?: string;
+    }>;
+    tenants: Array<{
+        id: string;
+        name: string;
+        created_at?: string;
+        updated_at?: string;
+    }>;
+}
+export interface UserIdentityInput extends RequestUser {
+    sub: string;
+}
+export interface UserServiceOptions {
+    who?: string;
+}
+export interface ScopeGrantRow {
+    user_id: string;
+    scope_name: string;
+}
+export interface TenantMembershipRow {
+    user_id: string;
+    id: string;
+    name: string;
+    created_at?: string;
+    updated_at?: string;
+}
+export interface GroupMembershipRow {
+    user_id: string;
+    group_name: string;
+    granted_at?: string;
+}
+//# sourceMappingURL=model.d.ts.map

package/dist/auth/users/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/auth/users/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAE3E,MAAM,WAAW,QAAS,SAAQ,iBAAiB;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAkB,SAAQ,QAAQ;IACjD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,OAAO,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/dist/auth/users/model.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=model.js.map

package/dist/auth/users/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../src/auth/users/model.ts"],"names":[],"mappings":""}

package/dist/auth/users/service.d.ts

@@ -0,0 +1,8 @@
+import type { CanonicalAuthUser, RequestUser } from "../identity/index.js";
+import type { UserListOptions } from "./d1.js";
+import type { AuthorizationUser, AuthUser, UserServiceOptions } from "./model.js";
+export declare function ensureUser(env: unknown, value: unknown, options?: UserServiceOptions & UserListOptions): Promise<AuthUser | null>;
+export declare function hasScope(env: unknown, user: RequestUser | CanonicalAuthUser | null | undefined, scope: string, options?: UserServiceOptions): Promise<boolean>;
+export declare function listAuthorizationUsers(env: unknown, options?: UserServiceOptions & UserListOptions): Promise<AuthorizationUser[]>;
+export declare function getAuthorizationUser(env: unknown, userId: unknown, options?: UserServiceOptions): Promise<AuthUser | null>;
+//# sourceMappingURL=service.d.ts.map

package/dist/auth/users/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/auth/users/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAS3E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAGlF,wBAAsB,UAAU,CAC9B,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,OAAO,EACd,OAAO,GAAE,kBAAkB,GAAG,eAAoB,GACjD,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQ1B;AAED,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,OAAO,EACZ,IAAI,EAAE,WAAW,GAAG,iBAAiB,GAAG,IAAI,GAAG,SAAS,EACxD,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,OAAO,CAAC,CAQlB;AAQD,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,kBAAkB,GAAG,eAAoB,GACjD,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAW9B;AAED,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,OAAO,EACf,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAE1B"}

package/dist/auth/users/service.js

@@ -0,0 +1,62 @@
+import { findUserByIdentity, getUserRow, insertUserRow, listUserRows, refreshUserIdentity, userHasScope, } from "./d1.js";
+import { normalizeUserIdentity, validateUserId } from "./validation.js";
+export async function ensureUser(env, value, options = {}) {
+    if (!env || typeof env !== "object" || !Reflect.get(env, "DB"))
+        return null;
+    const identity = normalizeUserIdentity(value);
+    if (!identity)
+        return null;
+    const provider = String(identity.auth_strategy ?? "oauth");
+    const existing = await findUserByIdentity(env, provider, identity.sub, options);
+    if (existing)
+        return refreshUserIdentity(env, existing, identity, options);
+    return insertUserRow(env, await stableId(`${provider}:${identity.sub}`), identity, options);
+}
+export async function hasScope(env, user, scope, options = {}) {
+    if (user && "auth_strategy" in user && user.auth_strategy === "http_basic")
+        return true;
+    const canonical = isCanonicalAuthUser(user)
+        ? user
+        : user?.authUser ?? await ensureUser(env, user, options);
+    if (!canonical)
+        return false;
+    if (Boolean(canonical.is_admin))
+        return true;
+    return userHasScope(env, canonical.id, scope, options);
+}
+function isCanonicalAuthUser(value) {
+    return Boolean(value && "id" in value && typeof value.id === "string" && value.id);
+}
+export async function listAuthorizationUsers(env, options = {}) {
+    const { users, grants, memberships, groups } = await listUserRows(env, options);
+    const scopesByUser = groupRows(grants, "user_id", (grant) => grant.scope_name);
+    const tenantsByUser = groupRows(memberships, "user_id", ({ user_id: _userId, ...tenant }) => tenant);
+    const groupsByUser = groupRows(groups, "user_id", ({ user_id: _userId, ...group }) => group);
+    return users.map((user) => ({
+        ...user,
+        scopes: scopesByUser.get(user.id) ?? [],
+        groups: groupsByUser.get(user.id) ?? [],
+        tenants: tenantsByUser.get(user.id) ?? [],
+    }));
+}
+export function getAuthorizationUser(env, userId, options = {}) {
+    return getUserRow(env, validateUserId(userId), options);
+}
+async function stableId(value) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+    return [...new Uint8Array(digest)]
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join("")
+        .slice(0, 32);
+}
+function groupRows(rows, key, map) {
+    const grouped = new Map();
+    for (const row of rows) {
+        const group = String(row[key]);
+        const values = grouped.get(group) ?? [];
+        values.push(map(row));
+        grouped.set(group, values);
+    }
+    return grouped;
+}
+//# sourceMappingURL=service.js.map

package/dist/auth/users/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/auth/users/service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,YAAY,GACb,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAExE,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAY,EACZ,KAAc,EACd,OAAO,GAAyC,EAAE;IAElD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5E,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChF,IAAI,QAAQ;QAAE,OAAO,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,aAAa,CAAC,GAAG,EAAE,MAAM,QAAQ,CAAC,GAAG,QAAQ,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAY,EACZ,IAAwD,EACxD,KAAa,EACb,OAAO,GAAuB,EAAE;IAEhC,IAAI,IAAI,IAAI,eAAe,IAAI,IAAI,IAAI,IAAI,CAAC,aAAa,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IACxF,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC;QACzC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAyD;IAEzD,OAAO,OAAO,CAAC,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,KAAK,CAAC,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAY,EACZ,OAAO,GAAyC,EAAE;IAElD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,SAAS,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACrG,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC1B,GAAG,IAAI;QACP,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE;QACvC,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE;QACvC,OAAO,EAAE,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE;KAC1C,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAY,EACZ,MAAe,EACf,OAAO,GAAuB,EAAE;IAEhC,OAAO,UAAU,CAAC,GAAG,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAa;IACnC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;SAC/B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACjD,IAAI,CAAC,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAChB,IAAoB,EACpB,GAAQ,EACR,GAAwB;IAExB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/auth/users/validation.d.ts

@@ -0,0 +1,4 @@
+import type { UserIdentityInput } from "./model.js";
+export declare function normalizeUserIdentity(value: unknown): UserIdentityInput | null;
+export declare function validateUserId(value: unknown): string;
+//# sourceMappingURL=validation.d.ts.map

package/dist/auth/users/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/auth/users/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,GAAG,IAAI,CAa9E;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAIrD"}

package/dist/auth/users/validation.js

@@ -0,0 +1,23 @@
+export function normalizeUserIdentity(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const input = Object.fromEntries(Object.entries(value));
+    const sub = typeof input.sub === "string" ? input.sub.trim() : "";
+    if (!sub)
+        return null;
+    const email = String(input.email ?? "").trim().toLowerCase();
+    return {
+        ...input,
+        sub,
+        email,
+        name: String(input.name ?? (email || sub)),
+        auth_strategy: String(input.auth_strategy ?? "oauth"),
+    };
+}
+export function validateUserId(value) {
+    const userId = String(value ?? "").trim();
+    if (!userId)
+        throw new TypeError("User id is required.");
+    return userId;
+}
+//# sourceMappingURL=validation.js.map

package/dist/auth/users/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/auth/users/validation.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7D,OAAO;QACL,GAAG,KAAK;QACR,GAAG;QACH,KAAK;QACL,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC;QAC1C,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,OAAO,CAAC;KAC1B,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cli/cli.d.ts

@@ -0,0 +1,9 @@
+import { type ProjectCommandResult } from "./project.js";
+import { type SiteStatus } from "./status.js";
+import type { CliOptions } from "./types.js";
+export declare const usage = "Usage:\n  cf-genai check|test|build|ci|ci:lint\n  cf-genai lint data-access\n  cf-genai dev [options]\n  cf-genai storybook [options]\n  cf-genai upgrade <base|auth> <latest|VERSION>\n  cf-genai release [--confirm] [--first] [--add-trust] [--pre] [--dry-run] [--bypass-lint] [--type patch|minor|major] [--version MAJOR.MINOR]\n  cf-genai release-status [--wait MINUTES] [--json]\n    cf-genai status [--env local|staging|production] [--json]\n  cf-genai version\n  cf-genai d1 refresh|backup|restore|migrate|status|check local|staging|production [options]\n  cf-genai admin status|features|users|tenants|scopes|groups|healthchecks|circuit-breakers [options]\n  cf-genai config check [options]\n  cf-genai user list|get|update [username] [options]\n  cf-genai tenant list|get|create|update [tenant-id] [options]\n\nOptions:\n  --database NAME             D1 binding or database name (default: DB)\n  --production-database NAME  Production D1 binding or database name\n  --production-env NAME       Wrangler production environment (default: none)\n  --staging-env NAME          Wrangler staging environment (default: staging)\n  --config PATH               Wrangler config path (default: wrangler.jsonc)\n  --env VALUE                 Environment: local, staging, or production\n  --output PATH               Backup output file\n  --file PATH                 Restore input file\n  --wrangler COMMAND          Wrangler command (default: npx wrangler)\n  --yes                       Confirm a remote staging refresh\n  --confirm-production        Explicitly permit production migration or breaker changes\n  --confirm                    Confirm a destructive or release operation\n  --dry-run                    Show release checks without changing Git or npm\n  --pre                        Publish or refresh the current patch prerelease as <version>-pre\n  --version MAJOR.MINOR        Explicit release target; patch is assigned as .0\n  --bypass-lint                Skip the release preflight lint (use sparingly)\n  --json                      Return machine-readable output\n  --help                      Show this help\n";
+export declare function parseOptions(args: readonly string[], env?: NodeJS.ProcessEnv): CliOptions;
+export type CliCommandResult = Awaited<ProjectCommandResult> | SiteStatus | void;
+export declare function main(args?: readonly string[], env?: NodeJS.ProcessEnv): Promise<CliCommandResult>;
+export type { CliOptions, CliTarget } from "./types.js";
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli/cli.ts"],"names":[],"mappings":"AAIA,OAAO,EAAqB,KAAK,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAa,MAAM,YAAY,CAAC;AAGxD,eAAO,MAAM,KAAK,glEAmCjB,CAAC;AAMF,wBAAgB,YAAY,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,UAAU,CA+CtG;AAED,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,GAAG,UAAU,GAAG,IAAI,CAAC;AAEjF,wBAAsB,IAAI,CAAC,IAAI,GAAE,SAAS,MAAM,EAA0B,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAuC3I;AAWD,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC"}