@capybara-hq/kernel 0.1.0-rc.1 → 0.1.0-rc.2

package/dist/identity/enterprise-admin.js

@@ -1,21 +1,32 @@
-import { sql } from "kysely";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable, Module } from "@nestjs/common";
 import { ApiError } from "../errors.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { XactLock } from "../infra/database/xact-lock.js";
 /**
- * 在调用方事务内取 `capybara.enterprise_admins` 咨询锁（事务结束释放），串行化所有企业管理员写操作
- * （撤销 / 停用 / 新建管理员 / 改部署设置 / CLI 的 `capybara admin grant|revoke`）。只加锁、不鉴权：
- * 没有发起账号的调用方（CLI）用它；有发起账号的用 {@link lockEnterpriseAdminsAndAuthorize}。
+ * The transaction-scoped lock (`XactLock`, `pg_advisory_xact_lock`) that serializes every
+ * enterprise admin write: revoke / disable / create an admin, deployment settings, prices,
+ * purposes, the catalog and extension admin writes, the CLI's `capybara admin grant|revoke`.
  */
-export async function lockEnterpriseAdmins(trx) {
-    await sql `SELECT pg_advisory_xact_lock(hashtext('capybara.enterprise_admins'))`.execute(trx);
-}
+const ENTERPRISE_ADMINS_LOCK = "capybara.enterprise_admins";
 /**
- * 企业管理员写操作的执行期复核（spec 3.6 R5）：{@link lockEnterpriseAdmins} 后在锁内实时确认发起人仍是
- * 活跃企业管理员，否则 `forbidden`。鉴权守卫在请求开头读到的身份可能已过期（另一个管理员刚撤销了他），
- * 必须在锁内重读。
+ * The run-time re-check of an enterprise admin write (spec 3.6 R5), under
+ * {@link ENTERPRISE_ADMINS_LOCK}: the actor must still be an active enterprise admin, else
+ * `forbidden`. The identity the auth guard read at the start of the request may be stale (another
+ * admin just revoked it), so it is re-read under the lock.
  */
-export async function lockEnterpriseAdminsAndAuthorize(trx, actorAccountId) {
-    await lockEnterpriseAdmins(trx);
-    const actor = await trx
+async function assertActiveEnterpriseAdmin(db, actorAccountId) {
+    const actor = await db
         .selectFrom("accounts")
         .select("id")
         .where("id", "=", actorAccountId)
@@ -25,3 +36,46 @@ export async function lockEnterpriseAdminsAndAuthorize(trx, actorAccountId) {
     if (!actor)
         throw new ApiError("forbidden", "Enterprise admin required");
 }
+/**
+ * The enterprise admin lock, the one implementation of "lock, then re-check the actor":
+ * both methods join the caller's transaction (`mandatory`), which holds the lock until it ends.
+ */
+let EnterpriseAdminLock = class EnterpriseAdminLock {
+    db;
+    xactLock;
+    txHost;
+    constructor(db, xactLock, txHost) {
+        this.db = db;
+        this.xactLock = xactLock;
+        this.txHost = txHost;
+    }
+    /** Only the lock (callers without an actor: the CLI, bootstrap). */
+    async lock() {
+        await this.xactLock.lock(ENTERPRISE_ADMINS_LOCK);
+    }
+    /** The lock, then {@link assertActiveEnterpriseAdmin} under it. */
+    async lockAndAuthorize(actorAccountId) {
+        await this.xactLock.lock(ENTERPRISE_ADMINS_LOCK);
+        await assertActiveEnterpriseAdmin(this.db.db, actorAccountId);
+    }
+};
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], EnterpriseAdminLock.prototype, "lock", null);
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], EnterpriseAdminLock.prototype, "lockAndAuthorize", null);
+EnterpriseAdminLock = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(XactLock)),
+    __param(2, Inject(TransactionHost))
+], EnterpriseAdminLock);
+export { EnterpriseAdminLock };
+/** The one {@link EnterpriseAdminLock}: identity, models, the extensions and the catalog import it. */
+let EnterpriseAdminLockModule = class EnterpriseAdminLockModule {
+};
+EnterpriseAdminLockModule = __decorate([
+    Module({ providers: [EnterpriseAdminLock], exports: [EnterpriseAdminLock] })
+], EnterpriseAdminLockModule);
+export { EnterpriseAdminLockModule };

package/dist/identity/external-identity-lock.d.ts

@@ -0,0 +1,17 @@
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { XactLock } from "../infra/database/xact-lock.js";
+/**
+ * The lock of one external identity (one provider per transaction-scoped lock): serializes resolve
+ * / link of the same `(source, externalId)`, whose row may not exist yet, so concurrent first
+ * resolves create one account. Joins the caller's transaction (`mandatory`), which holds it until
+ * it ends.
+ */
+export declare class ExternalIdentityLock {
+    private readonly xactLock;
+    readonly txHost: TransactionHost;
+    constructor(xactLock: XactLock, txHost: TransactionHost);
+    lock(id: {
+        source: string;
+        externalId: string;
+    }): Promise<void>;
+}

package/dist/identity/external-identity-lock.js

@@ -0,0 +1,39 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from "@nestjs/common";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { XactLock } from "../infra/database/xact-lock.js";
+/**
+ * The lock of one external identity (one provider per transaction-scoped lock): serializes resolve
+ * / link of the same `(source, externalId)`, whose row may not exist yet, so concurrent first
+ * resolves create one account. Joins the caller's transaction (`mandatory`), which holds it until
+ * it ends.
+ */
+let ExternalIdentityLock = class ExternalIdentityLock {
+    xactLock;
+    txHost;
+    constructor(xactLock, txHost) {
+        this.xactLock = xactLock;
+        this.txHost = txHost;
+    }
+    async lock(id) {
+        await this.xactLock.lock(`capybara.identity:${id.source}:${id.externalId}`);
+    }
+};
+__decorate([
+    Transactional({ propagation: "mandatory" })
+], ExternalIdentityLock.prototype, "lock", null);
+ExternalIdentityLock = __decorate([
+    Injectable(),
+    __param(0, Inject(XactLock)),
+    __param(1, Inject(TransactionHost))
+], ExternalIdentityLock);
+export { ExternalIdentityLock };

package/dist/identity/external.d.ts

@@ -1,8 +1,9 @@
 import type { ExternalIdentity } from "@capybara-hq/plugin-sdk";
-import { type Transaction } from "kysely";
-import type { KernelConfig } from "../config/schema.js";
-import type { KernelDatabase, KernelDb, LinkedVia } from "../db/kernel-schema.js";
-type Trx = Transaction<KernelDatabase>;
+import type { LinkedVia } from "../db/kernel-schema.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { ExternalIdentityLock } from "./external-identity-lock.js";
 export type { LinkedVia };
 /**
  * 第三方登录拒绝了这个身份（Ruling A18）：身份行经 IM 绑定链接建立，而请求没有带着同一账号的会话。
@@ -45,16 +46,17 @@ export declare function identityPlugin(source: string): string;
 /**
  * 外部身份：按 `(source, externalId)` 映射到账号（登录、渠道入站、通讯录共用同一个键）。
  * 首次出现时按「受信任的身份源 + 两侧邮箱均已验证」合并到既有账号，否则新建账号（不建组织）。
- * 同一身份的并发首次解析用事务级咨询锁串行化，只建一个账号。框架无关，由调用方注入依赖。
+ * Concurrent first resolves of one identity are serialized by {@link ExternalIdentityLock},
+ * so only one account is created.
  */
 export declare class ExternalIdentities {
     private readonly db;
+    readonly txHost: TransactionHost;
+    private readonly identityLock;
     private readonly config;
-    constructor(db: KernelDb, config: () => {
-        auth: Pick<KernelConfig["auth"], "trustedIdentitySources">;
-    });
-    /** 该外部身份绑定的账号 id；未绑定返回 undefined。 */
-    findAccount(source: string, externalId: string, trx?: Trx): Promise<string | undefined>;
+    constructor(db: KernelDb, txHost: TransactionHost, identityLock: ExternalIdentityLock, config: Pick<KernelConfigService, "get">);
+    /** The account the external identity is linked to (in the context's transaction when there is one); undefined when unlinked. */
+    findAccount(source: string, externalId: string): Promise<string | undefined>;
     /**
      * 解析外部身份到账号。已绑定 → 该账号（顺带刷新身份行上的邮箱与资料）；未绑定 → 合并或新建（见类说明），
      * 新身份行记 `linked_via = opts.linkedVia`（合并也是 `sso`）。
@@ -67,14 +69,15 @@ export declare class ExternalIdentities {
      * 新建账号的 `email_verified` 只在身份源受信任且身份邮箱已验证时为 true——不受信任的身份源可以声称任意邮箱
      * 「已验证」，不能让它建出的账号成为日后受信任登录的合并目标。
      * 合并写审计 `identity.linked`，新建写 `account.created`。不判断账号状态，由调用方决定（如登录拒绝停用账号）。
-     * 传 `trx` 时在调用方事务内执行；与 `link` 取同一把咨询锁，兜底用 `ON CONFLICT DO NOTHING` 后回读，
-     * 不抛唯一约束冲突、不中止调用方事务。
+     * Joins the caller's transaction when there is one; takes the same lock as `link`, and falls back
+     * to `ON CONFLICT DO NOTHING` plus a re-read, so it never throws a unique violation or aborts the
+     * caller's transaction.
      */
-    resolve(identity: ExternalIdentity, trx: Trx | undefined, opts: ResolveOptions): Promise<{
+    resolve(identity: ExternalIdentity, opts: ResolveOptions): Promise<{
         accountId: string;
         created: boolean;
     }>;
-    /** 同一身份的 resolve / link 串行化（事务级咨询锁）。 */
+    /** Serializes resolve / link of one identity ({@link ExternalIdentityLock}). */
     private lockIdentity;
     /** 身份源键（`<插件名>:<租户 id>`）是否在 `auth.trustedIdentitySources` 中：按完整键比较，信任按租户（Ruling A19）。 */
     private trusted;
@@ -95,12 +98,13 @@ export declare class ExternalIdentities {
      * 已绑定他人 → `409 identity.taken`。新行记 `linked_via = bind`：这样绑定的身份只能在 IM 里代表此人，
      * 不能直接用于第三方登录（Ruling A18）。与 `resolve` 取同一把咨询锁。新绑定写审计 `identity.linked`。
      */
-    link(accountId: string, identity: ExternalIdentity, trx?: Trx): Promise<void>;
+    link(accountId: string, identity: ExternalIdentity): Promise<void>;
     /**
      * 解除本人的一个外部身份（本地登录名不可解除）；不存在或不属于本人 → `identity.not_found`；
      * 账号没有本地密码且这是最后一个外部身份 → `409 identity.last_login_method`。审计 `identity.unlinked`。
      */
     unlink(accountId: string, source: string, externalId: string): Promise<void>;
+    private unlinkIn;
     /** 账号绑定的外部身份（不含本地登录名），按绑定时间升序。 */
     listForAccount(accountId: string): Promise<LinkedIdentity[]>;
 }

package/dist/identity/external.js

@@ -1,7 +1,22 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
 import { randomUUID } from "node:crypto";
+import { Inject, Injectable } from "@nestjs/common";
 import { sql } from "kysely";
 import { ApiError } from "../errors.js";
+import { KernelConfigService } from "../infra/config/kernel-config.service.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
 import { audit } from "./audit.js";
+import { ExternalIdentityLock } from "./external-identity-lock.js";
 /** `<插件名>:<租户 id>`；插件名同清单规则，租户 id 为非空、不含空白的串。 */
 const SOURCE_RE = /^([a-z0-9][a-z0-9._-]{0,213}):(\S{1,256})$/;
 const MAX_EXTERNAL_ID = 256;
@@ -60,18 +75,23 @@ const profileOf = (i) => JSON.stringify({
 /**
  * 外部身份：按 `(source, externalId)` 映射到账号（登录、渠道入站、通讯录共用同一个键）。
  * 首次出现时按「受信任的身份源 + 两侧邮箱均已验证」合并到既有账号，否则新建账号（不建组织）。
- * 同一身份的并发首次解析用事务级咨询锁串行化，只建一个账号。框架无关，由调用方注入依赖。
+ * Concurrent first resolves of one identity are serialized by {@link ExternalIdentityLock},
+ * so only one account is created.
  */
-export class ExternalIdentities {
+let ExternalIdentities = class ExternalIdentities {
     db;
+    txHost;
+    identityLock;
     config;
-    constructor(db, config) {
+    constructor(db, txHost, identityLock, config) {
         this.db = db;
+        this.txHost = txHost;
+        this.identityLock = identityLock;
         this.config = config;
     }
-    /** 该外部身份绑定的账号 id；未绑定返回 undefined。 */
-    async findAccount(source, externalId, trx) {
-        const row = await (trx ?? this.db)
+    /** The account the external identity is linked to (in the context's transaction when there is one); undefined when unlinked. */
+    async findAccount(source, externalId) {
+        const row = await this.db
             .selectFrom("identities")
             .select("account_id")
             .where("source", "=", source)
@@ -91,68 +111,66 @@ export class ExternalIdentities {
      * 新建账号的 `email_verified` 只在身份源受信任且身份邮箱已验证时为 true——不受信任的身份源可以声称任意邮箱
      * 「已验证」，不能让它建出的账号成为日后受信任登录的合并目标。
      * 合并写审计 `identity.linked`，新建写 `account.created`。不判断账号状态，由调用方决定（如登录拒绝停用账号）。
-     * 传 `trx` 时在调用方事务内执行；与 `link` 取同一把咨询锁，兜底用 `ON CONFLICT DO NOTHING` 后回读，
-     * 不抛唯一约束冲突、不中止调用方事务。
+     * Joins the caller's transaction when there is one; takes the same lock as `link`, and falls back
+     * to `ON CONFLICT DO NOTHING` plus a re-read, so it never throws a unique violation or aborts the
+     * caller's transaction.
      */
-    async resolve(identity, trx, opts) {
+    async resolve(identity, opts) {
         const id = normalize(identity);
-        const run = async (t) => {
-            await this.lockIdentity(t, id);
-            const existing = await this.findRow(t, id);
-            if (existing !== undefined) {
-                if (opts.login !== undefined)
-                    await this.allowLogin(t, id, existing, opts.login);
-                await this.refreshIdentity(t, id);
-                return { accountId: existing.accountId, created: false };
+        await this.lockIdentity(id);
+        const existing = await this.findRow(id);
+        if (existing !== undefined) {
+            if (opts.login !== undefined)
+                await this.allowLogin(id, existing, opts.login);
+            await this.refreshIdentity(id);
+            return { accountId: existing.accountId, created: false };
+        }
+        const merged = opts.allowMerge === true ? await this.mergeTarget(id) : undefined;
+        if (merged !== undefined) {
+            if (!(await this.insertIdentity(merged, id, "sso"))) {
+                return { accountId: await this.mustFind(id), created: false };
             }
-            const merged = opts.allowMerge === true ? await this.mergeTarget(t, id) : undefined;
-            if (merged !== undefined) {
-                if (!(await this.insertIdentity(t, merged, id, "sso"))) {
-                    return { accountId: await this.mustFind(t, id), created: false };
-                }
-                await audit(t, {
-                    actorAccountId: merged,
-                    action: "identity.linked",
-                    target: merged,
-                    detail: { source: id.source, externalId: id.externalId, via: "verified_email" },
-                });
-                return { accountId: merged, created: false };
-            }
-            const accountId = randomUUID();
-            await t
-                .insertInto("accounts")
-                .values({
-                id: accountId,
-                display_name: id.displayName,
-                email: id.email ?? null,
-                email_verified: id.emailVerified && this.trusted(id.source),
-            })
-                .execute();
-            if (!(await this.insertIdentity(t, accountId, id, opts.linkedVia))) {
-                // 不走咨询锁的写入方抢先插入了同一身份：撤销刚建的账号，回读
-                await t.deleteFrom("accounts").where("id", "=", accountId).execute();
-                return { accountId: await this.mustFind(t, id), created: false };
-            }
-            await audit(t, {
-                actorAccountId: accountId,
-                action: "account.created",
-                target: accountId,
-                detail: { source: id.source, externalId: id.externalId },
+            await audit(this.db.db, {
+                actorAccountId: merged,
+                action: "identity.linked",
+                target: merged,
+                detail: { source: id.source, externalId: id.externalId, via: "verified_email" },
             });
-            return { accountId, created: true };
-        };
-        return trx ? run(trx) : this.db.transaction().execute(run);
+            return { accountId: merged, created: false };
+        }
+        const accountId = randomUUID();
+        await this.db
+            .insertInto("accounts")
+            .values({
+            id: accountId,
+            display_name: id.displayName,
+            email: id.email ?? null,
+            email_verified: id.emailVerified && this.trusted(id.source),
+        })
+            .execute();
+        if (!(await this.insertIdentity(accountId, id, opts.linkedVia))) {
+            // 不走咨询锁的写入方抢先插入了同一身份：撤销刚建的账号，回读
+            await this.db.deleteFrom("accounts").where("id", "=", accountId).execute();
+            return { accountId: await this.mustFind(id), created: false };
+        }
+        await audit(this.db.db, {
+            actorAccountId: accountId,
+            action: "account.created",
+            target: accountId,
+            detail: { source: id.source, externalId: id.externalId },
+        });
+        return { accountId, created: true };
     }
-    /** 同一身份的 resolve / link 串行化（事务级咨询锁）。 */
-    async lockIdentity(t, id) {
-        await sql `SELECT pg_advisory_xact_lock(hashtext(${`capybara.identity:${id.source}:${id.externalId}`}))`.execute(t);
+    /** Serializes resolve / link of one identity ({@link ExternalIdentityLock}). */
+    async lockIdentity(id) {
+        await this.identityLock.lock(id);
     }
     /** 身份源键（`<插件名>:<租户 id>`）是否在 `auth.trustedIdentitySources` 中：按完整键比较，信任按租户（Ruling A19）。 */
     trusted(source) {
-        return this.config().auth.trustedIdentitySources.includes(source);
+        return this.config.get().auth.trustedIdentitySources.includes(source);
     }
-    async findRow(t, id) {
-        const row = await t
+    async findRow(id) {
+        const row = await this.db
             .selectFrom("identities")
             .select(["account_id", "linked_via"])
             .where("source", "=", id.source)
@@ -161,33 +179,33 @@ export class ExternalIdentities {
         return row && { accountId: row.account_id, linkedVia: row.linked_via };
     }
     /** 第三方登录能否用这一行（见 {@link resolve}）：只有 `bind` 行需要同一账号的会话，放行时把行改为 `sso`。 */
-    async allowLogin(t, id, row, login) {
+    async allowLogin(id, row, login) {
         const via = row.linkedVia ?? "sso";
         if (via !== "bind")
             return;
         if (login.sessionAccountId !== row.accountId)
             throw new IdentityNotVerified();
-        await t
+        await this.db
             .updateTable("identities")
             .set({ linked_via: "sso" })
             .where("source", "=", id.source)
             .where("external_id", "=", id.externalId)
             .execute();
-        await audit(t, {
+        await audit(this.db.db, {
             actorAccountId: row.accountId,
             action: "identity.verified",
             target: row.accountId,
             detail: { source: id.source, externalId: id.externalId, from: via },
         });
     }
-    async mustFind(t, id) {
-        const owner = await this.findAccount(id.source, id.externalId, t);
+    async mustFind(id) {
+        const owner = await this.findAccount(id.source, id.externalId);
         if (owner === undefined)
             throw new Error("identity vanished after a conflicting insert");
         return owner;
     }
-    async refreshIdentity(t, id) {
-        await t
+    async refreshIdentity(id) {
+        await this.db
             .updateTable("identities")
             .set({ email: id.email ?? null, email_verified: id.emailVerified, profile: profileOf(id) })
             .where("source", "=", id.source)
@@ -198,10 +216,10 @@ export class ExternalIdentities {
      * 可合并的既有账号：身份源键在 `auth.trustedIdentitySources` 中、身份邮箱已验证，
      * 且恰好有一个邮箱已验证、邮箱相同（不区分大小写）的账号；否则 undefined（多个候选时不猜，新建）。
      */
-    async mergeTarget(t, id) {
+    async mergeTarget(id) {
         if (!id.emailVerified || id.email === undefined || !this.trusted(id.source))
             return undefined;
-        const rows = await t
+        const rows = await this.db
             .selectFrom("accounts")
             .select("id")
             .where("email_verified", "=", true)
@@ -211,8 +229,8 @@ export class ExternalIdentities {
         return rows.length === 1 ? rows[0]?.id : undefined;
     }
     /** 插入身份行；已存在（主键冲突）时什么都不做并返回 false。 */
-    async insertIdentity(t, accountId, id, linkedVia) {
-        const row = await t
+    async insertIdentity(accountId, id, linkedVia) {
+        const row = await this.db
             .insertInto("identities")
             .values({
             source: id.source,
@@ -233,30 +251,27 @@ export class ExternalIdentities {
      * 已绑定他人 → `409 identity.taken`。新行记 `linked_via = bind`：这样绑定的身份只能在 IM 里代表此人，
      * 不能直接用于第三方登录（Ruling A18）。与 `resolve` 取同一把咨询锁。新绑定写审计 `identity.linked`。
      */
-    async link(accountId, identity, trx) {
+    async link(accountId, identity) {
         const id = normalize(identity);
-        const run = async (t) => {
-            await this.lockIdentity(t, id);
-            const owner = await this.findAccount(id.source, id.externalId, t);
-            if (owner !== undefined && owner !== accountId)
+        await this.lockIdentity(id);
+        const owner = await this.findAccount(id.source, id.externalId);
+        if (owner !== undefined && owner !== accountId)
+            throw taken();
+        if (owner === accountId) {
+            await this.refreshIdentity(id);
+            return;
+        }
+        if (!(await this.insertIdentity(accountId, id, "bind"))) {
+            if ((await this.mustFind(id)) !== accountId)
                 throw taken();
-            if (owner === accountId) {
-                await this.refreshIdentity(t, id);
-                return;
-            }
-            if (!(await this.insertIdentity(t, accountId, id, "bind"))) {
-                if ((await this.mustFind(t, id)) !== accountId)
-                    throw taken();
-                return;
-            }
-            await audit(t, {
-                actorAccountId: accountId,
-                action: "identity.linked",
-                target: accountId,
-                detail: { source: id.source, externalId: id.externalId, via: "bind" },
-            });
-        };
-        return trx ? run(trx) : this.db.transaction().execute(run);
+            return;
+        }
+        await audit(this.db.db, {
+            actorAccountId: accountId,
+            action: "identity.linked",
+            target: accountId,
+            detail: { source: id.source, externalId: id.externalId, via: "bind" },
+        });
     }
     /**
      * 解除本人的一个外部身份（本地登录名不可解除）；不存在或不属于本人 → `identity.not_found`；
@@ -265,38 +280,44 @@ export class ExternalIdentities {
     async unlink(accountId, source, externalId) {
         if (source === "local")
             throw notFound();
-        await this.db.transaction().execute(async (t) => {
-            const r = await t
-                .deleteFrom("identities")
-                .where("source", "=", source)
-                .where("external_id", "=", externalId)
-                .where("account_id", "=", accountId)
-                .executeTakeFirst();
-            if (r.numDeletedRows === 0n)
-                throw notFound();
-            // 没有本地密码时至少还要剩一个外部身份，否则此人再也登录不了（锁账号行，串行化并发解除）
-            await t.selectFrom("accounts").select("id").where("id", "=", accountId).forUpdate().execute();
-            const password = await t
-                .selectFrom("local_passwords")
-                .select("account_id")
-                .where("account_id", "=", accountId)
-                .executeTakeFirst();
-            const others = await t
-                .selectFrom("identities")
-                .select("source")
-                .where("account_id", "=", accountId)
-                .where("source", "!=", "local")
-                .limit(1)
-                .execute();
-            if (!password && others.length === 0) {
-                throw new ApiError("identity.last_login_method", "Cannot unlink the last sign-in method of an account without a password");
-            }
-            await audit(t, {
-                actorAccountId: accountId,
-                action: "identity.unlinked",
-                target: accountId,
-                detail: { source, externalId },
-            });
+        await this.unlinkIn(accountId, source, externalId);
+    }
+    async unlinkIn(accountId, source, externalId) {
+        const r = await this.db
+            .deleteFrom("identities")
+            .where("source", "=", source)
+            .where("external_id", "=", externalId)
+            .where("account_id", "=", accountId)
+            .executeTakeFirst();
+        if (r.numDeletedRows === 0n)
+            throw notFound();
+        // 没有本地密码时至少还要剩一个外部身份，否则此人再也登录不了（锁账号行，串行化并发解除）
+        await this.db
+            .selectFrom("accounts")
+            .select("id")
+            .where("id", "=", accountId)
+            .forUpdate()
+            .execute();
+        const password = await this.db
+            .selectFrom("local_passwords")
+            .select("account_id")
+            .where("account_id", "=", accountId)
+            .executeTakeFirst();
+        const others = await this.db
+            .selectFrom("identities")
+            .select("source")
+            .where("account_id", "=", accountId)
+            .where("source", "!=", "local")
+            .limit(1)
+            .execute();
+        if (!password && others.length === 0) {
+            throw new ApiError("identity.last_login_method", "Cannot unlink the last sign-in method of an account without a password");
+        }
+        await audit(this.db.db, {
+            actorAccountId: accountId,
+            action: "identity.unlinked",
+            target: accountId,
+            detail: { source, externalId },
         });
     }
     /** 账号绑定的外部身份（不含本地登录名），按绑定时间升序。 */
@@ -332,6 +353,23 @@ export class ExternalIdentities {
             };
         });
     }
-}
+};
+__decorate([
+    Transactional()
+], ExternalIdentities.prototype, "resolve", null);
+__decorate([
+    Transactional()
+], ExternalIdentities.prototype, "link", null);
+__decorate([
+    Transactional()
+], ExternalIdentities.prototype, "unlinkIn", null);
+ExternalIdentities = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(ExternalIdentityLock)),
+    __param(3, Inject(KernelConfigService))
+], ExternalIdentities);
+export { ExternalIdentities };
 const taken = () => new ApiError("identity.taken", "This external identity is already linked to another account");
 const notFound = () => new ApiError("identity.not_found", "External identity not found");

package/dist/identity/identity.module.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Identity: accounts, sessions, API tokens, deployment settings and the enterprise admin lock,
+ * external identities with IM binding and third-party sign-in.
+ */
+export declare class IdentityModule {
+}