@chevre/domain 22.11.0-alpha.10 → 22.11.0-alpha.12

package/example/src/chevre/roles/{addAdminInventoryManagerRole.ts → addProjectCreatorRole.ts}

@@ -9,13 +9,11 @@ async function main() {
     const roleRepo = await chevre.repository.Role.createInstance(mongoose.connection);
 
     const roleNames = [
-        chevre.factory.role.organizationRole.RoleName.AdminInventoryManager
+        'projectCreator'
     ];
     const permissions = [
-        'iam.members.me.read',
-        'admin.creativeWorks.*',
-        'admin.sellers.eventSeries.*',
-        'admin.sellers.read'
+        'aggregations.read',
+        'projects.create'
     ];
     for (const roleName of roleNames) {
         const existingRoles = await roleRepo.projectFields(
@@ -26,8 +24,8 @@ async function main() {
         );
         if (existingRoles.length === 0) {
             const createResult = await roleRepo.create({
-                roleName: roleName,
-                member: { typeOf: chevre.factory.creativeWorkType.SoftwareApplication },
+                roleName: <any>roleName,
+                member: { typeOf: chevre.factory.personType.Person },
                 memberOf: { typeOf: chevre.factory.organizationType.Project },
                 permissions: []
             });
@@ -35,7 +33,7 @@ async function main() {
         }
         for (const permission of permissions) {
             const result = await roleRepo.addPermissionIfNotExists({
-                roleName: { $eq: roleName },
+                roleName: { $eq: <any>roleName },
                 permission
             });
             console.log('permission added.', result, roleName);

package/example/src/chevre/roles/assignGlobalRoles.ts

@@ -0,0 +1,72 @@
+// tslint:disable:no-console
+import type { CognitoIdentityProvider as CognitoIdentityServiceProvider } from '@aws-sdk/client-cognito-identity-provider';
+import * as mongoose from 'mongoose';
+
+import { IGlobalMember } from '../../../../lib/chevre/repo/mongoose/schemas/member/global';
+import { chevre } from '../../../../lib/index';
+
+const { PROJECT_CREATOR_SUB } = process.env;
+
+let cognitoIdentityServiceProvider: CognitoIdentityServiceProvider | undefined;
+
+async function main() {
+    if (typeof PROJECT_CREATOR_SUB !== 'string') {
+        throw new Error('PROJECT_CREATOR_SUB setting required');
+    }
+
+    await mongoose.connect(<string>process.env.MONGOLAB_URI, { autoIndex: false });
+
+    const memberRepo = await chevre.repository.Member.createInstance(mongoose.connection);
+    const settingRepo = await chevre.repository.Setting.createInstance(mongoose.connection);
+    const setting = await settingRepo.findOne({ project: { id: { $eq: '*' } } }, ['userPoolIdNew']);
+    if (typeof setting?.userPoolIdNew !== 'string') {
+        throw new chevre.factory.errors.NotFound('setting.userPoolIdNew');
+    }
+
+    let globalMember: IGlobalMember;
+
+    if (cognitoIdentityServiceProvider === undefined) {
+        const { CognitoIdentityProvider } = await import('@aws-sdk/client-cognito-identity-provider');
+        const { fromEnv } = await import('@aws-sdk/credential-providers');
+        cognitoIdentityServiceProvider = new CognitoIdentityProvider({
+            apiVersion: 'latest',
+            region: 'ap-northeast-1',
+            credentials: fromEnv()
+        });
+    }
+    const personRepo = await chevre.repository.Person.createInstance({
+        userPoolId: setting.userPoolIdNew,
+        cognitoIdentityServiceProvider
+    });
+    const profile = await personRepo.findById({ userId: PROJECT_CREATOR_SUB });
+    const memberName = (typeof profile.givenName === 'string' && typeof profile.familyName === 'string')
+        ? `${profile.givenName} ${profile.familyName}`
+        : profile.memberOf?.membershipNumber;
+
+    globalMember = {
+        typeOf: chevre.factory.role.RoleType.OrganizationRole,
+        member: {
+            typeOf: chevre.factory.personType.Person,
+            id: profile.id,
+            name: memberName,
+            username: profile.memberOf?.membershipNumber,
+            hasRole: [{
+                typeOf: chevre.factory.role.RoleType.OrganizationRole,
+                roleName: <any>'projectCreator'
+            }]
+        }
+    };
+    console.log(profile, globalMember);
+
+    const existingGlobalMemberRoles = await memberRepo.findGlobalRoleNamesByMember({ member: { id: { $eq: globalMember.member.id } } });
+    console.log('existingGlobalMemberRoles:', existingGlobalMemberRoles);
+
+    // 権限作成
+    await memberRepo.createGlobalMember([globalMember]);
+}
+
+main()
+    .then(() => {
+        console.log('success!');
+    })
+    .catch(console.error);

package/example/src/chevre/roles/findPermissions.ts

@@ -0,0 +1,84 @@
+// tslint:disable:no-console
+// import * as moment from 'moment';
+import * as mongoose from 'mongoose';
+
+import { chevre } from '../../../../lib/index';
+
+const formatter = new Intl.NumberFormat('ja-JP');
+
+const PROJECT_ID = String(process.env.PROJECT_ID);
+const memberId = 'b3640a78-babd-4da4-81d3-7dcf4881a4a5';
+
+async function main() {
+    await mongoose.connect(<string>process.env.MONGOLAB_URI);
+
+    const memberRepo = await chevre.repository.Member.createInstance(mongoose.connection);
+    const roleRepo = await chevre.repository.Role.createInstance(mongoose.connection);
+
+    let startTime: [number, number] = process.hrtime();
+    let diff: [number, number] = process.hrtime(startTime);
+    let result: any;
+
+    startTime = process.hrtime();
+    result = await (await chevre.service.iam.createService()).findProjectPermissionsByMember({
+        project: { id: PROJECT_ID },
+        member: {
+            id: memberId,
+            memberOf: {
+                id: PROJECT_ID,
+                typeOf: chevre.factory.organizationType.Project
+            }
+        }
+    })({
+        member: memberRepo,
+        role: roleRepo
+    });
+    diff = process.hrtime(startTime);
+    console.log('diff:', [diff[0], formatter.format(diff[1])]);
+    console.log(result.roleNames.length, 'roleNames found');
+    console.log(result.permissions.length, 'permissions found');
+
+    startTime = process.hrtime();
+    result = await (await chevre.service.iam.createService()).findProjectPermissionsByMember({
+        project: { id: PROJECT_ID },
+        member: {
+            id: memberId,
+            memberOf: {
+                id: PROJECT_ID,
+                typeOf: chevre.factory.organizationType.Project
+            }
+        }
+    })({
+        member: memberRepo,
+        role: roleRepo
+    });
+    diff = process.hrtime(startTime);
+    console.log('diff:', [diff[0], formatter.format(diff[1])]);
+    console.log(result.roleNames.length, 'roleNames found');
+    console.log(result.permissions.length, 'permissions found');
+
+    startTime = process.hrtime();
+    result = await (await chevre.service.iam.createService()).findProjectPermissionsByMember({
+        project: { id: PROJECT_ID },
+        member: {
+            id: memberId,
+            memberOf: {
+                id: PROJECT_ID,
+                typeOf: chevre.factory.organizationType.Project
+            }
+        }
+    })({
+        member: memberRepo,
+        role: roleRepo
+    });
+    diff = process.hrtime(startTime);
+    console.log('diff:', [diff[0], formatter.format(diff[1])]);
+    console.log(result.roleNames.length, 'roleNames found');
+    console.log(result.permissions.length, 'permissions found');
+
+    console.log(result);
+}
+
+main()
+    .then(console.log)
+    .catch(console.error);

package/example/src/chevre/roles/findRoleNames.ts

@@ -0,0 +1,117 @@
+// tslint:disable:no-console
+// import * as moment from 'moment';
+import * as mongoose from 'mongoose';
+
+import { chevre } from '../../../../lib/index';
+
+const formatter = new Intl.NumberFormat('ja-JP');
+
+const PROJECT_ID = String(process.env.PROJECT_ID);
+const memberId = 'xxx';
+
+// tslint:disable-next-line:max-func-body-length
+async function main() {
+    await mongoose.connect(<string>process.env.MONGOLAB_URI);
+
+    const memberRepo = await chevre.repository.Member.createInstance(mongoose.connection);
+
+    let startTime: [number, number] = process.hrtime();
+    let diff: [number, number] = process.hrtime(startTime);
+    let result: any;
+
+    // startTime = process.hrtime();
+    // result = await memberRepo.aggregateRoleNames({
+    //     project: { id: { $eq: PROJECT_ID } },
+    //     member: {
+    //         id: { $eq: memberId },
+    //         memberOf: {
+    //             id: { $eq: PROJECT_ID },
+    //             typeOf: { $eq: chevre.factory.organizationType.Project }
+    //         }
+    //     }
+    // });
+    // diff = process.hrtime(startTime);
+    // console.log('diff:', [diff[0], formatter.format(diff[1])]);
+    // console.log(result.length, 'result found');
+
+    // startTime = process.hrtime();
+    // result = await memberRepo.aggregateRoleNames({
+    //     project: { id: { $eq: PROJECT_ID } },
+    //     member: {
+    //         id: { $eq: memberId },
+    //         memberOf: {
+    //             id: { $eq: PROJECT_ID },
+    //             typeOf: { $eq: chevre.factory.organizationType.Project }
+    //         }
+    //     }
+    // });
+    // diff = process.hrtime(startTime);
+    // console.log('diff:', [diff[0], formatter.format(diff[1])]);
+    // console.log(result.length, 'result found');
+
+    // startTime = process.hrtime();
+    // result = await memberRepo.aggregateRoleNames({
+    //     project: { id: { $eq: PROJECT_ID } },
+    //     member: {
+    //         id: { $eq: memberId },
+    //         memberOf: {
+    //             id: { $eq: PROJECT_ID },
+    //             typeOf: { $eq: chevre.factory.organizationType.Project }
+    //         }
+    //     }
+    // });
+    // diff = process.hrtime(startTime);
+    // console.log('diff:', [diff[0], formatter.format(diff[1])]);
+    // console.log(result.length, 'result found');
+    // console.log(result);
+
+    startTime = process.hrtime();
+    result = await memberRepo.findRoleNamesByMember({
+        project: { id: { $eq: PROJECT_ID } },
+        member: {
+            id: { $eq: memberId },
+            memberOf: {
+                id: { $eq: PROJECT_ID },
+                typeOf: { $eq: chevre.factory.organizationType.Project }
+            }
+        }
+    });
+    diff = process.hrtime(startTime);
+    console.log('diff:', [diff[0], formatter.format(diff[1])]);
+    console.log(result.length, 'result found');
+
+    startTime = process.hrtime();
+    result = await memberRepo.findRoleNamesByMember({
+        project: { id: { $eq: PROJECT_ID } },
+        member: {
+            id: { $eq: memberId },
+            memberOf: {
+                id: { $eq: PROJECT_ID },
+                typeOf: { $eq: chevre.factory.organizationType.Project }
+            }
+        }
+    });
+    diff = process.hrtime(startTime);
+    console.log('diff:', [diff[0], formatter.format(diff[1])]);
+    console.log(result.length, 'result found');
+
+    startTime = process.hrtime();
+    result = await memberRepo.findRoleNamesByMember({
+        project: { id: { $eq: PROJECT_ID } },
+        member: {
+            id: { $eq: memberId },
+            memberOf: {
+                id: { $eq: PROJECT_ID },
+                typeOf: { $eq: chevre.factory.organizationType.Project }
+            }
+        }
+    });
+    diff = process.hrtime(startTime);
+    console.log('diff:', [diff[0], formatter.format(diff[1])]);
+    console.log(result.length, 'result found');
+    console.log(result);
+}
+
+main()
+    .then(console.log)
+    .catch(console.error);

package/example/src/idaas/auth0/adminApplications.ts

@@ -0,0 +1,183 @@
+// tslint:disable:no-implicit-dependencies no-console no-magic-numbers
+import { ManagementClient } from 'auth0';
+import { readFileSync } from 'fs';
+import * as moment from 'moment';
+// import * as crypto from 'crypto'; // client_secret 生成用 (PKJWTなしの場合)
+// import { JWK, importPKCS8, generateKeyPair, SignJWT } from 'jose'; // Private Key JWT 用
+
+const PUBLIC_KEY_FILE_PATH = `${__dirname}/../../samplePublicKey.pem`;
+const { AUTH0_DOMAIN, AUTH0_MGMT_CLIENT_ID, AUTH0_MGMT_CLIENT_SECRET, AUTH0_MGMT_API_AUDIENCE, AUTH0_AUDIENCE } = process.env;
+
+if (typeof AUTH0_DOMAIN !== 'string'
+    || typeof AUTH0_MGMT_CLIENT_ID !== 'string'
+    || typeof AUTH0_MGMT_CLIENT_SECRET !== 'string'
+    || typeof AUTH0_MGMT_API_AUDIENCE !== 'string'
+    || typeof AUTH0_AUDIENCE !== 'string'
+) {
+    throw new Error('set envs!');
+}
+
+// --- Auth0 ManagementClient の初期化 ---
+const management = new ManagementClient({
+    domain: AUTH0_DOMAIN,
+    clientId: AUTH0_MGMT_CLIENT_ID,
+    clientSecret: AUTH0_MGMT_CLIENT_SECRET,
+    audience: AUTH0_MGMT_API_AUDIENCE
+    // scope: 'read:clients create:clients' // 必要なスコープを明示
+});
+
+async function sleep(waitInSeconds: number) {
+    await new Promise<void>((resolve) => {
+        setTimeout(
+            () => {
+                resolve();
+            },
+            waitInSeconds
+        );
+    });
+}
+
+/**
+ * アプリケーションを検索し、存在しなければ作成します。
+ * Private Key JWT 認証を使用する前提。
+ */
+async function findOrCreateServiceAccount(
+    appName: string,
+    projectId: string,
+    roles: string[],
+    audience: string
+) {
+    try {
+        console.log('getting organization...');
+        const getOrganizationResponse = await management.organizations.getByName({
+            name: projectId
+        });
+        const organization = getOrganizationResponse.data;
+        console.log('organization exists.', organization);
+
+        const newClient = (await management.clients.create({
+            name: appName,
+            app_type: 'non_interactive', // Machine to Machine アプリケーション
+            jwt_configuration: { // Private Key JWT の設定
+                alg: 'RS256' // 署名アルゴリズム
+            },
+            // token_endpoint_auth_method: 'client_secret_post',
+            client_authentication_methods: {
+                private_key_jwt: {
+                    credentials: [{
+                        alg: 'RS256',
+                        /**
+                         * Credential type. Supported types: public_key.
+                         *
+                         */
+                        credential_type: 'public_key',
+                        // name?: string;
+                        pem: readFileSync(PUBLIC_KEY_FILE_PATH, 'utf8')
+
+                    }]
+                }
+            },
+            grant_types: ['client_credentials'],
+            organization_usage: 'require', // 組織での利用を許可
+            default_organization: {
+                organization_id: organization.id,
+                flows: ['client_credentials']
+            },
+            oidc_conformant: true,
+            client_metadata: {
+                roles: JSON.stringify(roles)
+            }
+        })).data;
+        console.log(`Successfully created new application: ${newClient.client_id} (${newClient.name})`);
+
+        console.log(`checking clientGrant... ${newClient.client_id} (${newClient.name})`);
+        await sleep(3000);
+
+        let clientGrant = (await management.clientGrants.getAll({
+            audience,
+            client_id: newClient.client_id
+        })).data.shift();
+        if (clientGrant === undefined) {
+            clientGrant = (await management.clientGrants.create({
+                client_id: newClient.client_id,
+                audience,
+                organization_usage: 'require',
+                allow_any_organization: false,
+                scope: ['iam.members.me.read']
+            })).data;
+            console.log(`clientGrant created. ${newClient.client_id} (${newClient.name})`);
+        } else {
+            console.log(`clientGrant already exists. ${newClient.client_id} (${newClient.name})`);
+        }
+
+        console.log(`checking organizationClientGrant... ${newClient.client_id} (${newClient.name})`);
+        await sleep(3000);
+        const organizationClientGrant = (await management.organizations.getOrganizationClientGrants({
+            id: organization.id,
+            audience: 'https://development.apis.smart-theater.com',
+            client_id: newClient.client_id
+        })).data.shift();
+        if (organizationClientGrant === undefined) {
+            await management.organizations.postOrganizationClientGrants(
+                {
+                    id: organization.id
+                },
+                {
+                    grant_id: clientGrant.id
+                }
+            );
+            console.log(`organizationClientGrant created. ${newClient.client_id} (${newClient.name})`);
+        } else {
+            console.log(`organizationClientGrant already exists. ${newClient.client_id} (${newClient.name})`);
+        }
+
+        // 1. アプリケーションを検索 (名前で検索するのが一般的)
+        console.log('searching for applications...');
+        await sleep(3000);
+
+        await searchClients({ organization });
+    } catch (error) {
+        console.error(`Error finding or creating application: ${error.message}`);
+        throw error;
+    }
+}
+
+async function searchClients(params: {
+    organization: { id: string };
+}) {
+    const existingApps = await management.clients.getAll({
+        include_totals: true,
+        // app_type: 'non_interactive',
+        // is_global: false,
+        // page: 0,
+        // per_page: 50,
+        // q: `name:"${appName}"`, // 名前で検索
+        q: `client_grant.organization_id:"${params.organization.id}"`,
+        // from: undefined,
+        take: 50
+        // is_client_credentials: true // Machine to Machine アプリケーションに絞る
+    });
+    const clients = existingApps.data.clients;
+    console.log(clients.length, 'existingApps exist.', clients);
+    console.log(clients.length, 'clients found.');
+}
+
+export async function run() {
+    if (typeof AUTH0_AUDIENCE !== 'string') {
+        throw new Error('set envs!');
+    }
+
+    try {
+        await findOrCreateServiceAccount(
+            `sampleServiceAccount-${moment()
+                .format('YYYY-MM-DDTHH:mm:ss')}`,
+            'cinerino',
+            ['inventoryManager', 'user'],
+            AUTH0_AUDIENCE
+        );
+    } catch (error) {
+        console.error('Failed to run provisioning script:', error);
+    }
+}
+
+run();

package/example/src/idaas/auth0/getToken.ts

@@ -0,0 +1,55 @@
+// tslint:disable:no-implicit-dependencies no-console
+interface IAuth0Config {
+    auth0Domain: string;
+    clientId: string;
+    clientSecret: string;
+    audience: string;
+}
+
+// 環境変数から機密情報を取得することを強く推奨します
+const config: IAuth0Config = {
+    auth0Domain: String(process.env.AUTH0_DOMAIN),
+    clientId: String(process.env.AUTH0_CLIENT_ID),
+    clientSecret: String(process.env.AUTH0_CLIENT_SECRET),
+    audience: String(process.env.AUTH0_AUDIENCE)
+    // scopes: process.env.OKTA_SCOPES || 'api_access_scope openid', // 必要なスコープを指定
+    // authServerId: 'aussd9v86wlIar3cX697', // デフォルト承認サーバーを使用する場合はコメントアウトまたは指定しない
+};
+
+async function getToken() {
+    try {
+        const response = await fetch(
+            `https://${config.auth0Domain}/oauth/token`,
+            {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({
+                    client_id: config.clientId,
+                    client_secret: config.clientSecret,
+                    audience: config.audience,
+                    grant_type: 'client_credentials'
+                    // organization: 'org_zuMP9ng42QSgZ5Kn'
+                })
+            });
+
+        if (!response.ok) {
+            console.log(await response.json());
+            throw new Error('Network response was not ok');
+        }
+
+        const data = await response.json();
+        console.log(data);
+
+        return data;
+    } catch (error) {
+        console.error('Error fetching token:', error);
+    }
+}
+
+export async function main() {
+    const token = await getToken();
+    console.log(token);
+}
+
+main()
+    .catch(console.error);

package/example/src/idaas/auth0/getTokenByPrivateKeyJWT.ts

@@ -0,0 +1,84 @@
+// tslint:disable:no-implicit-dependencies no-console
+import * as crypto from 'crypto';
+import { readFileSync } from 'fs';
+import { SignJWT } from 'jose';
+import * as uuid from 'uuid';
+
+const PRIVATE_KEY_FILE_PATH = `${__dirname}/../../samplePrivateKey.pem`;
+
+interface IAuth0Config {
+    auth0Domain: string;
+    clientId: string;
+    privateKeyContent: string; // PEM形式の秘密鍵の内容 (例: fs.readFileSync('private_key.pem', 'utf8'))
+    audience: string;
+}
+
+// 環境変数から機密情報を取得することを強く推奨します
+const auth0config: IAuth0Config = {
+    auth0Domain: String(process.env.AUTH0_DOMAIN),
+    clientId: String(process.env.AUTH0_CLIENT_ID),
+    // keyId: 'xxx',
+    privateKeyContent: readFileSync(PRIVATE_KEY_FILE_PATH, 'utf8'), // 秘密鍵の内容を読み込む
+    audience: String(process.env.AUTH0_AUDIENCE)
+    // scopes: process.env.OKTA_SCOPES || 'api_access_scope openid', // 必要なスコープを指定
+    // authServerId: 'aussd9v86wlIar3cX697', // デフォルト承認サーバーを使用する場合はコメントアウトまたは指定しない
+};
+
+async function generateJwtAssertion(config: IAuth0Config) {
+    const privateKeyPEM = crypto.createPrivateKey(readFileSync(PRIVATE_KEY_FILE_PATH, 'utf8'));
+
+    return new SignJWT({})
+        .setProtectedHeader({
+            alg: 'RS256' // or RS384 or PS256
+            // kid: '(OPTIONAL) KID_GENERATED_BY_AUTH0'
+        })
+        .setIssuedAt()
+        .setIssuer(config.clientId)
+        .setSubject(config.clientId)
+        .setAudience(`https://${config.auth0Domain}/`)
+        .setExpirationTime('1m')
+        .setJti(uuid.v4())
+        .sign(privateKeyPEM);
+}
+
+async function getToken() {
+    try {
+        const jwtAssertion = await generateJwtAssertion(auth0config);
+        console.log('jwtAssertion:', jwtAssertion);
+
+        const body = new URLSearchParams({
+            grant_type: 'client_credentials',
+            client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
+            client_assertion: jwtAssertion,
+            audience: auth0config.audience
+            // scope: config.scopes,
+        }).toString();
+        const response = await fetch(
+            `https://${auth0config.auth0Domain}/oauth/token`,
+            {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: body
+            });
+
+        if (!response.ok) {
+            console.log(await response.json());
+            throw new Error('Network response was not ok');
+        }
+
+        const data = await response.json();
+        console.log(data);
+
+        return data;
+    } catch (error) {
+        console.error('Error fetching token:', error);
+    }
+}
+
+export async function main() {
+    const token = await getToken();
+    console.log(token);
+}
+
+main()
+    .catch(console.error);

package/lib/chevre/repo/member.d.ts

@@ -1,11 +1,13 @@
 import type { Connection, FilterQuery } from 'mongoose';
 import * as factory from '../factory';
+import { IGlobalMember } from './mongoose/schemas/member/global';
 type IKeyOfProjection = keyof factory.iam.IMember;
 export type ICustomerMember = Pick<factory.iam.IMemberOfRole, 'hasRole' | 'id' | 'name' | 'memberOf'>;
 /**
  * IAMメンバーリポジトリ
  */
 export declare class MemberRepo {
+    private readonly globalMemberModel;
     private readonly memberModel;
     constructor(connection: Connection);
     static CREATE_MONGO_CONDITIONS(params: factory.iam.ISearchConditions): FilterQuery<factory.iam.IMember>[];
@@ -37,7 +39,10 @@ export declare class MemberRepo {
     }): Promise<{
         member: ICustomerMember;
     }[]>;
-    aggregateRoleNames(params: {
+    /**
+     * distinctコマンドを使用して、プロジェクトメンバーのロールを検索する
+     */
+    findRoleNamesByMember(params: {
         project: {
             id: {
                 $eq: string;
@@ -56,9 +61,7 @@ export declare class MemberRepo {
                 };
             };
         };
-    }): Promise<{
-        roleName: string;
-    }[]>;
+    }): Promise<string[]>;
     deleteByProject(params: {
         project: {
             id: string;
@@ -163,6 +166,21 @@ export declare class MemberRepo {
         filter: any;
         $unset: any;
     }): Promise<import("mongoose").UpdateWriteOpResult>;
+    /**
+     * グローバルメンバー作成
+     * 2025-07-21~
+     */
+    createGlobalMember(params: IGlobalMember[]): Promise<void>;
+    /**
+     * distinctコマンドを使用して、グローバルメンバーのロールを検索する
+     */
+    findGlobalRoleNamesByMember(params: {
+        member: {
+            id: {
+                $eq: string;
+            };
+        };
+    }): Promise<string[]>;
     private projectFields;
 }
 export {};

package/lib/chevre/repo/member.js

@@ -13,16 +13,19 @@ exports.MemberRepo = void 0;
 const factory = require("../factory");
 const settings_1 = require("../settings");
 const member_1 = require("./mongoose/schemas/member");
+const global_1 = require("./mongoose/schemas/member/global");
 const AVAILABLE_PROJECT_FIELDS = [
     'project',
     'typeOf',
     'member'
 ];
+const ANY_PROJECT_ID = '*';
 /**
  * IAMメンバーリポジトリ
  */
 class MemberRepo {
     constructor(connection) {
+        this.globalMemberModel = connection.model(global_1.modelName, (0, global_1.createSchema)());
         this.memberModel = connection.model(member_1.modelName, (0, member_1.createSchema)());
     }
     // tslint:disable-next-line:cyclomatic-complexity max-func-body-length
@@ -112,7 +115,7 @@ class MemberRepo {
                 throw new factory.errors.ArgumentNull('project.id');
             }
             const filterQueries = MemberRepo.CREATE_MONGO_CONDITIONS({
-                project: { id: { $in: [params.project.id, '*'] } }, // 全プロジェクトで利用可能なクライアントを考慮(2025-01-11~)
+                project: { id: { $in: [params.project.id, ANY_PROJECT_ID] } }, // 全プロジェクトで利用可能なクライアントを考慮(2025-01-11~)
                 member: {
                     typeOf: { $eq: factory.creativeWorkType.WebApplication },
                     memberOf: { typeOf: { $eq: factory.organizationType.Project } }, // プロジェクトメンバーのはず
@@ -163,32 +166,55 @@ class MemberRepo {
                 .exec();
         });
     }
-    aggregateRoleNames(params) {
+    // migrate to findRoleNamesByMember(2025-07-21~)
+    // public async aggregateRoleNames(params: {
+    //     project: { id: { $eq: string } };
+    //     member: {
+    //         id: { $eq: string };
+    //         memberOf: {
+    //             id: { $eq: string };
+    //             typeOf: { $eq: factory.organizationType.Corporation | factory.organizationType.Project };
+    //         };
+    //     };
+    // }): Promise<{ roleName: string }[]> {
+    //     const matchStages: IMatchStage[] = [
+    //         { $match: { 'project.id': { $eq: params.project.id.$eq } } },
+    //         { $match: { 'member.id': { $eq: params.member.id.$eq } } },
+    //         { $match: { 'member.memberOf.id': { $eq: params.member.memberOf.id.$eq } } },
+    //         { $match: { 'member.memberOf.typeOf': { $eq: params.member.memberOf.typeOf.$eq } } }
+    //     ];
+    //     const aggregate = this.memberModel.aggregate([
+    //         // ...(typeof params.sort?.productID === 'number')
+    //         //     ? [{ $sort: { productID: params.sort.productID } }]
+    //         //     : [],
+    //         ...matchStages,
+    //         {
+    //             $unwind: {
+    //                 path: '$member.hasRole'
+    //             }
+    //         },
+    //         {
+    //             $project: {
+    //                 _id: 0,
+    //                 roleName: '$member.hasRole.roleName'
+    //             }
+    //         }
+    //     ]);
+    //     return aggregate.option({ maxTimeMS: MONGO_MAX_TIME_MS })
+    //         .exec();
+    // }
+    /**
+     * distinctコマンドを使用して、プロジェクトメンバーのロールを検索する
+     */
+    findRoleNamesByMember(params) {
         return __awaiter(this, void 0, void 0, function* () {
-            const matchStages = [
-                { $match: { 'project.id': { $eq: params.project.id.$eq } } },
-                { $match: { 'member.id': { $eq: params.member.id.$eq } } },
-                { $match: { 'member.memberOf.id': { $eq: params.member.memberOf.id.$eq } } },
-                { $match: { 'member.memberOf.typeOf': { $eq: params.member.memberOf.typeOf.$eq } } }
-            ];
-            const aggregate = this.memberModel.aggregate([
-                // ...(typeof params.sort?.productID === 'number')
-                //     ? [{ $sort: { productID: params.sort.productID } }]
-                //     : [],
-                ...matchStages,
-                {
-                    $unwind: {
-                        path: '$member.hasRole'
-                    }
-                },
-                {
-                    $project: {
-                        _id: 0,
-                        roleName: '$member.hasRole.roleName'
-                    }
-                }
-            ]);
-            return aggregate.option({ maxTimeMS: settings_1.MONGO_MAX_TIME_MS })
+            return this.memberModel.distinct('member.hasRole.roleName', {
+                'project.id': { $eq: params.project.id.$eq },
+                'member.id': { $eq: params.member.id.$eq },
+                'member.memberOf.id': { $eq: params.member.memberOf.id.$eq },
+                'member.memberOf.typeOf': { $eq: params.member.memberOf.typeOf.$eq }
+            })
+                .setOptions({ maxTimeMS: settings_1.MONGO_MAX_TIME_MS })
                 .exec();
         });
     }
@@ -293,7 +319,9 @@ class MemberRepo {
             if (typeof params.page !== 'number') {
                 throw new factory.errors.ArgumentNull('page');
             }
-            const matchStages = [{ $match: { 'member.id': { $eq: params.member.id } } }];
+            const matchStages = [
+                { $match: { 'member.id': { $eq: params.member.id } } }
+            ];
             if (typeof ((_b = (_a = params.project) === null || _a === void 0 ? void 0 : _a.id) === null || _b === void 0 ? void 0 : _b.$eq) === 'string') {
                 matchStages.push({ $match: { 'project.id': { $eq: params.project.id.$eq } } });
             }
@@ -343,6 +371,32 @@ class MemberRepo {
                 .exec();
         });
     }
+    /**
+     * グローバルメンバー作成
+     * 2025-07-21~
+     */
+    createGlobalMember(params) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (params.length > 0) {
+                yield this.globalMemberModel.insertMany(params.map(({ typeOf, member }) => ({ typeOf, member })));
+            }
+            else {
+                // no op
+            }
+        });
+    }
+    /**
+     * distinctコマンドを使用して、グローバルメンバーのロールを検索する
+     */
+    findGlobalRoleNamesByMember(params) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.globalMemberModel.distinct('member.hasRole.roleName', {
+                'member.id': { $eq: params.member.id.$eq }
+            })
+                .setOptions({ maxTimeMS: settings_1.MONGO_MAX_TIME_MS })
+                .exec();
+        });
+    }
     projectFields(params, inclusion) {
         return __awaiter(this, void 0, void 0, function* () {
             const conditions = MemberRepo.CREATE_MONGO_CONDITIONS(params);

package/lib/chevre/repo/mongoose/schemas/member/global.d.ts

@@ -0,0 +1,14 @@
+import { IndexDefinition, IndexOptions, Model, Schema, SchemaDefinition } from 'mongoose';
+import * as factory from '../../../../factory';
+type IMemberOfRole = Pick<factory.iam.IMemberOfRole, 'hasRole' | 'id' | 'image' | 'name' | 'typeOf' | 'username'>;
+type IGlobalMember = Pick<factory.iam.IMember, 'typeOf'> & {
+    member: IMemberOfRole;
+};
+type IDocType = IGlobalMember;
+type IModel = Model<IDocType>;
+type ISchemaDefinition = SchemaDefinition<IDocType>;
+type ISchema = Schema<IDocType, IModel, {}, {}, {}, {}, ISchemaDefinition, IDocType>;
+declare const modelName = "Member.Global";
+declare const indexes: [d: IndexDefinition, o: IndexOptions][];
+declare function createSchema(): ISchema;
+export { createSchema, IGlobalMember, IModel, indexes, modelName };

package/lib/chevre/repo/mongoose/schemas/member/global.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.modelName = exports.indexes = void 0;
+exports.createSchema = createSchema;
+const mongoose_1 = require("mongoose");
+const writeConcern_1 = require("../../writeConcern");
+const settings_1 = require("../../../../settings");
+const modelName = 'Member.Global';
+exports.modelName = modelName;
+const schemaDefinition = {
+    // globalロール管理なのでprojectは不要
+    // project: {
+    //     type: SchemaTypes.Mixed,
+    //     required: true
+    // },
+    typeOf: {
+        type: String,
+        required: true
+    },
+    member: {
+        type: mongoose_1.SchemaTypes.Mixed,
+        required: true
+    }
+};
+const schemaOptions = {
+    autoIndex: settings_1.MONGO_AUTO_INDEX,
+    autoCreate: false,
+    collection: 'members.global',
+    id: true,
+    read: settings_1.MONGO_READ_PREFERENCE,
+    writeConcern: writeConcern_1.writeConcern,
+    strict: true,
+    strictQuery: false,
+    timestamps: false,
+    versionKey: false,
+    toJSON: {
+        getters: false,
+        virtuals: false,
+        minimize: false,
+        versionKey: false
+    },
+    toObject: {
+        getters: false,
+        virtuals: true,
+        minimize: false,
+        versionKey: false
+    }
+};
+const indexes = [
+    [
+        { 'member.id': 1 },
+        {
+            name: 'uniqueIAMMember',
+            unique: true
+        }
+    ],
+    [
+        { 'member.hasRole.roleName': 1, 'member.id': 1 },
+        {
+            name: 'searchByMemberHasRoleRoleName',
+            partialFilterExpression: {
+                'member.hasRole.roleName': { $exists: true }
+            }
+        }
+    ]
+];
+exports.indexes = indexes;
+/**
+ * グロバールIAMメンバースキーマ
+ */
+let schema;
+function createSchema() {
+    if (schema === undefined) {
+        schema = new mongoose_1.Schema(schemaDefinition, schemaOptions);
+        if (settings_1.MONGO_AUTO_INDEX) {
+            indexes.forEach((indexParams) => {
+                schema === null || schema === void 0 ? void 0 : schema.index(...indexParams);
+            });
+        }
+    }
+    return schema;
+}

package/lib/chevre/repo/role.d.ts

@@ -11,13 +11,14 @@ export declare class RoleRepo {
     constructor(connection: Connection);
     static CREATE_MONGO_CONDITIONS(params: factory.role.organizationRole.ISearchConditions): FilterQuery<IDocType>[];
     projectFields(params: factory.role.organizationRole.ISearchConditions, inclusion: IKeyOfProjection[]): Promise<IRole[]>;
-    aggregatePermissions(params: {
+    /**
+     * distinctコマンドを使用して、ロールから権限を検索する
+     */
+    findUniquePermissionsByRoleName(params: {
         roleName: {
             $in: string[];
         };
-    }): Promise<{
-        _id: string;
-    }[]>;
+    }): Promise<string[]>;
     addPermissionIfNotExists(params: {
         roleName: {
             $eq: factory.role.organizationRole.RoleName;

package/lib/chevre/repo/role.js

@@ -77,39 +77,42 @@ class RoleRepo {
                 .exec();
         });
     }
-    aggregatePermissions(params) {
+    // migrate to findDistinctPermissionsByRoleName(2025-07-21~)
+    // public async aggregatePermissions(params: {
+    //     roleName: { $in: string[] };
+    // }): Promise<{ _id: string }[]> {
+    //     const matchStages: IMatchStage[] = [
+    //         { $match: { roleName: { $in: params.roleName.$in } } }
+    //     ];
+    //     const aggregate = this.roleModel.aggregate([
+    //         ...matchStages,
+    //         {
+    //             $unwind: {
+    //                 path: '$permissions'
+    //             }
+    //         },
+    //         {
+    //             $project: {
+    //                 _id: 0,
+    //                 permission: '$permissions'
+    //             }
+    //         },
+    //         {
+    //             $group: {
+    //                 _id: '$permission'
+    //             }
+    //         }
+    //     ]);
+    //     return aggregate.option({ maxTimeMS: MONGO_MAX_TIME_MS })
+    //         .exec();
+    // }
+    /**
+     * distinctコマンドを使用して、ロールから権限を検索する
+     */
+    findUniquePermissionsByRoleName(params) {
         return __awaiter(this, void 0, void 0, function* () {
-            const matchStages = [
-                { $match: { roleName: { $in: params.roleName.$in } } }
-            ];
-            const aggregate = this.roleModel.aggregate([
-                // ...(typeof params.sort?.productID === 'number')
-                //     ? [{ $sort: { productID: params.sort.productID } }]
-                //     : [],
-                ...matchStages,
-                {
-                    $unwind: {
-                        path: '$permissions'
-                    }
-                },
-                {
-                    $project: {
-                        _id: 0,
-                        permission: '$permissions'
-                    }
-                },
-                {
-                    $group: {
-                        _id: '$permission'
-                    }
-                }
-            ]);
-            // if (typeof params.limit === 'number' && params.limit > 0) {
-            //     const page: number = (typeof params.page === 'number' && params.page > 0) ? params.page : 1;
-            //     aggregate.limit(params.limit * page)
-            //         .skip(params.limit * (page - 1));
-            // }
-            return aggregate.option({ maxTimeMS: settings_1.MONGO_MAX_TIME_MS })
+            return this.roleModel.distinct('permissions', { roleName: { $in: params.roleName.$in } })
+                .setOptions({ maxTimeMS: settings_1.MONGO_MAX_TIME_MS })
                 .exec();
         });
     }

package/lib/chevre/service/iam.d.ts

@@ -8,7 +8,7 @@ export type IPermission = string;
 /**
  * プロジェクトメンバーの権限を検索する
  */
-export declare function searchPermissions(params: {
+export declare function findProjectPermissionsByMember(params: {
     project: {
         id: string;
     };
@@ -23,10 +23,20 @@ export declare function searchPermissions(params: {
     member: MemberRepo;
     role: RoleRepo;
 }) => Promise<{
-    hasRole: {
-        roleName: string;
-    }[];
-    permissions: {
-        _id: string;
-    }[];
+    roleNames: string[];
+    permissions: string[];
+}>;
+/**
+ * グローバル権限を検索する
+ */
+export declare function findGloablPermissionsByMember(params: {
+    member: {
+        id: string;
+    };
+}): (repos: {
+    member: MemberRepo;
+    role: RoleRepo;
+}) => Promise<{
+    roleNames: string[];
+    permissions: string[];
 }>;

package/lib/chevre/service/iam.js

@@ -9,14 +9,16 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.searchPermissions = searchPermissions;
+exports.findProjectPermissionsByMember = findProjectPermissionsByMember;
+exports.findGloablPermissionsByMember = findGloablPermissionsByMember;
 /**
  * プロジェクトメンバーの権限を検索する
  */
-function searchPermissions(params) {
+function findProjectPermissionsByMember(params) {
     return (repos) => __awaiter(this, void 0, void 0, function* () {
         let permissions = [];
-        const hasRole = yield repos.member.aggregateRoleNames({
+        // const hasRole = await repos.member.aggregateRoleNames({
+        const roleNames = yield repos.member.findRoleNamesByMember({
             project: { id: { $eq: params.project.id } },
             member: {
                 id: { $eq: params.member.id },
@@ -26,9 +28,27 @@ function searchPermissions(params) {
                 }
             }
         });
-        if (hasRole.length > 0) {
-            permissions = yield repos.role.aggregatePermissions({ roleName: { $in: hasRole.map((r) => r.roleName) } });
+        if (roleNames.length > 0) {
+            // permissions = await repos.role.aggregatePermissions({ roleName: { $in: hasRole.map((r) => r.roleName) } });
+            permissions = yield repos.role.findUniquePermissionsByRoleName({ roleName: { $in: roleNames } });
         }
-        return { hasRole, permissions };
+        return { roleNames, permissions };
+    });
+}
+/**
+ * グローバル権限を検索する
+ */
+function findGloablPermissionsByMember(params) {
+    return (repos) => __awaiter(this, void 0, void 0, function* () {
+        let permissions = [];
+        const roleNames = yield repos.member.findGlobalRoleNamesByMember({
+            member: {
+                id: { $eq: params.member.id }
+            }
+        });
+        if (roleNames.length > 0) {
+            permissions = yield repos.role.findUniquePermissionsByRoleName({ roleName: { $in: roleNames } });
+        }
+        return { roleNames, permissions };
     });
 }

package/package.json

@@ -49,10 +49,12 @@
     "@types/sinon-mongoose": "^1.3.11",
     "@types/uniqid": "^4.1.3",
     "@types/uuid": "^3.4.10",
+    "auth0": "4.27.0",
     "coveralls": "^3.1.0",
     "csvtojson": "^2.0.10",
     "eslint": "9.16.0",
     "googleapis": "^85.0.0",
+    "jose": "6.0.12",
     "json2csv": "4.5.4",
     "mocha": "10.6.0",
     "mongoose": "8.0.4",
@@ -113,5 +115,5 @@
     "postversion": "git push origin --tags",
     "prepublishOnly": "npm run clean && npm run build && npm test && npm run doc"
   },
-  "version": "22.11.0-alpha.10"
+  "version": "22.11.0-alpha.12"
 }

package/example/src/chevre/searchPermissions.ts

@@ -1,46 +0,0 @@
-// tslint:disable:no-console
-import * as moment from 'moment';
-import * as mongoose from 'mongoose';
-
-import { chevre } from '../../../lib/index';
-
-const PROJECT_ID = String(process.env.PROJECT_ID);
-const memberId = 'xxx';
-
-async function main() {
-    await mongoose.connect(<string>process.env.MONGOLAB_URI);
-
-    const memberRepo = await chevre.repository.Member.createInstance(mongoose.connection);
-    const roleRepo = await chevre.repository.Role.createInstance(mongoose.connection);
-
-    let now: Date;
-
-    now = new Date();
-    const searchPermissionsResult = await (await chevre.service.iam.createService()).searchPermissions({
-        project: { id: PROJECT_ID },
-        member: {
-            id: memberId,
-            memberOf: {
-                id: PROJECT_ID,
-                typeOf: chevre.factory.organizationType.Project
-            }
-        }
-    })({
-        member: memberRepo,
-        role: roleRepo
-    });
-    console.log('time cost:', moment()
-        .diff(now));
-
-    console.log(searchPermissionsResult);
-    console.log(searchPermissionsResult.permissions.length);
-
-    // console.log(aggregateRoleNamesResult);
-    // console.log(aggregateRoleNamesResult.length);
-    // console.log(aggregatePermissionsResult);
-    // console.log(aggregatePermissionsResult.length);
-}
-
-main()
-    .then(console.log)
-    .catch(console.error);