@devxcrew/platform 0.1.2 → 0.1.6

package/README.md

@@ -1,7 +1,7 @@
 # Platform Core
 
 Source repository: https://github.com/devxcrew/platform.
-Package: `@devxcrew/platform`, version `0.1.0`.
+Package: `@devxcrew/platform`, source version `0.1.6`.
 
 Platform Core owns database identity, sessions, role permissions, and tenant membership.
 Applications consume its public provider. Framework remains responsible for business-neutral runtime primitives.
@@ -80,3 +80,9 @@ Actual SMTP delivery acceptance remains deferred. Local failure and concurrency
 ## Distribution
 
 First-party package code uses the MIT license. Dependency licenses and notices retain their original terms.
+
+## Tenant storage
+
+Platform now exports createTenantProvider, tenantConnectionsMigration, provisionTenant and verifyTenantReadiness.
+The tenant owner uses public Framework database contracts. See agent/TENANCY.md for composition and upgrade guidance.
+Cxsun consumes matched development artifacts. This extraction does not publish new registry versions.

package/dist/index.d.ts

@@ -1,5 +1,7 @@
-export { createIdentityProvider, IdentityError, identityMigration, identityAdministrationMigration, identityRolesMigration, identityPermissionDeclarationsMigration, identityPermissionLabelsMigration, seedIdentity, } from "./modules/identity/index.js";
+export { createIdentityProvider, IdentityError, identityMigration, identityAdministrationMigration, identityRolesMigration, identityPermissionDeclarationsMigration, identityPermissionLabelsMigration, seedIdentity } from "./modules/identity/index.js";
 export type { IdentityPermissionDeclaration } from "./modules/identity/index.js";
-export { listSchema, userCreateSchema, userUpdateSchema, organizationCreateSchema, organizationUpdateSchema, membershipSchema, roleUpdateSchema, profileSchema, settingsSchema, } from "./modules/identity/index.js";
-export type { IdentityListQuery, IdentityResource, } from "./modules/identity/index.js";
-export type { IdentitySchema, IdentityConfig, Principal, Portal, IdentityDeliveryProvider, IdentityProviderOptions, IdentityPermissionCatalogEntry, } from "./modules/identity/index.js";
+export { listSchema, userCreateSchema, userUpdateSchema, organizationCreateSchema, organizationUpdateSchema, membershipSchema, roleUpdateSchema, profileSchema, settingsSchema } from "./modules/identity/index.js";
+export type { IdentityListQuery, IdentityResource } from "./modules/identity/index.js";
+export type { IdentitySchema, IdentityConfig, Principal, Portal, IdentityDeliveryProvider, IdentityProviderOptions, IdentityPermissionCatalogEntry } from "./modules/identity/index.js";
+export * from "./modules/tenant/index.js";
+export { createIdentityTenantDirectory, type IdentityTenantDirectory } from "./modules/identity/index.js";

package/dist/index.js

@@ -1,2 +1,4 @@
-export { createIdentityProvider, IdentityError, identityMigration, identityAdministrationMigration, identityRolesMigration, identityPermissionDeclarationsMigration, identityPermissionLabelsMigration, seedIdentity, } from "./modules/identity/index.js";
-export { listSchema, userCreateSchema, userUpdateSchema, organizationCreateSchema, organizationUpdateSchema, membershipSchema, roleUpdateSchema, profileSchema, settingsSchema, } from "./modules/identity/index.js";
+export { createIdentityProvider, IdentityError, identityMigration, identityAdministrationMigration, identityRolesMigration, identityPermissionDeclarationsMigration, identityPermissionLabelsMigration, seedIdentity } from "./modules/identity/index.js";
+export { listSchema, userCreateSchema, userUpdateSchema, organizationCreateSchema, organizationUpdateSchema, membershipSchema, roleUpdateSchema, profileSchema, settingsSchema } from "./modules/identity/index.js";
+export * from "./modules/tenant/index.js";
+export { createIdentityTenantDirectory } from "./modules/identity/index.js";

package/dist/modules/identity/audit/audit.controller.d.ts

@@ -0,0 +1,17 @@
+import type { Principal } from "../identity.types.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+import type { createIdentityAuditProvider } from "./audit.provider.js";
+export declare class IdentityAuditController {
+    private readonly service;
+    constructor(service: ReturnType<typeof createIdentityAuditProvider>);
+    index(actor: Principal, query: IdentityListQuery): Promise<{
+        data: Record<string, unknown>[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show(actor: Principal, id: string): Promise<Record<string, unknown> | undefined>;
+}

package/dist/modules/identity/audit/audit.controller.js

@@ -0,0 +1,12 @@
+export class IdentityAuditController {
+    service;
+    constructor(service) {
+        this.service = service;
+    }
+    index(actor, query) {
+        return this.service.list(actor, query);
+    }
+    show(actor, id) {
+        return this.service.show(actor, id);
+    }
+}

package/dist/modules/identity/audit/audit.migration.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/audit/audit.migration.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/audit/audit.provider.d.ts

@@ -0,0 +1,24 @@
+import type { Kysely, Transaction } from "kysely";
+import type { IdentitySchema } from "../identity.types.js";
+export declare function createIdentityAuditProvider(database: Kysely<IdentitySchema>, userTenants: (trx: Transaction<IdentitySchema>, userId: string) => Promise<string[]>, tenantIds: (trx: Transaction<IdentitySchema>) => Promise<string[]>): Readonly<{
+    verify: () => Promise<void>;
+    list: (actor: import("../identity.types.js").Principal, query: import("../index.js").IdentityListQuery) => Promise<{
+        data: Record<string, unknown>[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show: (actor: import("../identity.types.js").Principal, id: string) => Promise<Record<string, unknown> | undefined>;
+    mutate: import("../identity.types.js").IdentityMutation;
+    record: (trx: Transaction<IdentitySchema>, actor: import("../identity.types.js").Principal, tenantId: string, action: string, resourceId: string) => Promise<void>;
+    recordEvent: (db: Kysely<IdentitySchema>, input: {
+        appId: string;
+        actorId: string;
+        tenantId: string;
+        action: string;
+        resourceId: string;
+    }) => Promise<void>;
+}>;

package/dist/modules/identity/audit/audit.provider.js

@@ -0,0 +1,14 @@
+import { IdentityAuditRepository } from "./audit.repository.js";
+import { IdentityAuditService } from "./audit.service.js";
+export function createIdentityAuditProvider(database, userTenants, tenantIds) {
+    const repository = new IdentityAuditRepository(database);
+    const service = new IdentityAuditService(database, repository, userTenants, tenantIds);
+    return Object.freeze({
+        verify: repository.verifySchema.bind(repository),
+        list: service.list.bind(service),
+        show: service.show.bind(service),
+        mutate: service.mutate,
+        record: repository.record.bind(repository),
+        recordEvent: repository.recordEvent.bind(repository)
+    });
+}

package/dist/modules/identity/audit/audit.repository.d.ts

@@ -0,0 +1,26 @@
+import { type Kysely, type Transaction } from "kysely";
+import type { IdentitySchema, Principal } from "../identity.types.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+export declare class IdentityAuditRepository {
+    private readonly db;
+    constructor(db: Kysely<IdentitySchema>);
+    verifySchema(): Promise<void>;
+    list(actor: Principal, query: IdentityListQuery): Promise<{
+        data: Record<string, unknown>[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show(actor: Principal, id: string): Promise<Record<string, unknown> | undefined>;
+    record(trx: Transaction<IdentitySchema>, actor: Principal, tenantId: string, action: string, resourceId: string): Promise<void>;
+    recordEvent(db: Kysely<IdentitySchema>, input: {
+        appId: string;
+        actorId: string;
+        tenantId: string;
+        action: string;
+        resourceId: string;
+    }): Promise<void>;
+}

package/dist/modules/identity/audit/audit.repository.js

@@ -0,0 +1,46 @@
+import { randomUUID } from "node:crypto";
+import { sql } from "kysely";
+import { listRows, showRow } from "../support/pagination.js";
+function auditListSource(actor) {
+    return sql `select id,actor_id as actorId,tenant_id as tenantId,action,resource_id as resourceId,created_at as createdAt
+    from identity_audit_events where app_id=${actor.appId}
+    ${actor.portal === "super-admin" ? sql `` : sql `and tenant_id=${actor.tenant.id}`}`;
+}
+export class IdentityAuditRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async verifySchema() {
+        await this.db.selectFrom("identity_audit_events").select("created_at").limit(1).execute();
+    }
+    list(actor, query) {
+        return listRows(this.db, auditListSource(actor), ["id"], query, (row) => row);
+    }
+    show(actor, id) {
+        return showRow(this.db, auditListSource(actor), id, (row) => row);
+    }
+    async record(trx, actor, tenantId, action, resourceId) {
+        await this.recordEvent(trx, {
+            appId: actor.appId,
+            actorId: actor.user.id,
+            tenantId,
+            action,
+            resourceId
+        });
+    }
+    async recordEvent(db, input) {
+        await db
+            .insertInto("identity_audit_events")
+            .values({
+            id: randomUUID(),
+            app_id: input.appId,
+            actor_id: input.actorId,
+            tenant_id: input.tenantId,
+            action: input.action,
+            resource_id: input.resourceId,
+            created_at: new Date().toISOString()
+        })
+            .execute();
+    }
+}

package/dist/modules/identity/audit/audit.routes.d.ts

@@ -0,0 +1,5 @@
+export declare const auditResource: "audit-events";
+export declare const auditResourceRoute: (controller: import("./audit.controller.js").IdentityAuditController) => {
+    resource: "audit-events";
+    controller: import("./audit.controller.js").IdentityAuditController;
+};

package/dist/modules/identity/audit/audit.routes.js

@@ -0,0 +1,2 @@
+export const auditResource = "audit-events";
+export const auditResourceRoute = (controller) => ({ resource: auditResource, controller });

package/dist/modules/identity/audit/audit.schema.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/audit/audit.schema.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/audit/audit.seed.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/audit/audit.seed.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/audit/audit.service.d.ts

@@ -0,0 +1,23 @@
+import type { Kysely, Transaction } from "kysely";
+import type { IdentityMutation, IdentitySchema, Principal } from "../identity.types.js";
+import { IdentityAuditRepository } from "./audit.repository.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+export declare class IdentityAuditService {
+    private readonly db;
+    private readonly repository;
+    private readonly userTenants;
+    private readonly tenantIds;
+    constructor(db: Kysely<IdentitySchema>, repository: IdentityAuditRepository, userTenants: (trx: Transaction<IdentitySchema>, userId: string) => Promise<string[]>, tenantIds: (trx: Transaction<IdentitySchema>) => Promise<string[]>);
+    list(actor: Principal, query: IdentityListQuery): Promise<{
+        data: Record<string, unknown>[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show(actor: Principal, id: string): Promise<Record<string, unknown> | undefined>;
+    private allow;
+    readonly mutate: IdentityMutation;
+}

package/dist/modules/identity/audit/audit.service.js

@@ -0,0 +1,46 @@
+import { checkIdentityRequest } from "../support/identity.request-context.js";
+import { IdentityError } from "../support/identity.error.js";
+export class IdentityAuditService {
+    db;
+    repository;
+    userTenants;
+    tenantIds;
+    constructor(db, repository, userTenants, tenantIds) {
+        this.db = db;
+        this.repository = repository;
+        this.userTenants = userTenants;
+        this.tenantIds = tenantIds;
+    }
+    list(actor, query) {
+        this.allow(actor);
+        return this.repository.list(actor, query);
+    }
+    show(actor, id) {
+        this.allow(actor);
+        return this.repository.show(actor, id);
+    }
+    allow(actor) {
+        if (actor.portal === "user" || !actor.permissions.includes("identity.manage"))
+            throw new IdentityError(403, "Access denied.");
+    }
+    mutate = async (actor, resource, id, action, affectedTenant) => this.db.transaction().execute(async (trx) => {
+        checkIdentityRequest();
+        const result = await action(trx, id);
+        checkIdentityRequest();
+        const targetTenant = affectedTenant ??
+            (resource === "organizations"
+                ? id
+                : resource === "memberships"
+                    ? id.split("~")[1]
+                    : actor.tenant.id);
+        let targets = [targetTenant];
+        if (!affectedTenant && ["users", "profile"].includes(resource))
+            targets = await this.userTenants(trx, id);
+        if (["roles", "application-settings", "security-settings"].includes(resource))
+            targets = await this.tenantIds(trx);
+        for (const tenant of new Set(targets))
+            await this.repository.record(trx, actor, tenant, `identity.${resource}.changed`, id);
+        checkIdentityRequest();
+        return result;
+    });
+}

package/dist/modules/identity/audit/audit.types.d.ts

@@ -0,0 +1,12 @@
+export interface IdentityAuditTables {
+    identity_audit_events: {
+        id: string;
+        app_id: string;
+        actor_id: string;
+        tenant_id: string;
+        action: string;
+        resource_id: string;
+        created_at: string;
+    };
+}
+export type IdentityAuditRow = IdentityAuditTables["identity_audit_events"];

package/dist/modules/identity/audit/audit.types.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/audit/index.d.ts

@@ -0,0 +1,4 @@
+export { createIdentityAuditProvider } from "./audit.provider.js";
+export { auditResource, auditResourceRoute } from "./audit.routes.js";
+export type { IdentityAuditRow } from "./audit.types.js";
+export { IdentityAuditController } from "./audit.controller.js";

package/dist/modules/identity/audit/index.js

@@ -0,0 +1,3 @@
+export { createIdentityAuditProvider } from "./audit.provider.js";
+export { auditResource, auditResourceRoute } from "./audit.routes.js";
+export { IdentityAuditController } from "./audit.controller.js";

package/dist/modules/identity/{identity.administration-service.d.ts → composition/identity.composition.d.ts}

@@ -1,13 +1,25 @@
-import { type Kysely } from "kysely";
-import type { IdentitySchema, Principal } from "./identity.types.js";
-import { type IdentityListQuery, type IdentityResource } from "./identity.administration-schema.js";
-export declare class IdentityAdministrationService {
-    private readonly db;
-    private readonly appName;
-    private readonly repository;
+import type { Kysely } from "kysely";
+import type { IdentitySchema, Principal } from "../identity.types.js";
+import type { IdentityListQuery, IdentityResource } from "../support/pagination.schema.js";
+import { type IdentityPermissionProvider } from "../permission/index.js";
+import { IdentityUserController } from "../user/index.js";
+import { IdentitySettingsController } from "../settings/index.js";
+import type { IdentityResourceRoute } from "../support/resource-controller.js";
+import type { IdentityUserOwnership } from "../user/index.js";
+export declare class IdentityAdministrationComposition {
+    private readonly audit;
+    private readonly session;
+    private readonly organization;
+    private readonly settingsProvider;
     private readonly roles;
-    private readonly presentationService;
-    constructor(db: Kysely<IdentitySchema>, appName: string);
+    private readonly userRoles;
+    private readonly users;
+    private readonly permissions;
+    readonly userController: IdentityUserController;
+    readonly settingsController: IdentitySettingsController;
+    readonly routes: readonly IdentityResourceRoute[];
+    userOwnership(): IdentityUserOwnership;
+    constructor(database: Kysely<IdentitySchema>, appName: string, permissions: IdentityPermissionProvider);
     list(actor: Principal, resource: IdentityResource, query: IdentityListQuery): Promise<{
         data: Record<string, unknown>[];
         meta: {
@@ -16,28 +28,58 @@ export declare class IdentityAdministrationService {
             total: number;
             lastPage: number;
         };
+    } | {
+        data: {
+            portals: string[];
+        }[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    } | {
+        data: {
+            active: boolean;
+            version: number;
+        }[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
     }>;
-    show(actor: Principal, resource: IdentityResource, id: string): Promise<Record<string, unknown>>;
-    create(actor: Principal, resource: IdentityResource, raw: unknown): Promise<{
-        id: string;
-        name: string;
+    show(actor: Principal, resource: IdentityResource, id: string): Promise<Record<string, unknown> | {
+        portals: string[];
+    } | {
         active: boolean;
         version: number;
-    } | {
+    }>;
+    create(actor: Principal, resource: IdentityResource, raw: unknown): Promise<{
         id: string;
         userId: string;
         tenantId: string;
         roleId: string;
-        portal: import("./identity.types.js").Portal;
+        portal: import("../identity.types.js").Portal;
+        active: boolean;
+        version: number;
+    } | {
+        id: string;
+        name: string;
         active: boolean;
         version: number;
     }>;
     update(actor: Principal, resource: IdentityResource, id: string, raw: unknown): Promise<{
+        id: string;
+        permissionIds: string[];
+        version: number;
+    } | {
         id: string;
         userId: string;
         tenantId: string;
         roleId: string;
-        portal: import("./identity.types.js").Portal;
+        portal: import("../identity.types.js").Portal;
         active: boolean;
         version: number;
     } | {
@@ -45,10 +87,6 @@ export declare class IdentityAdministrationService {
         version: number;
         id: string;
         name: string;
-    } | {
-        id: string;
-        permissionIds: string[];
-        version: number;
     }>;
     remove(actor: Principal, resource: IdentityResource, id: string, expectedVersion?: number): Promise<void>;
     profile(actor: Principal, raw?: unknown): Promise<{
@@ -77,7 +115,6 @@ export declare class IdentityAdministrationService {
         timeZone: string;
         version: number;
     }>;
-    private revision;
     presentation(actor: Principal): Promise<{
         displayName: string;
         organizationDisplayName: string;
@@ -88,10 +125,5 @@ export declare class IdentityAdministrationService {
         displayName: string;
         requiresOrganizationId: boolean;
     }>;
-    private allow;
-    private tenant;
-    private assignableRole;
-    private activeTenant;
-    private unprivilegedUser;
-    private mutate;
+    verify(): Promise<void>;
 }

package/dist/modules/identity/composition/identity.composition.js

@@ -0,0 +1,171 @@
+import { IdentityError } from "../support/identity.error.js";
+import { createIdentityAuditProvider, auditResourceRoute } from "../audit/index.js";
+import { createIdentitySessionProvider, sessionResourceRoute } from "../session/index.js";
+import { createIdentityOrganizationProvider, organizationResourceRoute } from "../organization/index.js";
+import { createIdentitySettingsProvider } from "../settings/index.js";
+import { createIdentityRoleProvider, roleResourceRoute } from "../role/index.js";
+import { createIdentityUserRoleProvider, userRoleResourceRoute } from "../user-role/index.js";
+import { activeUserIds, createIdentityUserAdministrationProvider, userNameSource, userResourceRoute } from "../user/index.js";
+import { permissionResourceRoute } from "../permission/index.js";
+import { IdentityUserController } from "../user/index.js";
+import { IdentityOrganizationController } from "../organization/index.js";
+import { IdentityUserRoleController } from "../user-role/index.js";
+import { IdentityRoleController } from "../role/index.js";
+import { IdentityPermissionController } from "../permission/index.js";
+import { IdentitySessionController } from "../session/index.js";
+import { IdentityAuditController } from "../audit/index.js";
+import { IdentitySettingsController } from "../settings/index.js";
+export class IdentityAdministrationComposition {
+    audit;
+    session;
+    organization;
+    settingsProvider;
+    roles;
+    userRoles;
+    users;
+    permissions;
+    userController;
+    settingsController;
+    routes;
+    userOwnership() {
+        return {
+            activeOrganization: this.organization.active,
+            assignInvitedMembership: this.userRoles.assignInvitedMembership,
+            revokeUserSessions: this.session.revokeUser,
+            recordEvent: this.audit.recordEvent,
+            sessionSeconds: this.settingsProvider.sessionSeconds,
+            activeSession: this.session.active,
+            createSession: this.session.create,
+            revokeSession: this.session.revoke,
+            throttle: this.session.throttle,
+            clearThrottle: this.session.clearThrottle,
+            activeMembership: this.userRoles.activeMembership,
+            activeOrganizationDetail: this.organization.activeDetail,
+            permissionIds: this.roles.permissionIds
+        };
+    }
+    constructor(database, appName, permissions) {
+        this.permissions = permissions;
+        this.audit = createIdentityAuditProvider(database, (trx, userId) => this.userRoles.tenantIdsForUser(trx, userId), (trx) => this.organization.tenantIds(trx));
+        this.session = createIdentitySessionProvider(database, this.audit.mutate);
+        this.organization = createIdentityOrganizationProvider(database, this.audit.mutate, this.session.revokeTenant);
+        this.settingsProvider = createIdentitySettingsProvider(database, appName, this.audit.mutate, this.session.revokeApp);
+        this.roles = createIdentityRoleProvider(database, permissions, this.audit.mutate, this.audit.record, this.organization.active, async (trx, appId, tenantId, roleId) => {
+            const userIds = await this.userRoles.userIdsForCustomRole(trx, roleId);
+            await this.session.revokeRoleMembers(trx, appId, tenantId, userIds);
+        });
+        this.userRoles = createIdentityUserRoleProvider(database, {
+            users: userNameSource,
+            organizations: this.organization.nameSource,
+            roles: this.roles.customRoleNameSource,
+            customRoleIds: this.roles.customRoleIdsSource
+        }, activeUserIds, this.roles.resolve, this.roles.customRoleInApp, this.audit.mutate, async (actor, userId) => {
+            if (!(await this.users.show(actor, userId)))
+                throw new IdentityError(404, "Resource not found.");
+        }, this.organization.active, this.audit.record, this.session.revokeMembership);
+        this.users = createIdentityUserAdministrationProvider(database, (actor, userId) => this.userRoles.userVisibility(actor, this.roles.customRoleIdsSource, userId), this.roles.resolve, this.userRoles, this.audit.mutate, this.organization.active, this.session.revokeUser);
+        this.userController = new IdentityUserController(this.users);
+        this.settingsController = new IdentitySettingsController(this.settingsProvider);
+        this.routes = [
+            userResourceRoute(this.userController),
+            organizationResourceRoute(new IdentityOrganizationController(this.organization)),
+            userRoleResourceRoute(new IdentityUserRoleController(this.userRoles)),
+            roleResourceRoute(new IdentityRoleController(this.roles)),
+            permissionResourceRoute(new IdentityPermissionController(this.permissions)),
+            sessionResourceRoute(new IdentitySessionController(this.session)),
+            auditResourceRoute(new IdentityAuditController(this.audit))
+        ];
+    }
+    async list(actor, resource, query) {
+        if (resource === "users")
+            return this.users.list(actor, query);
+        if (resource === "organizations")
+            return this.organization.list(actor, query);
+        if (resource === "memberships")
+            return this.userRoles.list(actor, query);
+        if (resource === "roles")
+            return this.roles.list(actor, query);
+        if (resource === "permissions")
+            return this.permissions.list(actor, query);
+        if (resource === "sessions")
+            return this.session.list(actor, query);
+        return this.audit.list(actor, query);
+    }
+    async show(actor, resource, id) {
+        const row = resource === "users"
+            ? await this.users.show(actor, id)
+            : resource === "organizations"
+                ? await this.organization.show(actor, id)
+                : resource === "memberships"
+                    ? await this.userRoles.show(actor, id)
+                    : resource === "roles"
+                        ? await this.roles.show(actor, id)
+                        : resource === "permissions"
+                            ? await this.permissions.show(actor, id)
+                            : resource === "sessions"
+                                ? await this.session.show(actor, id)
+                                : await this.audit.show(actor, id);
+        if (!row)
+            throw new IdentityError(404, "Resource not found.");
+        return row;
+    }
+    async create(actor, resource, raw) {
+        if (resource === "roles")
+            return this.roles.create(actor, raw);
+        if (resource === "users")
+            return this.users.create(actor, raw);
+        if (resource === "organizations")
+            return this.organization.create(actor, raw);
+        if (resource === "memberships")
+            return this.userRoles.createMembership(actor, raw);
+        throw new IdentityError(405, "Creation is not supported for this resource.");
+    }
+    async update(actor, resource, id, raw) {
+        if (resource === "memberships")
+            return this.userRoles.updateMembership(actor, id, raw);
+        if (resource === "roles" && !["user", "admin", "super-admin"].includes(id))
+            return this.roles.update(actor, id, raw);
+        if (resource === "roles") {
+            await this.show(actor, resource, id);
+            return this.roles.updateSystemPermissions(actor, id, raw);
+        }
+        if (resource === "users")
+            return this.users.update(actor, id, raw);
+        if (resource === "organizations")
+            return this.organization.update(actor, id, raw);
+        throw new IdentityError(405, "Update is not supported for this resource.");
+    }
+    async remove(actor, resource, id, expectedVersion) {
+        if (resource === "memberships")
+            return this.userRoles.removeMembership(actor, id, expectedVersion);
+        if (resource === "sessions") {
+            await this.session.remove(actor, id);
+            return;
+        }
+        await this.show(actor, resource, id);
+        throw new IdentityError(405, "Deletion is not supported for this resource.");
+    }
+    profile(actor, raw) {
+        return this.users.profile(actor, raw);
+    }
+    settings(actor, raw) {
+        return this.settingsProvider.organizationSettings(actor, raw);
+    }
+    applicationSettings(actor, security, raw, fallbackSeconds) {
+        return this.settingsProvider.applicationSettings(actor, security, raw, fallbackSeconds);
+    }
+    presentation(actor) {
+        return this.settingsProvider.presentation(actor);
+    }
+    configuration(appId, requiresOrganizationId) {
+        return this.settingsProvider.configuration(appId, requiresOrganizationId);
+    }
+    async verify() {
+        await this.audit.verify();
+        await this.session.verify();
+        await this.organization.verify();
+        await this.settingsProvider.verify();
+        await this.roles.verify();
+        await this.userRoles.verify();
+    }
+}

package/dist/modules/identity/composition/identity.seed.d.ts

@@ -0,0 +1,3 @@
+import type { Kysely } from "kysely";
+import type { IdentitySchema } from "../identity.types.js";
+export declare function seedIdentity(db: Kysely<IdentitySchema>, env: NodeJS.ProcessEnv): Promise<void>;

package/dist/modules/identity/composition/identity.seed.js

@@ -0,0 +1,16 @@
+import { seedOrganization } from "../organization/index.js";
+import { seedRoles } from "../role/index.js";
+import { seedPermissions } from "../permission/index.js";
+import { seedRolePermissions } from "../role-permission/index.js";
+import { seedAccounts, seedUsers } from "../user/index.js";
+import { seedMemberships } from "../user-role/index.js";
+export async function seedIdentity(db, env) {
+    const accounts = seedAccounts(env);
+    await db.transaction().execute(async (trx) => {
+        await seedOrganization(trx, env);
+        await seedRoles(trx);
+        await seedPermissions(trx);
+        await seedRolePermissions(trx);
+        await seedMemberships(trx, await seedUsers(trx, accounts));
+    });
+}