@devxcrew/platform 0.1.2 → 0.1.6

package/dist/modules/identity/{identity.lifecycle-service.js → user/user.lifecycle.service.js}

@@ -1,36 +1,33 @@
 import { randomBytes, randomUUID } from "node:crypto";
-import { digest, hashPassword } from "./identity.password.js";
-import { IdentityError } from "./identity.error.js";
-import { IdentityRepository } from "./identity.repository.js";
-import { checkIdentityRequest } from "./identity.request-context.js";
-import { invitationSchema, recoverySchema, tokenCompletionSchema, } from "./identity.lifecycle-schema.js";
+import { digest, hashPassword } from "./user.password.js";
+import { IdentityError } from "../support/identity.error.js";
+import { IdentityUserRepository } from "./user.repository.js";
+import { checkIdentityRequest } from "../support/identity.request-context.js";
+import { invitationSchema, recoverySchema, tokenCompletionSchema } from "./user.lifecycle.schema.js";
 export class IdentityLifecycleService {
     db;
     config;
     delivery;
-    constructor(db, config, delivery) {
+    permissions;
+    ownership;
+    constructor(db, config, delivery, permissions, ownership) {
         this.db = db;
         this.config = config;
         this.delivery = delivery;
+        this.permissions = permissions;
+        this.ownership = ownership;
     }
     async invite(actor, raw) {
-        if (actor.portal === "user" ||
-            !actor.permissions.includes("identity.manage"))
+        if (actor.portal === "user" || !actor.permissions.includes("identity.manage"))
             throw new IdentityError(403, "Access denied.");
         const input = invitationSchema.parse(raw);
         const tenantId = input.tenantId ?? actor.tenant.id;
-        if (actor.portal !== "super-admin" &&
-            (tenantId !== actor.tenant.id || input.roleId !== "user"))
+        if (actor.portal !== "super-admin" && (tenantId !== actor.tenant.id || input.roleId !== "user"))
             throw new IdentityError(403, "Access denied.");
         this.requireDelivery();
-        if ((await new IdentityRepository(this.db).throttle(digest(`${actor.appId}:invitation:${actor.user.id}`))) > 20)
+        if ((await new IdentityUserRepository(this.db, this.permissions, this.ownership).throttle(digest(`${actor.appId}:invitation:${actor.user.id}`))) > 20)
             throw new IdentityError(429, "Too many invitations. Try again later.");
-        const tenant = await this.db
-            .selectFrom("identity_tenants")
-            .select("id")
-            .where("id", "=", tenantId)
-            .where("active", "=", 1)
-            .executeTakeFirst();
+        const tenant = await this.ownership.activeOrganization(this.db, tenantId);
         if (!tenant)
             throw new IdentityError(422, "Organization is inactive or unavailable.");
         if (await this.db
@@ -44,24 +41,23 @@ export class IdentityLifecycleService {
     }
     async requestRecovery(portal, raw, address) {
         const input = recoverySchema
-            .refine((value) => this.config.mode !== "multi-tenant" || Boolean(value.tenantId), { path: ["tenantId"], message: "Enter an organization ID." })
+            .refine((value) => this.config.mode !== "multi-tenant" || Boolean(value.tenantId), {
+            path: ["tenantId"],
+            message: "Enter an organization ID."
+        })
             .parse(raw);
         this.requireDelivery();
-        const repository = new IdentityRepository(this.db);
+        const repository = new IdentityUserRepository(this.db, this.permissions, this.ownership);
         if ((await repository.throttle(digest(`${this.config.appId}:recovery-ip:${address}`))) > 20)
             throw new IdentityError(429, "Too many recovery requests. Try again later.");
         if ((await repository.throttle(digest(`${this.config.appId}:recovery:${address}:${input.email}`))) > 5)
             throw new IdentityError(429, "Too many recovery requests. Try again later.");
-        const tenantId = this.config.mode === "single-client"
-            ? this.config.tenantId
-            : input.tenantId;
+        const tenantId = this.config.mode === "single-client" ? this.config.tenantId : input.tenantId;
         const user = await repository.user(input.email);
         const principal = user?.active && tenantId
             ? await repository.principal(user.id, tenantId, portal, this.config.appId)
             : null;
-        if (user?.active &&
-            tenantId &&
-            principal?.permissions.includes("identity.password")) {
+        if (user?.active && tenantId && principal?.permissions.includes("identity.password")) {
             await this.db
                 .updateTable("identity_tokens")
                 .set({ consumed_at: new Date().toISOString() })
@@ -72,12 +68,12 @@ export class IdentityLifecycleService {
             await this.issue("recovery", user.email, user.name, portal, tenantId, user.id);
         }
         return {
-            message: "If this account can recover access, an email will arrive.",
+            message: "If this account can recover access, an email will arrive."
         };
     }
     async complete(portal, kind, raw, address) {
         const input = tokenCompletionSchema.parse(raw);
-        const repository = new IdentityRepository(this.db);
+        const repository = new IdentityUserRepository(this.db, this.permissions, this.ownership);
         if ((await repository.throttle(digest(`${this.config.appId}:complete:${address}`))) > 10)
             throw new IdentityError(429, "Too many account requests. Try again later.");
         const available = await this.db
@@ -109,15 +105,9 @@ export class IdentityLifecycleService {
                 .where("expires_at", ">", new Date().toISOString())
                 .executeTakeFirst();
             if (!token ||
-                (this.config.mode === "single-client" &&
-                    token.tenant_id !== this.config.tenantId))
+                (this.config.mode === "single-client" && token.tenant_id !== this.config.tenantId))
                 throw new IdentityError(422, "This link is invalid or expired.");
-            const activeTenant = await trx
-                .selectFrom("identity_tenants")
-                .select("id")
-                .where("id", "=", token.tenant_id)
-                .where("active", "=", 1)
-                .executeTakeFirst();
+            const activeTenant = await this.ownership.activeOrganization(trx, token.tenant_id);
             if (!activeTenant)
                 throw new IdentityError(422, "This link is invalid or expired.");
             const claimed = await trx
@@ -143,20 +133,13 @@ export class IdentityLifecycleService {
                     email: token.email,
                     name: token.name,
                     password_hash: passwordHash,
-                    active: 1,
-                })
-                    .execute();
-                await trx
-                    .insertInto("identity_memberships")
-                    .values({
-                    user_id: userId,
-                    tenant_id: token.tenant_id,
-                    role_id: token.role_id,
+                    active: 1
                 })
                     .execute();
+                await this.ownership.assignInvitedMembership(trx, userId, token.tenant_id, token.role_id);
             }
             else {
-                const principal = await new IdentityRepository(trx).principal(userId, token.tenant_id, portal, this.config.appId);
+                const principal = await new IdentityUserRepository(trx, this.permissions, this.ownership).principal(userId, token.tenant_id, portal, this.config.appId);
                 if (!principal?.permissions.includes("identity.password"))
                     throw new IdentityError(422, "This link is invalid or expired.");
                 await trx
@@ -164,10 +147,7 @@ export class IdentityLifecycleService {
                     .set({ password_hash: passwordHash })
                     .where("id", "=", userId)
                     .execute();
-                await trx
-                    .deleteFrom("identity_sessions")
-                    .where("user_id", "=", userId)
-                    .execute();
+                await this.ownership.revokeUserSessions(trx, userId);
                 await trx
                     .updateTable("identity_tokens")
                     .set({ consumed_at: new Date().toISOString() })
@@ -175,25 +155,19 @@ export class IdentityLifecycleService {
                     .where("kind", "=", "recovery")
                     .execute();
             }
-            await trx
-                .insertInto("identity_audit_events")
-                .values({
-                id: randomUUID(),
-                app_id: this.config.appId,
-                actor_id: userId,
-                tenant_id: token.tenant_id,
+            await this.ownership.recordEvent(trx, {
+                appId: this.config.appId,
+                actorId: userId,
+                tenantId: token.tenant_id,
                 action: `identity.${kind}.completed`,
-                resource_id: token.id,
-                created_at: new Date().toISOString(),
-            })
-                .execute();
+                resourceId: token.id
+            });
             checkIdentityRequest();
             return { message: "Account access updated. Sign in to continue." };
         });
     }
     async list(actor, query) {
-        if (actor.portal === "user" ||
-            !actor.permissions.includes("identity.manage"))
+        if (actor.portal === "user" || !actor.permissions.includes("identity.manage"))
             throw new IdentityError(403, "Access denied.");
         let select = this.db
             .selectFrom("identity_tokens")
@@ -202,10 +176,7 @@ export class IdentityLifecycleService {
         if (actor.portal !== "super-admin")
             select = select.where("tenant_id", "=", actor.tenant.id);
         if (query.search)
-            select = select.where((eb) => eb.or([
-                eb("email", "like", `%${query.search}%`),
-                eb("name", "like", `%${query.search}%`),
-            ]));
+            select = select.where((eb) => eb.or([eb("email", "like", `%${query.search}%`), eb("name", "like", `%${query.search}%`)]));
         const count = await select
             .select((eb) => eb.fn.countAll().as("total"))
             .executeTakeFirstOrThrow();
@@ -223,13 +194,12 @@ export class IdentityLifecycleService {
                 page: query.page,
                 perPage: query.perPage,
                 total,
-                lastPage: Math.max(1, Math.ceil(total / query.perPage)),
-            },
+                lastPage: Math.max(1, Math.ceil(total / query.perPage))
+            }
         };
     }
     async show(actor, id) {
-        if (actor.portal === "user" ||
-            !actor.permissions.includes("identity.manage"))
+        if (actor.portal === "user" || !actor.permissions.includes("identity.manage"))
             throw new IdentityError(403, "Access denied.");
         let query = this.db
             .selectFrom("identity_tokens")
@@ -252,14 +222,13 @@ export class IdentityLifecycleService {
             email: old.email,
             name: old.name,
             roleId: old.roleId,
-            tenantId: old.tenantId,
+            tenantId: old.tenantId
         });
         await this.revoke(actor, id);
         return result;
     }
     async revoke(actor, id) {
-        if (actor.portal === "user" ||
-            !actor.permissions.includes("identity.manage"))
+        if (actor.portal === "user" || !actor.permissions.includes("identity.manage"))
             throw new IdentityError(403, "Access denied.");
         const token = await this.db
             .selectFrom("identity_tokens")
@@ -268,8 +237,7 @@ export class IdentityLifecycleService {
             .where("app_id", "=", actor.appId)
             .where("kind", "=", "invitation")
             .executeTakeFirst();
-        if (!token ||
-            (actor.portal !== "super-admin" && token.tenant_id !== actor.tenant.id))
+        if (!token || (actor.portal !== "super-admin" && token.tenant_id !== actor.tenant.id))
             throw new IdentityError(404, "Invitation not found.");
         await this.db.transaction().execute(async (trx) => {
             checkIdentityRequest();
@@ -283,18 +251,13 @@ export class IdentityLifecycleService {
                 query = query.where("tenant_id", "=", actor.tenant.id);
             if ((await query.executeTakeFirst()).numUpdatedRows !== 1n)
                 throw new IdentityError(404, "Invitation not found.");
-            await trx
-                .insertInto("identity_audit_events")
-                .values({
-                id: randomUUID(),
-                app_id: actor.appId,
-                actor_id: actor.user.id,
-                tenant_id: token.tenant_id,
+            await this.ownership.recordEvent(trx, {
+                appId: actor.appId,
+                actorId: actor.user.id,
+                tenantId: token.tenant_id,
                 action: "identity.invitation.revoked",
-                resource_id: id,
-                created_at: new Date().toISOString(),
-            })
-                .execute();
+                resourceId: id
+            });
             checkIdentityRequest();
         });
     }
@@ -316,7 +279,7 @@ export class IdentityLifecycleService {
             user_id: userId,
             expires_at: new Date(Date.now() + (kind === "recovery" ? 1800 : 86400) * 1000).toISOString(),
             consumed_at: null,
-            delivered: 0,
+            delivered: 0
         };
         checkIdentityRequest();
         await this.db.insertInto("identity_tokens").values(row).execute();
@@ -325,10 +288,8 @@ export class IdentityLifecycleService {
         try {
             const delivered = await this.delivery.send({
                 to: email,
-                subject: kind === "invitation"
-                    ? "Account invitation"
-                    : "Recover account access",
-                text: `${name}, open this link to ${kind === "invitation" ? "set up your account" : "reset your password"}: ${link}\nThis link expires at ${row.expires_at}.`,
+                subject: kind === "invitation" ? "Account invitation" : "Recover account access",
+                text: `${name}, open this link to ${kind === "invitation" ? "set up your account" : "reset your password"}: ${link}\nThis link expires at ${row.expires_at}.`
             });
             if (!delivered.messageId)
                 throw new Error("Missing delivery receipt.");
@@ -339,27 +300,19 @@ export class IdentityLifecycleService {
                     .set({ delivered: 1 })
                     .where("id", "=", row.id)
                     .execute();
-                await trx
-                    .insertInto("identity_audit_events")
-                    .values({
-                    id: randomUUID(),
-                    app_id: this.config.appId,
-                    actor_id: actorId,
-                    tenant_id: tenantId,
+                await this.ownership.recordEvent(trx, {
+                    appId: this.config.appId,
+                    actorId,
+                    tenantId,
                     action: `identity.${kind}.issued`,
-                    resource_id: row.id,
-                    created_at: new Date().toISOString(),
-                })
-                    .execute();
+                    resourceId: row.id
+                });
                 checkIdentityRequest();
             });
             return { ...row, delivered: 1 };
         }
         catch {
-            await this.db
-                .deleteFrom("identity_tokens")
-                .where("id", "=", row.id)
-                .execute();
+            await this.db.deleteFrom("identity_tokens").where("id", "=", row.id).execute();
             throw new IdentityError(503, "Account email is unavailable. Contact your administrator.");
         }
     }
@@ -375,21 +328,16 @@ export class IdentityLifecycleService {
                 ? "closed"
                 : row.expires_at <= new Date().toISOString()
                     ? "expired"
-                    : "pending",
+                    : "pending"
         };
     }
     async audit(actor, action, resourceId, tenantId = actor.tenant.id) {
-        await this.db
-            .insertInto("identity_audit_events")
-            .values({
-            id: randomUUID(),
-            app_id: actor.appId,
-            actor_id: actor.user.id,
-            tenant_id: tenantId,
+        await this.ownership.recordEvent(this.db, {
+            appId: actor.appId,
+            actorId: actor.user.id,
+            tenantId,
             action,
-            resource_id: resourceId,
-            created_at: new Date().toISOString(),
-        })
-            .execute();
+            resourceId
+        });
     }
 }

package/dist/modules/identity/user/user.migration.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/user/user.migration.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/{identity.password.js → user/user.password.js}

@@ -17,5 +17,5 @@ export function digest(value) {
     return createHash("sha256").update(value).digest("hex");
 }
 function derive(password, salt) {
-    return new Promise((resolve, reject) => scrypt(password, salt, 64, options, (error, key) => error ? reject(error) : resolve(key)));
+    return new Promise((resolve, reject) => scrypt(password, salt, 64, options, (error, key) => (error ? reject(error) : resolve(key))));
 }

package/dist/modules/identity/user/user.provider.d.ts

@@ -0,0 +1,80 @@
+import type { Kysely, RawBuilder, Transaction } from "kysely";
+import type { IdentityConfig, IdentityProviderOptions, IdentitySchema } from "../identity.types.js";
+import type { IdentityPermissionProvider } from "../permission/index.js";
+import { IdentityService } from "./user.service.js";
+import { IdentityLifecycleService } from "./user.lifecycle.service.js";
+import type { IdentityRoleResolver } from "../role/index.js";
+import type { IdentityMutation } from "../identity.types.js";
+import type { IdentityUserRoleProvider } from "../user-role/index.js";
+import type { Portal } from "../identity.types.js";
+export interface IdentityUserOwnership {
+    activeOrganization(db: Kysely<IdentitySchema>, id: string): Promise<unknown>;
+    assignInvitedMembership(trx: Transaction<IdentitySchema>, userId: string, tenantId: string, portal: Portal): Promise<void>;
+    revokeUserSessions(trx: Transaction<IdentitySchema>, userId: string): Promise<void>;
+    recordEvent(db: Kysely<IdentitySchema>, input: {
+        appId: string;
+        actorId: string;
+        tenantId: string;
+        action: string;
+        resourceId: string;
+    }): Promise<void>;
+    sessionSeconds(appId: string, fallback: number): Promise<number>;
+    activeSession(tokenHash: string, appId: string, portal: Portal, now: string): Promise<IdentitySchema["identity_sessions"] | undefined>;
+    createSession(session: IdentitySchema["identity_sessions"], previous: string | undefined, eligible: (trx: Transaction<IdentitySchema>) => Promise<boolean>): Promise<boolean>;
+    revokeSession(tokenHash: string, appId: string, portal: Portal): Promise<void>;
+    throttle(key: string): Promise<number>;
+    clearThrottle(key: string): Promise<void>;
+    activeMembership(db: Kysely<IdentitySchema>, userId: string, tenantId: string, portal: Portal): Promise<{
+        custom_role_id: string | null;
+    } | undefined>;
+    activeOrganizationDetail(db: Kysely<IdentitySchema>, id: string): Promise<{
+        id: string;
+        name: string;
+    } | undefined>;
+    permissionIds(db: Kysely<IdentitySchema>, portal: Portal, customRoleId: string | null, appId: string, tenantId: string): Promise<string[] | null>;
+}
+export declare function createIdentityUserProvider(database: Kysely<IdentitySchema>, config: IdentityConfig, permissions: IdentityPermissionProvider, ownership: IdentityUserOwnership, options?: IdentityProviderOptions): Readonly<{
+    verify: () => Promise<void>;
+    identity: IdentityService;
+    lifecycle: IdentityLifecycleService;
+}>;
+export type IdentityUserProvider = ReturnType<typeof createIdentityUserProvider>;
+export declare function createIdentityUserAdministrationProvider(database: Kysely<IdentitySchema>, visibility: (actor: import("../identity.types.js").Principal, userId: RawBuilder<unknown>) => RawBuilder<unknown>, resolveRole: IdentityRoleResolver, userRoles: IdentityUserRoleProvider, mutate: IdentityMutation, activeOrganization: (trx: Transaction<IdentitySchema>, id: string) => Promise<unknown>, revokeUserSessions: (trx: Transaction<IdentitySchema>, userId: string) => Promise<void>): Readonly<{
+    list: (actor: import("../identity.types.js").Principal, query: import("../index.js").IdentityListQuery) => Promise<{
+        data: {
+            active: boolean;
+            version: number;
+        }[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show: (actor: import("../identity.types.js").Principal, id: string) => Promise<{
+        active: boolean;
+        version: number;
+    } | undefined>;
+    create: (actor: import("../identity.types.js").Principal, raw: unknown) => Promise<{
+        id: string;
+        email: string;
+        name: string;
+        active: boolean;
+        version: number;
+    }>;
+    update: (actor: import("../identity.types.js").Principal, id: string, raw: unknown) => Promise<{
+        id: string;
+        name: string;
+        email: string;
+        active: boolean;
+        version: number;
+    }>;
+    profile: (actor: import("../identity.types.js").Principal, raw?: unknown) => Promise<{
+        active: boolean;
+        version: number;
+        email: string;
+        id: string;
+        name: string;
+    }>;
+}>;

package/dist/modules/identity/user/user.provider.js

@@ -0,0 +1,22 @@
+import { IdentityUserRepository } from "./user.repository.js";
+import { IdentityService } from "./user.service.js";
+import { IdentityLifecycleService } from "./user.lifecycle.service.js";
+import { IdentityUserAdministrationService } from "./user.administration.service.js";
+export function createIdentityUserProvider(database, config, permissions, ownership, options = {}) {
+    const repository = new IdentityUserRepository(database, permissions, ownership);
+    return Object.freeze({
+        verify: repository.verifySchema.bind(repository),
+        identity: new IdentityService(repository, config),
+        lifecycle: new IdentityLifecycleService(database, config, options.delivery, permissions, ownership)
+    });
+}
+export function createIdentityUserAdministrationProvider(database, visibility, resolveRole, userRoles, mutate, activeOrganization, revokeUserSessions) {
+    const service = new IdentityUserAdministrationService(database, visibility, resolveRole, userRoles.assignInitialMembership, mutate, activeOrganization, userRoles.isManageableUser, userRoles.protectAdministrators, revokeUserSessions);
+    return Object.freeze({
+        list: service.list.bind(service),
+        show: service.show.bind(service),
+        create: service.create.bind(service),
+        update: service.update.bind(service),
+        profile: service.profile.bind(service)
+    });
+}

package/dist/modules/identity/user/user.repository.d.ts

@@ -0,0 +1,64 @@
+import type { IdentityPermissionProvider } from "../permission/index.js";
+import { type Kysely, type RawBuilder } from "kysely";
+import type { IdentitySchema, Portal } from "../identity.types.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+import type { IdentityUserOwnership } from "./user.provider.js";
+export declare const userNameSource: () => RawBuilder<unknown>;
+export declare function activeUserIds(db: Kysely<IdentitySchema>, ids: string[]): Promise<string[]>;
+export declare function listUsers(db: Kysely<IdentitySchema>, query: IdentityListQuery, visibility: RawBuilder<unknown>): Promise<{
+    data: {
+        active: boolean;
+        version: number;
+    }[];
+    meta: {
+        page: number;
+        perPage: number;
+        total: number;
+        lastPage: number;
+    };
+}>;
+export declare function showUser(db: Kysely<IdentitySchema>, id: string, visibility: RawBuilder<unknown>): Promise<{
+    active: boolean;
+    version: number;
+} | undefined>;
+export declare class IdentityUserRepository {
+    private readonly db;
+    private readonly permissions;
+    private readonly ownership;
+    constructor(db: Kysely<IdentitySchema>, permissions: IdentityPermissionProvider, ownership: IdentityUserOwnership);
+    verifySchema(): Promise<void>;
+    user(email: string): Promise<{
+        active: number;
+        email: string;
+        id: string;
+        name: string;
+        password_hash: string;
+        version: number;
+    } | undefined>;
+    sessionSeconds(appId: string, fallback: number): Promise<number>;
+    principal(userId: string, tenantId: string, portal: Portal, appId: string): Promise<{
+        user: {
+            id: string;
+            email: string;
+            name: string;
+        };
+        tenant: {
+            id: string;
+            name: string;
+        };
+        permissions: string[];
+    } | null>;
+    session(tokenHash: string, appId: string, portal: Portal, now: string): Promise<{
+        token_hash: string;
+        user_id: string;
+        tenant_id: string;
+        app_id: string;
+        portal: Portal;
+        expires_at: string;
+    } | undefined>;
+    createSession(session: IdentitySchema["identity_sessions"], expectedHash: string, previous?: string): Promise<boolean>;
+    revoke(tokenHash: string, appId: string, portal: Portal): Promise<void>;
+    throttle(key: string): Promise<number>;
+    clearThrottle(key: string): Promise<void>;
+    changePassword(userId: string, expectedHash: string, passwordHash: string): Promise<boolean>;
+}

package/dist/modules/identity/user/user.repository.js

@@ -0,0 +1,129 @@
+import { sql } from "kysely";
+import { checkIdentityRequest } from "../support/identity.request-context.js";
+import { listRows, showRow } from "../support/pagination.js";
+const presentUser = (row) => ({
+    ...row,
+    active: Boolean(row.active),
+    version: Number(row.version)
+});
+export const userNameSource = () => sql `select id,name,active from identity_users`;
+export async function activeUserIds(db, ids) {
+    if (ids.length === 0)
+        return [];
+    const rows = await db
+        .selectFrom("identity_users")
+        .select("id")
+        .where("id", "in", ids)
+        .where("active", "=", 1)
+        .execute();
+    return rows.map((row) => row.id);
+}
+export function listUsers(db, query, visibility) {
+    return listRows(db, userListSource(visibility), ["id", "name", "email"], query, presentUser);
+}
+export function showUser(db, id, visibility) {
+    return showRow(db, userListSource(visibility), id, presentUser);
+}
+function userListSource(visibility) {
+    return sql `select u.id,u.name,u.email,u.active,u.version from identity_users u
+    where ${visibility}`;
+}
+export class IdentityUserRepository {
+    db;
+    permissions;
+    ownership;
+    constructor(db, permissions, ownership) {
+        this.db = db;
+        this.permissions = permissions;
+        this.ownership = ownership;
+    }
+    async verifySchema() {
+        await this.db.selectFrom("identity_users").select("version").limit(1).execute();
+        await this.db
+            .selectFrom("identity_tokens")
+            .select(["delivered", "consumed_at"])
+            .limit(1)
+            .execute();
+    }
+    user(email) {
+        return this.db
+            .selectFrom("identity_users")
+            .selectAll()
+            .where("email", "=", email)
+            .executeTakeFirst();
+    }
+    async sessionSeconds(appId, fallback) {
+        return this.ownership.sessionSeconds(appId, fallback);
+    }
+    async principal(userId, tenantId, portal, appId) {
+        const user = await this.db
+            .selectFrom("identity_users")
+            .select(["id", "email", "name"])
+            .where("id", "=", userId)
+            .where("active", "=", 1)
+            .executeTakeFirst();
+        if (!user)
+            return null;
+        const membership = await this.ownership.activeMembership(this.db, userId, tenantId, portal);
+        if (!membership)
+            return null;
+        const tenant = await this.ownership.activeOrganizationDetail(this.db, tenantId);
+        if (!tenant)
+            return null;
+        const ids = await this.ownership.permissionIds(this.db, portal, membership.custom_role_id, appId, tenantId);
+        if (!ids)
+            return null;
+        return {
+            user: { id: user.id, email: user.email, name: user.name },
+            tenant,
+            permissions: await this.permissions.filterDeclared(this.db, appId, portal, ids)
+        };
+    }
+    session(tokenHash, appId, portal, now) {
+        return this.ownership.activeSession(tokenHash, appId, portal, now);
+    }
+    createSession(session, expectedHash, previous) {
+        return this.ownership.createSession(session, previous, async (trx) => {
+            const current = await trx
+                .selectFrom("identity_users")
+                .select("id")
+                .where("id", "=", session.user_id)
+                .where("password_hash", "=", expectedHash)
+                .where("active", "=", 1)
+                .executeTakeFirst();
+            if (!current)
+                return false;
+            const membership = await this.ownership.activeMembership(trx, session.user_id, session.tenant_id, session.portal);
+            if (!membership)
+                return false;
+            if (!(await this.ownership.activeOrganizationDetail(trx, session.tenant_id)))
+                return false;
+            const permissions = await this.ownership.permissionIds(trx, session.portal, membership.custom_role_id, session.app_id, session.tenant_id);
+            return permissions !== null;
+        });
+    }
+    revoke(tokenHash, appId, portal) {
+        return this.ownership.revokeSession(tokenHash, appId, portal);
+    }
+    throttle(key) {
+        return this.ownership.throttle(key);
+    }
+    clearThrottle(key) {
+        return this.ownership.clearThrottle(key);
+    }
+    async changePassword(userId, expectedHash, passwordHash) {
+        return this.db.transaction().execute(async (trx) => {
+            checkIdentityRequest();
+            const result = await trx
+                .updateTable("identity_users")
+                .set({ password_hash: passwordHash })
+                .where("id", "=", userId)
+                .where("password_hash", "=", expectedHash)
+                .executeTakeFirst();
+            if (result.numUpdatedRows !== 1n)
+                return false;
+            await this.ownership.revokeUserSessions(trx, userId);
+            return true;
+        });
+    }
+}