@devxcrew/platform 0.1.2 → 0.1.6

package/dist/modules/identity/user/user.routes.d.ts

@@ -0,0 +1,12 @@
+export declare const userResource: "users";
+export declare const userResourceRoute: (controller: import("./user.controller.js").IdentityUserController) => {
+    resource: "users";
+    controller: import("./user.controller.js").IdentityUserController;
+};
+export declare const userLifecyclePaths: {
+    readonly recovery: "recovery";
+    readonly recoveryComplete: "recovery/complete";
+    readonly invitationAccept: "invitations/accept";
+    readonly invitations: "invitations";
+    readonly profile: "profile";
+};

package/dist/modules/identity/user/user.routes.js

@@ -0,0 +1,9 @@
+export const userResource = "users";
+export const userResourceRoute = (controller) => ({ resource: userResource, controller });
+export const userLifecyclePaths = {
+    recovery: "recovery",
+    recoveryComplete: "recovery/complete",
+    invitationAccept: "invitations/accept",
+    invitations: "invitations",
+    profile: "profile"
+};

package/dist/modules/identity/user/user.schema.d.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+export { identityKeySchema, portalSchema } from "../support/identity.schema.js";
+export declare const passwordSchema: z.ZodObject<{
+    currentPassword: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strict>;
+export declare const accountSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    name: z.ZodString;
+    password: z.ZodString;
+    portal: z.ZodEnum<{
+        admin: "admin";
+        "super-admin": "super-admin";
+        user: "user";
+    }>;
+    tenantId: z.ZodString;
+}, z.core.$strict>;
+export declare const userCreateSchema: z.ZodObject<{
+    name: z.ZodString;
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    password: z.ZodString;
+    roleId: z.ZodDefault<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const userUpdateSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>>;
+    active: z.ZodOptional<z.ZodBoolean>;
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;
+export declare const profileSchema: z.ZodObject<{
+    name: z.ZodString;
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;

package/dist/modules/identity/user/user.schema.js

@@ -0,0 +1,46 @@
+import { z } from "zod";
+import { identityKeySchema, portalSchema, resourceIdSchema } from "../support/identity.schema.js";
+export { identityKeySchema, portalSchema } from "../support/identity.schema.js";
+export const passwordSchema = z
+    .object({
+    currentPassword: z.string().min(1).max(256),
+    password: z.string().min(12).max(256)
+})
+    .strict();
+export const accountSchema = z
+    .object({
+    email: z
+        .email()
+        .max(254)
+        .transform((value) => value.toLowerCase()),
+    name: z.string().trim().min(1).max(100),
+    password: z.string().min(12).max(256),
+    portal: portalSchema,
+    tenantId: identityKeySchema
+})
+    .strict();
+const userName = z.string().trim().min(1).max(100);
+const userEmail = z
+    .email()
+    .max(254)
+    .transform((value) => value.trim().toLowerCase());
+const expectedVersion = z.number().int().min(0);
+export const userCreateSchema = z
+    .object({
+    name: userName,
+    email: userEmail,
+    password: z.string().min(12).max(256),
+    roleId: resourceIdSchema.default("user"),
+    tenantId: identityKeySchema.optional()
+})
+    .strict();
+export const userUpdateSchema = z
+    .object({
+    name: userName.optional(),
+    email: userEmail.optional(),
+    active: z.boolean().optional(),
+    expectedVersion
+})
+    .strict()
+    .refine((value) => Object.keys(value).length > 1, "Provide a changed field.");
+export const profileSchema = z.object({ name: userName, expectedVersion }).strict();

package/dist/modules/identity/user/user.seed.d.ts

@@ -0,0 +1,14 @@
+import type { Transaction } from "kysely";
+import type { IdentitySchema, Portal } from "../identity.types.js";
+export declare function seedAccounts(env: NodeJS.ProcessEnv): {
+    email: string;
+    name: string;
+    password: string;
+    portal: "admin" | "super-admin" | "user";
+    tenantId: string;
+}[];
+export declare function seedUsers(trx: Transaction<IdentitySchema>, accounts: ReturnType<typeof seedAccounts>): Promise<{
+    userId: string;
+    tenantId: string;
+    portal: Portal;
+}[]>;

package/dist/modules/identity/user/user.seed.js

@@ -0,0 +1,47 @@
+import { randomUUID } from "node:crypto";
+import { accountSchema } from "./user.schema.js";
+import { hashPassword } from "./user.password.js";
+export function seedAccounts(env) {
+    const tenantId = env.IDENTITY_TENANT_ID ?? "default";
+    return ["user", "admin", "super-admin"].flatMap((portal) => {
+        const prefix = `IDENTITY_SEED_${portal.toUpperCase().replace("-", "_")}`;
+        const email = env[`${prefix}_EMAIL`];
+        const password = env[`${prefix}_PASSWORD`];
+        if (!email && !password)
+            return [];
+        return [
+            accountSchema.parse({
+                email,
+                password,
+                name: env[`${prefix}_NAME`]?.trim() || portal,
+                portal,
+                tenantId
+            })
+        ];
+    });
+}
+export async function seedUsers(trx, accounts) {
+    const created = [];
+    for (const account of accounts) {
+        const existing = await trx
+            .selectFrom("identity_users")
+            .select("id")
+            .where("email", "=", account.email)
+            .executeTakeFirst();
+        if (existing)
+            continue;
+        const userId = randomUUID();
+        await trx
+            .insertInto("identity_users")
+            .values({
+            id: userId,
+            email: account.email,
+            name: account.name,
+            password_hash: await hashPassword(account.password),
+            active: 1
+        })
+            .execute();
+        created.push({ userId, tenantId: account.tenantId, portal: account.portal });
+    }
+    return created;
+}

package/dist/modules/identity/user/user.service.d.ts

@@ -0,0 +1,33 @@
+import { IdentityUserRepository } from "./user.repository.js";
+import type { IdentityConfig, Portal, Principal } from "../identity.types.js";
+import type { z } from "zod";
+import type { passwordSchema } from "./user.schema.js";
+import type { loginSchema } from "../session/index.js";
+export declare class IdentityService {
+    private readonly repository;
+    private readonly config;
+    private readonly dummyHash;
+    constructor(repository: IdentityUserRepository, config: IdentityConfig);
+    login(portal: Portal, input: z.infer<typeof loginSchema>, address: string, previous?: string): Promise<{
+        token: string;
+        sessionSeconds: number;
+        principal: {
+            user: {
+                id: string;
+                email: string;
+                name: string;
+            };
+            tenant: {
+                id: string;
+                name: string;
+            };
+            permissions: string[];
+            appId: string;
+            portal: Portal;
+        };
+    }>;
+    authenticate(portal: Portal, token?: string): Promise<Principal>;
+    requirePermission(principal: Principal, permission: string): void;
+    logout(portal: Portal, token?: string): Promise<void>;
+    changePassword(principal: Principal, input: z.infer<typeof passwordSchema>): Promise<void>;
+}

package/dist/modules/identity/user/user.service.js

@@ -0,0 +1,76 @@
+import { randomBytes } from "node:crypto";
+import { digest, hashPassword, verifyPassword } from "./user.password.js";
+import { IdentityError } from "../support/identity.error.js";
+export class IdentityService {
+    repository;
+    config;
+    dummyHash = hashPassword(randomBytes(32).toString("hex"));
+    constructor(repository, config) {
+        this.repository = repository;
+        this.config = config;
+    }
+    async login(portal, input, address, previous) {
+        const key = digest(`${this.config.appId}:${portal}:${address}:${input.email}`);
+        const ipKey = digest(`${this.config.appId}:ip:${address}`);
+        if ((await this.repository.throttle(ipKey)) > 100 || (await this.repository.throttle(key)) > 10)
+            throw new IdentityError(429, "Too many sign-in attempts. Try again later.");
+        const user = await this.repository.user(input.email);
+        const valid = await verifyPassword(input.password, user?.password_hash ?? (await this.dummyHash));
+        const tenantId = this.config.mode === "single-client" ? this.config.tenantId : input.tenantId;
+        if (!valid ||
+            !user ||
+            !Number(user.active) ||
+            !tenantId ||
+            (this.config.mode === "single-client" && input.tenantId && input.tenantId !== tenantId))
+            throw new IdentityError(401, "Invalid credentials or portal access.");
+        const principal = await this.repository.principal(user.id, tenantId, portal, this.config.appId);
+        if (!principal?.permissions.includes(`desk.${portal}`))
+            throw new IdentityError(401, "Invalid credentials or portal access.");
+        const token = randomBytes(32).toString("base64url");
+        const sessionSeconds = await this.repository.sessionSeconds(this.config.appId, this.config.sessionSeconds);
+        const created = await this.repository.createSession({
+            token_hash: digest(token),
+            user_id: user.id,
+            tenant_id: tenantId,
+            app_id: this.config.appId,
+            portal,
+            expires_at: new Date(Date.now() + sessionSeconds * 1000).toISOString()
+        }, user.password_hash, previous ? digest(previous) : undefined);
+        if (!created)
+            throw new IdentityError(401, "Invalid credentials or portal access.");
+        await this.repository.clearThrottle(key);
+        return {
+            token,
+            sessionSeconds,
+            principal: { ...principal, appId: this.config.appId, portal }
+        };
+    }
+    async authenticate(portal, token) {
+        if (!token || !/^[A-Za-z0-9_-]{43}$/.test(token))
+            throw new IdentityError(401, "Sign in to continue.");
+        const session = await this.repository.session(digest(token), this.config.appId, portal, new Date().toISOString());
+        if (!session ||
+            (this.config.mode === "single-client" && session.tenant_id !== this.config.tenantId))
+            throw new IdentityError(401, "Sign in to continue.");
+        const principal = await this.repository.principal(session.user_id, session.tenant_id, portal, this.config.appId);
+        if (!principal)
+            throw new IdentityError(401, "Sign in to continue.");
+        return { ...principal, appId: this.config.appId, portal };
+    }
+    requirePermission(principal, permission) {
+        if (!principal.permissions.includes(permission))
+            throw new IdentityError(403, "Access denied.");
+    }
+    async logout(portal, token) {
+        if (token)
+            await this.repository.revoke(digest(token), this.config.appId, portal);
+    }
+    async changePassword(principal, input) {
+        this.requirePermission(principal, "identity.password");
+        const user = await this.repository.user(principal.user.email);
+        if (!user || !(await verifyPassword(input.currentPassword, user.password_hash)))
+            throw new IdentityError(422, "Current password is incorrect.");
+        if (!(await this.repository.changePassword(user.id, user.password_hash, await hashPassword(input.password))))
+            throw new IdentityError(409, "Account changed. Sign in again.");
+    }
+}

package/dist/modules/identity/user/user.types.d.ts

@@ -0,0 +1,27 @@
+import type { Generated } from "kysely";
+import type { Portal } from "../identity.types.js";
+export interface IdentityUserTables {
+    identity_users: {
+        id: string;
+        email: string;
+        name: string;
+        password_hash: string;
+        active: number;
+        version: Generated<number>;
+    };
+    identity_tokens: {
+        id: string;
+        token_hash: string;
+        app_id: string;
+        tenant_id: string;
+        kind: "invitation" | "recovery";
+        email: string;
+        name: string;
+        role_id: Portal;
+        user_id: string | null;
+        expires_at: string;
+        consumed_at: string | null;
+        delivered: number;
+    };
+}
+export type IdentityUserRow = IdentityUserTables["identity_users"];

package/dist/modules/identity/user/user.types.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/user-role/index.d.ts

@@ -0,0 +1,8 @@
+export { createIdentityUserRoleProvider } from "./user-role.provider.js";
+export type { IdentityUserRoleProvider } from "./user-role.provider.js";
+export { protectAdministrators } from "./user-role.policy.js";
+export { membershipDeleteQuerySchema, membershipSchema, membershipUpdateSchema } from "./user-role.schema.js";
+export { seedMemberships } from "./user-role.seed.js";
+export { userRoleResource, userRoleResourceRoute } from "./user-role.routes.js";
+export type { IdentityMembershipRow } from "./user-role.types.js";
+export { IdentityUserRoleController } from "./user-role.controller.js";

package/dist/modules/identity/user-role/index.js

@@ -0,0 +1,6 @@
+export { createIdentityUserRoleProvider } from "./user-role.provider.js";
+export { protectAdministrators } from "./user-role.policy.js";
+export { membershipDeleteQuerySchema, membershipSchema, membershipUpdateSchema } from "./user-role.schema.js";
+export { seedMemberships } from "./user-role.seed.js";
+export { userRoleResource, userRoleResourceRoute } from "./user-role.routes.js";
+export { IdentityUserRoleController } from "./user-role.controller.js";

package/dist/modules/identity/user-role/user-role.controller.d.ts

@@ -0,0 +1,42 @@
+import type { Principal } from "../identity.types.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+import type { IdentityUserRoleProvider } from "./user-role.provider.js";
+export declare class IdentityUserRoleController {
+    private readonly service;
+    constructor(service: IdentityUserRoleProvider);
+    index(actor: Principal, query: IdentityListQuery): Promise<{
+        data: {
+            active: boolean;
+            version: number;
+        }[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show(actor: Principal, id: string): Promise<{
+        active: boolean;
+        version: number;
+    } | undefined>;
+    store(actor: Principal, raw: unknown): Promise<{
+        id: string;
+        userId: string;
+        tenantId: string;
+        roleId: string;
+        portal: import("../identity.types.js").Portal;
+        active: boolean;
+        version: number;
+    }>;
+    update(actor: Principal, id: string, raw: unknown): Promise<{
+        id: string;
+        userId: string;
+        tenantId: string;
+        roleId: string;
+        portal: import("../identity.types.js").Portal;
+        active: boolean;
+        version: number;
+    }>;
+    destroy(actor: Principal, id: string, expectedVersion?: number): Promise<void>;
+}

package/dist/modules/identity/user-role/user-role.controller.js

@@ -0,0 +1,21 @@
+export class IdentityUserRoleController {
+    service;
+    constructor(service) {
+        this.service = service;
+    }
+    index(actor, query) {
+        return this.service.list(actor, query);
+    }
+    show(actor, id) {
+        return this.service.show(actor, id);
+    }
+    store(actor, raw) {
+        return this.service.createMembership(actor, raw);
+    }
+    update(actor, id, raw) {
+        return this.service.updateMembership(actor, id, raw);
+    }
+    destroy(actor, id, expectedVersion) {
+        return this.service.removeMembership(actor, id, expectedVersion);
+    }
+}

package/dist/modules/identity/user-role/user-role.migration.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/user-role/user-role.migration.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/user-role/user-role.policy.d.ts

@@ -0,0 +1,3 @@
+import type { Kysely, Transaction } from "kysely";
+import type { IdentitySchema } from "../identity.types.js";
+export declare function protectAdministrators(trx: Transaction<IdentitySchema>, userId: string, activeUsers: (db: Kysely<IdentitySchema>, ids: string[]) => Promise<string[]>, tenantId?: string, roleId?: string): Promise<void>;

package/dist/modules/identity/user-role/user-role.policy.js

@@ -0,0 +1,25 @@
+import { IdentityError } from "../support/identity.error.js";
+export async function protectAdministrators(trx, userId, activeUsers, tenantId, roleId) {
+    let query = trx
+        .selectFrom("identity_memberships")
+        .selectAll()
+        .where("user_id", "=", userId)
+        .where("active", "=", 1)
+        .where("role_id", "in", ["admin", "super-admin"]);
+    if (tenantId)
+        query = query.where("tenant_id", "=", tenantId);
+    if (roleId)
+        query = query.where("role_id", "=", roleId);
+    for (const member of await query.execute()) {
+        const peers = await trx
+            .selectFrom("identity_memberships")
+            .select("user_id")
+            .where("tenant_id", "=", member.tenant_id)
+            .where("role_id", "=", member.role_id)
+            .where("active", "=", 1)
+            .where("user_id", "!=", userId)
+            .execute();
+        if ((await activeUsers(trx, peers.map((peer) => peer.user_id))).length === 0)
+            throw new IdentityError(409, "Keep at least one active administrator for this role and organization.");
+    }
+}

package/dist/modules/identity/user-role/user-role.provider.d.ts

@@ -0,0 +1,18 @@
+import type { Kysely, Transaction } from "kysely";
+import type { IdentitySchema, Portal, Principal } from "../identity.types.js";
+import type { IdentityRoleResolver } from "../role/index.js";
+import type { IdentityMutation } from "../identity.types.js";
+import { IdentityUserRoleService } from "./user-role.service.js";
+import { customRoleUserIds, assertManageableUser, assignInvitedMembership, activeMembership, membershipTenantIds } from "./user-role.repository.js";
+import { userVisibility, type MembershipReadSources } from "./user-role.repository.js";
+export type IdentityUserRoleProvider = Pick<IdentityUserRoleService, "list" | "show" | "createMembership" | "updateMembership" | "removeMembership" | "assignInitialMembership"> & {
+    verify(): Promise<void>;
+    tenantIdsForUser: typeof membershipTenantIds;
+    userIdsForCustomRole: typeof customRoleUserIds;
+    isManageableUser: typeof assertManageableUser;
+    assignInvitedMembership: typeof assignInvitedMembership;
+    activeMembership: typeof activeMembership;
+    userVisibility: typeof userVisibility;
+    protectAdministrators(trx: Transaction<IdentitySchema>, userId: string): Promise<void>;
+};
+export declare function createIdentityUserRoleProvider(database: Kysely<IdentitySchema>, readSources: MembershipReadSources, activeUsers: (db: Kysely<IdentitySchema>, ids: string[]) => Promise<string[]>, resolveRole: IdentityRoleResolver, customRoleInApp: (db: Kysely<IdentitySchema>, id: string, appId: string) => Promise<unknown>, mutate: IdentityMutation, assertUserVisible: (actor: Principal, userId: string) => Promise<unknown>, activeOrganization: (trx: Transaction<IdentitySchema>, id: string) => Promise<unknown>, recordAudit: (trx: Transaction<IdentitySchema>, actor: Principal, tenantId: string, action: string, id: string) => Promise<void>, revokeMembershipSessions: (trx: Transaction<IdentitySchema>, appId: string, userId: string, tenantId: string, portal: Portal) => Promise<void>): IdentityUserRoleProvider;

package/dist/modules/identity/user-role/user-role.provider.js

@@ -0,0 +1,23 @@
+import { IdentityUserRoleService } from "./user-role.service.js";
+import { customRoleUserIds, assertManageableUser, assignInvitedMembership, activeMembership, membershipTenantIds, verifyMembershipSchema } from "./user-role.repository.js";
+import { userVisibility } from "./user-role.repository.js";
+import { protectAdministrators } from "./user-role.policy.js";
+export function createIdentityUserRoleProvider(database, readSources, activeUsers, resolveRole, customRoleInApp, mutate, assertUserVisible, activeOrganization, recordAudit, revokeMembershipSessions) {
+    const service = new IdentityUserRoleService(database, readSources, activeUsers, resolveRole, customRoleInApp, mutate, assertUserVisible, activeOrganization, recordAudit, revokeMembershipSessions);
+    return Object.freeze({
+        verify: () => verifyMembershipSchema(database),
+        tenantIdsForUser: membershipTenantIds,
+        userIdsForCustomRole: customRoleUserIds,
+        isManageableUser: assertManageableUser,
+        assignInvitedMembership,
+        activeMembership,
+        userVisibility,
+        protectAdministrators: (trx, userId) => protectAdministrators(trx, userId, activeUsers),
+        list: service.list.bind(service),
+        show: service.show.bind(service),
+        createMembership: service.createMembership.bind(service),
+        updateMembership: service.updateMembership.bind(service),
+        removeMembership: service.removeMembership.bind(service),
+        assignInitialMembership: service.assignInitialMembership.bind(service)
+    });
+}

package/dist/modules/identity/user-role/user-role.repository.d.ts

@@ -0,0 +1,34 @@
+import { type Kysely, type RawBuilder, type Transaction } from "kysely";
+import type { IdentitySchema, Principal } from "../identity.types.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+export interface MembershipReadSources {
+    users(): RawBuilder<unknown>;
+    organizations(): RawBuilder<unknown>;
+    roles(): RawBuilder<unknown>;
+    customRoleIds(appId: string): RawBuilder<unknown>;
+}
+export declare function listMemberships(db: Kysely<IdentitySchema>, actor: Principal, query: IdentityListQuery, sources: MembershipReadSources): Promise<{
+    data: {
+        active: boolean;
+        version: number;
+    }[];
+    meta: {
+        page: number;
+        perPage: number;
+        total: number;
+        lastPage: number;
+    };
+}>;
+export declare function showMembership(db: Kysely<IdentitySchema>, actor: Principal, id: string, sources: MembershipReadSources): Promise<{
+    active: boolean;
+    version: number;
+} | undefined>;
+export declare function userVisibility(actor: Principal, customRoleIds: (appId: string) => RawBuilder<unknown>, userId: RawBuilder<unknown>): RawBuilder<unknown>;
+export declare function verifyMembershipSchema(db: Kysely<IdentitySchema>): Promise<void>;
+export declare function membershipTenantIds(trx: Transaction<IdentitySchema>, userId: string): Promise<string[]>;
+export declare function customRoleUserIds(trx: Transaction<IdentitySchema>, roleId: string): Promise<string[]>;
+export declare function assertManageableUser(trx: Transaction<IdentitySchema>, userId: string): Promise<"manageable" | "privileged" | "shared">;
+export declare function assignInvitedMembership(trx: Transaction<IdentitySchema>, userId: string, tenantId: string, roleId: "user" | "admin" | "super-admin"): Promise<void>;
+export declare function activeMembership(db: Kysely<IdentitySchema>, userId: string, tenantId: string, portal: "user" | "admin" | "super-admin"): Promise<{
+    custom_role_id: string | null;
+} | undefined>;

package/dist/modules/identity/user-role/user-role.repository.js

@@ -0,0 +1,87 @@
+import { sql } from "kysely";
+import { listRows, showRow } from "../support/pagination.js";
+const presentMembership = (row) => ({
+    ...row,
+    active: Boolean(row.active),
+    version: Number(row.version)
+});
+export function listMemberships(db, actor, query, sources) {
+    return listRows(db, membershipListSource(actor, sources), ["id", "userName", "organizationName", "roleName"], query, presentMembership);
+}
+export function showMembership(db, actor, id, sources) {
+    return showRow(db, membershipListSource(actor, sources), id, presentMembership);
+}
+export function userVisibility(actor, customRoleIds, userId) {
+    const eligible = sql `select m.user_id from identity_memberships m
+    where m.user_id=${userId} and (m.custom_role_id is null or m.custom_role_id in (${customRoleIds(actor.appId)}))
+    ${actor.portal === "super-admin" ? sql `` : sql `and m.tenant_id=${actor.tenant.id}`}`;
+    return actor.portal === "super-admin"
+        ? sql `exists (${eligible}) or not exists (select 1 from identity_memberships m where m.user_id=${userId})`
+        : sql `exists (${eligible})`;
+}
+export async function verifyMembershipSchema(db) {
+    await db
+        .selectFrom("identity_memberships")
+        .select(["custom_role_id", "active", "version"])
+        .limit(1)
+        .execute();
+}
+export async function membershipTenantIds(trx, userId) {
+    const rows = await trx
+        .selectFrom("identity_memberships")
+        .select("tenant_id")
+        .where("user_id", "=", userId)
+        .distinct()
+        .execute();
+    return rows.map((row) => row.tenant_id);
+}
+export async function customRoleUserIds(trx, roleId) {
+    const rows = await trx
+        .selectFrom("identity_memberships")
+        .select("user_id")
+        .where("custom_role_id", "=", roleId)
+        .execute();
+    return rows.map((row) => row.user_id);
+}
+export async function assertManageableUser(trx, userId) {
+    const privileged = await trx
+        .selectFrom("identity_memberships")
+        .select("role_id")
+        .where("user_id", "=", userId)
+        .where("role_id", "in", ["admin", "super-admin"])
+        .executeTakeFirst();
+    if (privileged)
+        return "privileged";
+    const tenants = await trx
+        .selectFrom("identity_memberships")
+        .select("tenant_id")
+        .where("user_id", "=", userId)
+        .distinct()
+        .execute();
+    return tenants.length > 1 ? "shared" : "manageable";
+}
+export async function assignInvitedMembership(trx, userId, tenantId, roleId) {
+    await trx
+        .insertInto("identity_memberships")
+        .values({ user_id: userId, tenant_id: tenantId, role_id: roleId })
+        .execute();
+}
+export function activeMembership(db, userId, tenantId, portal) {
+    return db
+        .selectFrom("identity_memberships")
+        .select("custom_role_id")
+        .where("user_id", "=", userId)
+        .where("tenant_id", "=", tenantId)
+        .where("role_id", "=", portal)
+        .where("active", "=", 1)
+        .executeTakeFirst();
+}
+function membershipListSource(actor, sources) {
+    const global = actor.portal === "super-admin";
+    return sql `select m.user_id||'~'||m.tenant_id||'~'||m.role_id as id,m.user_id as userId,m.tenant_id as tenantId,
+    coalesce(m.custom_role_id,m.role_id) as roleId,m.role_id as portal,m.active,m.version,u.name as userName,t.name as organizationName,
+    coalesce(c.name,m.role_id) as roleName from identity_memberships m
+    join (${sources.users()}) u on u.id=m.user_id join (${sources.organizations()}) t on t.id=m.tenant_id
+    left join (${sources.roles()}) c on c.id=m.custom_role_id
+    where (m.custom_role_id is null or c.app_id=${actor.appId}) ${global ? sql `` : sql `and m.tenant_id=${actor.tenant.id}`}`;
+}

package/dist/modules/identity/user-role/user-role.routes.d.ts

@@ -0,0 +1,5 @@
+export declare const userRoleResource: "memberships";
+export declare const userRoleResourceRoute: (controller: import("./user-role.controller.js").IdentityUserRoleController) => {
+    resource: "memberships";
+    controller: import("./user-role.controller.js").IdentityUserRoleController;
+};

package/dist/modules/identity/user-role/user-role.routes.js

@@ -0,0 +1,2 @@
+export const userRoleResource = "memberships";
+export const userRoleResourceRoute = (controller) => ({ resource: userRoleResource, controller });

package/dist/modules/identity/user-role/user-role.schema.d.ts

@@ -0,0 +1,14 @@
+import { z } from "zod";
+export declare const membershipDeleteQuerySchema: z.ZodObject<{
+    expectedVersion: z.ZodPipe<z.ZodString, z.ZodTransform<number, string>>;
+}, z.core.$strict>;
+export declare const membershipSchema: z.ZodObject<{
+    userId: z.ZodString;
+    tenantId: z.ZodOptional<z.ZodString>;
+    roleId: z.ZodString;
+}, z.core.$strict>;
+export declare const membershipUpdateSchema: z.ZodObject<{
+    roleId: z.ZodString;
+    active: z.ZodBoolean;
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;

package/dist/modules/identity/user-role/user-role.schema.js

@@ -0,0 +1,25 @@
+import { z } from "zod";
+import { identityKeySchema, resourceIdSchema } from "../support/identity.schema.js";
+const expectedVersion = z.number().int().min(0);
+export const membershipDeleteQuerySchema = z
+    .object({
+    expectedVersion: z
+        .string()
+        .regex(/^(0|[1-9][0-9]{0,9})$/)
+        .transform(Number)
+})
+    .strict();
+export const membershipSchema = z
+    .object({
+    userId: identityKeySchema,
+    tenantId: identityKeySchema.optional(),
+    roleId: resourceIdSchema
+})
+    .strict();
+export const membershipUpdateSchema = z
+    .object({
+    roleId: resourceIdSchema,
+    active: z.boolean(),
+    expectedVersion
+})
+    .strict();