@devxcrew/platform 0.1.2 → 0.1.6

package/dist/modules/identity/identity.presentation-service.js

@@ -1,51 +0,0 @@
-export class IdentityPresentationService {
-    db;
-    appName;
-    constructor(db, appName) {
-        this.db = db;
-        this.appName = appName;
-    }
-    async configuration(appId, requiresOrganizationId) {
-        const app = await this.db
-            .selectFrom("identity_app_settings")
-            .select("display_name")
-            .where("app_id", "=", appId)
-            .executeTakeFirst();
-        return {
-            displayName: app?.display_name ?? this.appName,
-            requiresOrganizationId,
-        };
-    }
-    async presentation(actor) {
-        const app = await this.db
-            .selectFrom("identity_app_settings")
-            .select(["display_name", "locale", "time_zone"])
-            .where("app_id", "=", actor.appId)
-            .executeTakeFirst();
-        const organization = await this.db
-            .selectFrom("identity_settings")
-            .selectAll()
-            .where("tenant_id", "=", actor.tenant.id)
-            .executeTakeFirst();
-        return {
-            displayName: app?.display_name ?? this.appName,
-            organizationDisplayName: organization?.display_name ?? actor.tenant.name,
-            locale: organization?.locale ?? app?.locale ?? "en",
-            timeZone: organization?.time_zone ?? app?.time_zone ?? "UTC",
-        };
-    }
-    async organizationSettings(actor) {
-        const organization = await this.db
-            .selectFrom("identity_settings")
-            .select("version")
-            .where("tenant_id", "=", actor.tenant.id)
-            .executeTakeFirst();
-        const presentation = await this.presentation(actor);
-        return {
-            displayName: presentation.organizationDisplayName,
-            locale: presentation.locale,
-            timeZone: presentation.timeZone,
-            version: Number(organization?.version ?? 0),
-        };
-    }
-}

package/dist/modules/identity/identity.roles-service.d.ts

@@ -1,49 +0,0 @@
-import type { Kysely } from "kysely";
-import type { IdentitySchema, Portal, Principal } from "./identity.types.js";
-export declare class IdentityRolesService {
-    private readonly db;
-    constructor(db: Kysely<IdentitySchema>);
-    resolve(database: Kysely<IdentitySchema>, actor: Principal, roleId: string, tenantId: string): Promise<{
-        portal: Portal;
-        customRoleId: null;
-    } | {
-        portal: "user";
-        customRoleId: string;
-    }>;
-    create(actor: Principal, raw: unknown): Promise<{
-        id: `${string}-${string}-${string}-${string}-${string}`;
-        name: string;
-        tenantId: string;
-        portal: string;
-        system: boolean;
-        active: boolean;
-        version: number;
-        permissionIds: string[];
-    }>;
-    update(actor: Principal, id: string, raw: unknown): Promise<{
-        id: string;
-        name: string;
-        tenantId: string;
-        portal: string;
-        system: boolean;
-        active: boolean;
-        version: number;
-        permissionIds: string[];
-    }>;
-    updateMembership(actor: Principal, id: string, raw: unknown): Promise<{
-        id: string;
-        userId: string;
-        tenantId: string;
-        roleId: string;
-        portal: Portal;
-        active: boolean;
-        version: number;
-    }>;
-    removeMembership(actor: Principal, id: string, expectedVersion?: number): Promise<void>;
-    private manage;
-    private scope;
-    private permissions;
-    private uniqueName;
-    private replacePermissions;
-    private audit;
-}

package/dist/modules/identity/identity.roles-service.js

@@ -1,327 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { validateDeclaredPermissions } from "./identity.permission-declarations.js";
-import { IdentityError } from "./identity.error.js";
-import { checkIdentityRequest } from "./identity.request-context.js";
-import { protectAdministrators } from "./identity.membership-policy.js";
-import { customRoleCreateSchema, customRoleUpdateSchema, membershipUpdateSchema, } from "./identity.administration-schema.js";
-export class IdentityRolesService {
-    db;
-    constructor(db) {
-        this.db = db;
-    }
-    async resolve(database, actor, roleId, tenantId) {
-        if (["user", "admin", "super-admin"].includes(roleId)) {
-            if (actor.portal !== "super-admin" && roleId !== "user")
-                throw new IdentityError(403, "Only super administrators can assign privileged roles.");
-            return { portal: roleId, customRoleId: null };
-        }
-        const role = await database
-            .selectFrom("identity_custom_roles")
-            .select("id")
-            .where("id", "=", roleId)
-            .where("app_id", "=", actor.appId)
-            .where("tenant_id", "=", tenantId)
-            .where("active", "=", 1)
-            .executeTakeFirst();
-        if (!role)
-            throw new IdentityError(422, "Select an active role in this organization.");
-        return { portal: "user", customRoleId: role.id };
-    }
-    async create(actor, raw) {
-        this.manage(actor);
-        const input = customRoleCreateSchema.parse(raw);
-        const tenantId = input.tenantId ?? actor.tenant.id;
-        this.scope(actor, tenantId);
-        return this.db.transaction().execute(async (trx) => {
-            checkIdentityRequest();
-            const tenant = await trx
-                .selectFrom("identity_tenants")
-                .select("id")
-                .where("id", "=", tenantId)
-                .where("active", "=", 1)
-                .executeTakeFirst();
-            if (!tenant)
-                throw new IdentityError(422, "Organization is inactive or unavailable.");
-            await this.permissions(trx, input.permissionIds, actor.appId);
-            await this.uniqueName(trx, actor.appId, tenantId, input.name);
-            const id = randomUUID();
-            await trx
-                .insertInto("identity_custom_roles")
-                .values({
-                id,
-                app_id: actor.appId,
-                tenant_id: tenantId,
-                name: input.name,
-            })
-                .execute();
-            await this.replacePermissions(trx, id, input.permissionIds);
-            await this.audit(trx, actor, tenantId, "identity.role.created", id);
-            checkIdentityRequest();
-            return {
-                id,
-                name: input.name,
-                tenantId,
-                portal: "user",
-                system: false,
-                active: true,
-                version: 0,
-                permissionIds: [...new Set(input.permissionIds)],
-            };
-        });
-    }
-    async update(actor, id, raw) {
-        this.manage(actor);
-        const input = customRoleUpdateSchema.parse(raw);
-        return this.db.transaction().execute(async (trx) => {
-            checkIdentityRequest();
-            const role = await trx
-                .selectFrom("identity_custom_roles")
-                .selectAll()
-                .where("id", "=", id)
-                .where("app_id", "=", actor.appId)
-                .executeTakeFirst();
-            if (!role ||
-                (actor.portal !== "super-admin" && role.tenant_id !== actor.tenant.id))
-                throw new IdentityError(404, "Role not found.");
-            if (Number(role.version) !== input.expectedVersion)
-                throw new IdentityError(409, "This record changed. Reload before saving.");
-            if (input.permissionIds)
-                await this.permissions(trx, input.permissionIds, actor.appId);
-            if (input.name)
-                await this.uniqueName(trx, actor.appId, role.tenant_id, input.name, id);
-            const updated = await trx
-                .updateTable("identity_custom_roles")
-                .set({
-                name: input.name ?? role.name,
-                active: input.active === undefined ? role.active : Number(input.active),
-                version: input.expectedVersion + 1,
-            })
-                .where("id", "=", id)
-                .where("version", "=", input.expectedVersion)
-                .executeTakeFirst();
-            if (updated.numUpdatedRows !== 1n)
-                throw new IdentityError(409, "This record changed. Reload before saving.");
-            if (input.permissionIds)
-                await this.replacePermissions(trx, id, input.permissionIds);
-            await trx
-                .deleteFrom("identity_sessions")
-                .where("app_id", "=", actor.appId)
-                .where("tenant_id", "=", role.tenant_id)
-                .where("user_id", "in", trx
-                .selectFrom("identity_memberships")
-                .select("user_id")
-                .where("custom_role_id", "=", id))
-                .execute();
-            await this.audit(trx, actor, role.tenant_id, "identity.role.changed", id);
-            const permissions = await trx
-                .selectFrom("identity_custom_role_permissions")
-                .select("permission_id")
-                .where("role_id", "=", id)
-                .execute();
-            checkIdentityRequest();
-            return {
-                id,
-                name: input.name ?? role.name,
-                tenantId: role.tenant_id,
-                portal: "user",
-                system: false,
-                active: input.active ?? Boolean(role.active),
-                version: input.expectedVersion + 1,
-                permissionIds: permissions.map((row) => row.permission_id),
-            };
-        });
-    }
-    async updateMembership(actor, id, raw) {
-        this.manage(actor);
-        const input = membershipUpdateSchema.parse(raw);
-        const [userId, tenantId, oldPortal, extra] = id.split("~");
-        if (!userId || !tenantId || !oldPortal || extra)
-            throw new IdentityError(404, "Membership not found.");
-        this.scope(actor, tenantId);
-        if (actor.portal !== "super-admin" && oldPortal !== "user")
-            throw new IdentityError(403, "Only super administrators can change privileged memberships.");
-        return this.db.transaction().execute(async (trx) => {
-            checkIdentityRequest();
-            const current = await trx
-                .selectFrom("identity_memberships")
-                .selectAll()
-                .where("user_id", "=", userId)
-                .where("tenant_id", "=", tenantId)
-                .where("role_id", "=", oldPortal)
-                .executeTakeFirst();
-            if (!current)
-                throw new IdentityError(404, "Membership not found.");
-            if (current.custom_role_id &&
-                !(await trx
-                    .selectFrom("identity_custom_roles")
-                    .select("id")
-                    .where("id", "=", current.custom_role_id)
-                    .where("app_id", "=", actor.appId)
-                    .executeTakeFirst()))
-                throw new IdentityError(404, "Membership not found.");
-            if (input.active &&
-                !(await trx
-                    .selectFrom("identity_tenants")
-                    .select("id")
-                    .where("id", "=", tenantId)
-                    .where("active", "=", 1)
-                    .executeTakeFirst()))
-                throw new IdentityError(422, "Organization is inactive or unavailable.");
-            if (Number(current.version) !== input.expectedVersion)
-                throw new IdentityError(409, "This record changed. Reload before saving.");
-            const selected = await this.resolve(trx, actor, input.roleId, tenantId);
-            if (!input.active || selected.portal !== oldPortal)
-                await protectAdministrators(trx, userId, tenantId, oldPortal);
-            if (selected.portal !== oldPortal &&
-                (await trx
-                    .selectFrom("identity_memberships")
-                    .select("user_id")
-                    .where("user_id", "=", userId)
-                    .where("tenant_id", "=", tenantId)
-                    .where("role_id", "=", selected.portal)
-                    .executeTakeFirst()))
-                throw new IdentityError(409, "This account already has that portal membership.");
-            const changed = await trx
-                .updateTable("identity_memberships")
-                .set({
-                role_id: selected.portal,
-                custom_role_id: selected.customRoleId,
-                active: Number(input.active),
-                version: input.expectedVersion + 1,
-            })
-                .where("user_id", "=", userId)
-                .where("tenant_id", "=", tenantId)
-                .where("role_id", "=", oldPortal)
-                .where("version", "=", input.expectedVersion)
-                .executeTakeFirst();
-            if (changed.numUpdatedRows !== 1n)
-                throw new IdentityError(409, "This record changed. Reload before saving.");
-            await trx
-                .deleteFrom("identity_sessions")
-                .where("app_id", "=", actor.appId)
-                .where("user_id", "=", userId)
-                .where("tenant_id", "=", tenantId)
-                .where("portal", "=", oldPortal)
-                .execute();
-            const nextId = `${userId}~${tenantId}~${selected.portal}`;
-            await this.audit(trx, actor, tenantId, "identity.membership.changed", nextId);
-            checkIdentityRequest();
-            return {
-                id: nextId,
-                userId,
-                tenantId,
-                roleId: selected.customRoleId ?? selected.portal,
-                portal: selected.portal,
-                active: input.active,
-                version: input.expectedVersion + 1,
-            };
-        });
-    }
-    async removeMembership(actor, id, expectedVersion) {
-        this.manage(actor);
-        if (!Number.isInteger(expectedVersion) || Number(expectedVersion) < 0)
-            throw new IdentityError(422, "Provide the current membership version.");
-        const [userId, tenantId, portal, extra] = id.split("~");
-        if (!userId || !tenantId || !portal || extra)
-            throw new IdentityError(404, "Membership not found.");
-        this.scope(actor, tenantId);
-        if (actor.portal !== "super-admin" && portal !== "user")
-            throw new IdentityError(403, "Only super administrators can change privileged memberships.");
-        await this.db.transaction().execute(async (trx) => {
-            checkIdentityRequest();
-            const current = await trx
-                .selectFrom("identity_memberships")
-                .select(["custom_role_id", "version"])
-                .where("user_id", "=", userId)
-                .where("tenant_id", "=", tenantId)
-                .where("role_id", "=", portal)
-                .executeTakeFirst();
-            if (!current ||
-                (current.custom_role_id &&
-                    !(await trx
-                        .selectFrom("identity_custom_roles")
-                        .select("id")
-                        .where("id", "=", current.custom_role_id)
-                        .where("app_id", "=", actor.appId)
-                        .executeTakeFirst())))
-                throw new IdentityError(404, "Membership not found.");
-            if (Number(current.version) !== expectedVersion)
-                throw new IdentityError(409, "This record changed. Reload before saving.");
-            await protectAdministrators(trx, userId, tenantId, portal);
-            await trx
-                .deleteFrom("identity_memberships")
-                .where("user_id", "=", userId)
-                .where("tenant_id", "=", tenantId)
-                .where("role_id", "=", portal)
-                .execute();
-            await trx
-                .deleteFrom("identity_sessions")
-                .where("app_id", "=", actor.appId)
-                .where("user_id", "=", userId)
-                .where("tenant_id", "=", tenantId)
-                .where("portal", "=", portal)
-                .execute();
-            await this.audit(trx, actor, tenantId, "identity.membership.removed", id);
-            checkIdentityRequest();
-        });
-    }
-    manage(actor) {
-        if (actor.portal === "user" ||
-            !actor.permissions.includes("identity.manage"))
-            throw new IdentityError(403, "Access denied.");
-    }
-    scope(actor, tenantId) {
-        if (actor.portal !== "super-admin" && tenantId !== actor.tenant.id)
-            throw new IdentityError(403, "Access denied.");
-    }
-    async permissions(trx, ids, appId) {
-        await validateDeclaredPermissions(trx, appId, "user", ids);
-        if (!ids.includes("desk.user"))
-            throw new IdentityError(422, "Keep the user desk permission.");
-        if (ids.some((id) => id === "identity.manage" ||
-            (id.startsWith("desk.") && id !== "desk.user")))
-            throw new IdentityError(403, "Custom user roles cannot grant administration access.");
-        const known = await trx
-            .selectFrom("identity_permissions")
-            .select("id")
-            .execute();
-        if (ids.some((id) => !known.some((row) => row.id === id)))
-            throw new IdentityError(422, "Unknown permission.");
-    }
-    async uniqueName(trx, appId, tenantId, name, exceptId = "") {
-        if (await trx
-            .selectFrom("identity_custom_roles")
-            .select("id")
-            .where("app_id", "=", appId)
-            .where("tenant_id", "=", tenantId)
-            .where("name", "=", name)
-            .where("id", "!=", exceptId)
-            .executeTakeFirst())
-            throw new IdentityError(409, "A role with this name already exists.");
-    }
-    async replacePermissions(trx, id, permissions) {
-        await trx
-            .deleteFrom("identity_custom_role_permissions")
-            .where("role_id", "=", id)
-            .execute();
-        for (const permission of new Set(permissions))
-            await trx
-                .insertInto("identity_custom_role_permissions")
-                .values({ role_id: id, permission_id: permission })
-                .execute();
-    }
-    async audit(trx, actor, tenantId, action, resourceId) {
-        await trx
-            .insertInto("identity_audit_events")
-            .values({
-            id: randomUUID(),
-            app_id: actor.appId,
-            actor_id: actor.user.id,
-            tenant_id: tenantId,
-            action,
-            resource_id: resourceId,
-            created_at: new Date().toISOString(),
-        })
-            .execute();
-    }
-}