@devxcrew/platform 0.1.2 → 0.1.6

package/dist/modules/identity/identity.controller.d.ts

@@ -1,19 +1,21 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { IdentityService } from "./identity.service.js";
+import type { IdentityUserProvider } from "./user/index.js";
 import type { IdentityConfig, Portal } from "./identity.types.js";
-import { IdentityAdministrationService } from "./identity.administration-service.js";
-import { IdentityLifecycleService } from "./identity.lifecycle-service.js";
+import { IdentityAdministrationComposition } from "./composition/identity.composition.js";
 export declare class IdentityController {
-    private readonly service;
     private readonly config;
     private readonly administration;
-    private readonly lifecycle;
-    constructor(service: IdentityService, config: IdentityConfig, administration: IdentityAdministrationService, lifecycle: IdentityLifecycleService);
+    private readonly authentication;
+    private readonly accounts;
+    constructor(service: IdentityUserProvider["identity"], config: IdentityConfig, administration: IdentityAdministrationComposition, lifecycle: IdentityUserProvider["lifecycle"]);
     handle(request: IncomingMessage, response: ServerResponse, signal?: AbortSignal): Promise<boolean>;
     authenticateRequest(request: IncomingMessage, requestedPortal: Portal, signal?: AbortSignal): Promise<import("./identity.types.js").Principal>;
     private handleRequest;
     private adminRequest;
     private wireList;
+    private requireResult;
+    private requireAction;
+    private requireUpdate;
     private cookie;
     private cookieName;
     private token;

package/dist/modules/identity/identity.controller.js

@@ -1,19 +1,23 @@
 import { ZodError } from "zod";
-import { portalSchema, loginSchema, passwordSchema, } from "./identity.schema.js";
-import { IdentityError } from "./identity.error.js";
+import { portalSchema, IdentityUserLifecycleController, userLifecyclePaths } from "./user/index.js";
+import { settingsPaths } from "./settings/index.js";
+import { IdentitySessionAuthenticationController } from "./session/index.js";
+import { IdentityError } from "./support/identity.error.js";
 import { identityRoutes, portalRoutes } from "./identity.routes.js";
-import { resourceListQuerySchema, membershipDeleteQuerySchema, resourceIdSchema, } from "./identity.administration-schema.js";
-import { checkIdentityRequest, runIdentityRequest, } from "./identity.request-context.js";
+import { resourceListQuerySchema } from "./support/pagination.schema.js";
+import { membershipDeleteQuerySchema } from "./user-role/index.js";
+import { resourceIdSchema } from "./support/identity.schema.js";
+import { checkIdentityRequest, runIdentityRequest } from "./support/identity.request-context.js";
 export class IdentityController {
-    service;
     config;
     administration;
-    lifecycle;
+    authentication;
+    accounts;
     constructor(service, config, administration, lifecycle) {
-        this.service = service;
         this.config = config;
         this.administration = administration;
-        this.lifecycle = lifecycle;
+        this.authentication = new IdentitySessionAuthenticationController(service, config);
+        this.accounts = new IdentityUserLifecycleController(lifecycle);
     }
     async handle(request, response, signal) {
         return runIdentityRequest(signal, () => this.handleRequest(request, response));
@@ -23,11 +27,14 @@ export class IdentityController {
             checkIdentityRequest();
             const parsedPortal = portalSchema.safeParse(requestedPortal);
             if (!parsedPortal.success)
-                throw new IdentityError(422, "Validation failed", { portal: ["Select a supported portal."] });
+                throw new IdentityError(422, "Validation failed", {
+                    portal: ["Select a supported portal."]
+                });
             const portal = parsedPortal.data;
-            if (!["GET", "HEAD", "OPTIONS"].includes(request.method ?? "") && request.headers.origin !== this.config.origin)
+            if (!["GET", "HEAD", "OPTIONS"].includes(request.method ?? "") &&
+                request.headers.origin !== this.config.origin)
                 throw new IdentityError(403, "Untrusted request origin.");
-            const principal = await this.service.authenticate(portal, this.token(request, portal));
+            const principal = await this.authentication.authenticate(portal, this.token(request, portal));
             checkIdentityRequest();
             return principal;
         });
@@ -46,8 +53,8 @@ export class IdentityController {
             const token = this.token(request, portal);
             if (desk) {
                 try {
-                    const principal = await this.service.authenticate(portal, token);
-                    this.service.requirePermission(principal, `desk.${portal}`);
+                    const principal = await this.authentication.authenticate(portal, token);
+                    this.authentication.requireDesk(principal, portal);
                     return false;
                 }
                 catch (error) {
@@ -59,37 +66,33 @@ export class IdentityController {
                 }
             }
             const route = identityRoutes.find((r) => r.method === request.method && r.path === api?.[2]);
-            if (request.method !== "GET" &&
-                request.headers.origin !== this.config.origin)
+            if (request.method !== "GET" && request.headers.origin !== this.config.origin)
                 throw new IdentityError(403, "Untrusted request origin.");
             if (!route) {
                 await this.adminRequest(request, response, portal, token, api[2]);
                 return true;
             }
             if (route.action === "login") {
-                const result = await this.service.login(portal, loginSchema
-                    .refine((input) => this.config.mode !== "multi-tenant" || Boolean(input.tenantId), { path: ["tenantId"], message: "Enter an organization ID." })
-                    .parse(await this.body(request)), request.socket.remoteAddress ?? "unknown", token);
+                const result = await this.authentication.login(portal, await this.body(request), request.socket.remoteAddress ?? "unknown", token);
                 response.setHeader("Set-Cookie", this.cookie(portal, result.token, result.sessionSeconds));
                 this.json(response, 201, { data: result.principal });
             }
             else if (route.action === "logout") {
-                await this.service.logout(portal, token);
+                await this.authentication.logout(portal, token);
                 response.setHeader("Set-Cookie", this.cookie(portal, "", 0));
                 response.writeHead(204);
                 response.end();
             }
             else {
-                const principal = await this.service.authenticate(portal, token);
+                const principal = await this.authentication.authenticate(portal, token);
                 if (route.action === "password") {
-                    await this.service.changePassword(principal, passwordSchema.parse(await this.body(request)));
+                    await this.authentication.changePassword(principal, await this.body(request));
                     response.setHeader("Set-Cookie", this.cookie(portal, "", 0));
                     response.writeHead(204);
                     response.end();
                 }
                 else {
-                    this.service.requirePermission(principal, `desk.${portal}`);
-                    this.json(response, 200, { data: principal });
+                    this.json(response, 200, { data: this.authentication.current(principal, portal) });
                 }
             }
         }
@@ -105,62 +108,67 @@ export class IdentityController {
             else {
                 console.error("Identity request failed.");
                 this.json(response, 500, {
-                    message: "Unable to complete the request.",
+                    message: "Unable to complete the request."
                 });
             }
         }
         return true;
     }
     async adminRequest(request, response, portal, token, path) {
-        if (path === "configuration") {
+        if (path === settingsPaths[0]) {
             if (request.method !== "GET")
                 throw new IdentityError(405, "Method not allowed.");
             this.json(response, 200, {
-                data: await this.administration.configuration(this.config.appId, this.config.mode === "multi-tenant"),
+                data: await this.administration.settingsController.configuration(this.config.appId, this.config.mode === "multi-tenant")
             });
             return;
         }
-        if (["recovery", "recovery/complete", "invitations/accept"].includes(path)) {
+        if ([
+            userLifecyclePaths.recovery,
+            userLifecyclePaths.recoveryComplete,
+            userLifecyclePaths.invitationAccept
+        ].some((route) => route === path)) {
             if (request.method !== "POST")
                 throw new IdentityError(405, "Method not allowed.");
             const raw = await this.body(request);
-            const data = path === "recovery"
-                ? await this.lifecycle.requestRecovery(portal, raw, request.socket.remoteAddress ?? "unknown")
-                : await this.lifecycle.complete(portal, path === "recovery/complete" ? "recovery" : "invitation", raw, request.socket.remoteAddress ?? "unknown");
-            this.json(response, path === "recovery" ? 202 : 200, { data });
+            const data = path === userLifecyclePaths.recovery
+                ? await this.accounts.requestRecovery(portal, raw, request.socket.remoteAddress ?? "unknown")
+                : await this.accounts.complete(portal, path === userLifecyclePaths.recoveryComplete ? "recovery" : "invitation", raw, request.socket.remoteAddress ?? "unknown");
+            this.json(response, path === userLifecyclePaths.recovery ? 202 : 200, { data });
             return;
         }
-        const principal = await this.service.authenticate(portal, token);
-        if (path === "presentation") {
+        const principal = await this.authentication.authenticate(portal, token);
+        if (path === settingsPaths[1]) {
             if (request.method !== "GET")
                 throw new IdentityError(405, "Method not allowed.");
             this.json(response, 200, {
-                data: await this.administration.presentation(principal),
+                data: await this.administration.settingsController.presentation(principal)
             });
             return;
         }
-        if (path === "invitations" || path.startsWith("invitations/")) {
-            if (path === "invitations" && request.method === "GET") {
+        if (path === userLifecyclePaths.invitations ||
+            path.startsWith(`${userLifecyclePaths.invitations}/`)) {
+            if (path === userLifecyclePaths.invitations && request.method === "GET") {
                 const query = resourceListQuerySchema.parse(Object.fromEntries(new URL(request.url, this.config.origin).searchParams));
-                this.json(response, 200, this.wireList(await this.lifecycle.list(principal, query)));
+                this.json(response, 200, this.wireList(await this.accounts.index(principal, query)));
             }
-            else if (path === "invitations" && request.method === "POST") {
+            else if (path === userLifecyclePaths.invitations && request.method === "POST") {
                 this.json(response, 201, {
-                    data: await this.lifecycle.invite(principal, await this.body(request)),
+                    data: await this.accounts.store(principal, await this.body(request))
                 });
             }
             else if (request.method === "GET") {
                 this.json(response, 200, {
-                    data: await this.lifecycle.show(principal, resourceIdSchema.parse(path.slice("invitations/".length))),
+                    data: await this.accounts.show(principal, resourceIdSchema.parse(path.slice(`${userLifecyclePaths.invitations}/`.length)))
                 });
             }
             else if (request.method === "POST" && path.endsWith("/resend")) {
                 this.json(response, 201, {
-                    data: await this.lifecycle.resend(principal, resourceIdSchema.parse(path.slice("invitations/".length, -"/resend".length))),
+                    data: await this.accounts.resend(principal, resourceIdSchema.parse(path.slice(`${userLifecyclePaths.invitations}/`.length, -"/resend".length)))
                 });
             }
             else if (request.method === "DELETE") {
-                await this.lifecycle.revoke(principal, resourceIdSchema.parse(path.slice("invitations/".length)));
+                await this.accounts.destroy(principal, resourceIdSchema.parse(path.slice(`${userLifecyclePaths.invitations}/`.length)));
                 response.writeHead(204);
                 response.end();
             }
@@ -168,53 +176,50 @@ export class IdentityController {
                 throw new IdentityError(405, "Method not allowed.");
             return;
         }
-        if ([
-            "profile",
-            "settings",
-            "application-settings",
-            "security-settings",
-        ].includes(path)) {
+        if (path === userLifecyclePaths.profile ||
+            settingsPaths.includes(path)) {
             if (!["GET", "PATCH"].includes(request.method ?? ""))
                 throw new IdentityError(405, "Method not allowed.");
             const input = request.method === "PATCH" ? await this.body(request) : undefined;
-            const data = path === "profile"
-                ? await this.administration.profile(principal, input)
-                : path === "settings"
-                    ? await this.administration.settings(principal, input)
-                    : await this.administration.applicationSettings(principal, path === "security-settings", input, this.config.sessionSeconds);
+            const data = path === userLifecyclePaths.profile
+                ? await this.administration.userController.profile(principal, input)
+                : path === settingsPaths[2]
+                    ? await this.administration.settingsController.organization(principal, input)
+                    : await this.administration.settingsController.application(principal, path === settingsPaths[4], input, this.config.sessionSeconds);
             this.json(response, 200, { data });
             return;
         }
-        const match = path.match(/^(users|organizations|memberships|roles|permissions|sessions|audit-events)(?:\/([^/]+))?$/);
-        if (!match)
+        const [segment, encodedId, extra] = path.split("/");
+        const route = this.administration.routes.find(({ resource }) => resource === segment);
+        if (!route || extra)
             throw new IdentityError(404, "Not found.");
-        const resource = match[1];
-        const id = match[2]
-            ? resourceIdSchema.parse(decodeURIComponent(match[2]))
-            : undefined;
+        const resource = route.resource;
+        const controller = route.controller;
+        const id = encodedId ? resourceIdSchema.parse(decodeURIComponent(encodedId)) : undefined;
         if (request.method === "GET") {
             const query = resourceListQuerySchema.parse(Object.fromEntries(new URL(request.url, this.config.origin).searchParams));
             this.json(response, 200, id
-                ? { data: await this.administration.show(principal, resource, id) }
-                : this.wireList(await this.administration.list(principal, resource, query)));
+                ? { data: await this.requireResult(controller.show(principal, id)) }
+                : this.wireList((await controller.index(principal, query))));
         }
         else if (request.method === "POST" && !id) {
             this.json(response, 201, {
-                data: await this.administration.create(principal, resource, await this.body(request)),
+                data: await this.requireAction(controller.store?.bind(controller), principal, await this.body(request))
             });
         }
         else if (request.method === "PATCH" && id) {
             this.json(response, 200, {
-                data: await this.administration.update(principal, resource, id, await this.body(request)),
+                data: await this.requireUpdate(controller.update?.bind(controller), principal, id, await this.body(request))
             });
         }
         else if (request.method === "DELETE" && id) {
             const query = new URL(request.url, this.config.origin).searchParams;
             const expectedVersion = resource === "memberships"
-                ? membershipDeleteQuerySchema.parse(Object.fromEntries(query))
-                    .expectedVersion
+                ? membershipDeleteQuerySchema.parse(Object.fromEntries(query)).expectedVersion
                 : undefined;
-            await this.administration.remove(principal, resource, id, expectedVersion);
+            if (!controller.destroy)
+                throw new IdentityError(405, "Deletion is not supported for this resource.");
+            await controller.destroy(principal, id, expectedVersion);
             response.writeHead(204);
             response.end();
         }
@@ -228,10 +233,26 @@ export class IdentityController {
                 current_page: page.meta.page,
                 per_page: page.meta.perPage,
                 total: page.meta.total,
-                last_page: page.meta.lastPage,
-            },
+                last_page: page.meta.lastPage
+            }
         };
     }
+    async requireResult(result) {
+        const value = await result;
+        if (!value)
+            throw new IdentityError(404, "Resource not found.");
+        return value;
+    }
+    requireAction(action, actor, raw) {
+        if (!action)
+            throw new IdentityError(405, "Creation is not supported for this resource.");
+        return action(actor, raw);
+    }
+    requireUpdate(action, actor, id, raw) {
+        if (!action)
+            throw new IdentityError(405, "Update is not supported for this resource.");
+        return action(actor, id, raw);
+    }
     cookie(portal, token, age) {
         return `${this.cookieName(portal)}=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${age}${this.config.origin.startsWith("https:") ? "; Secure" : ""}`;
     }
@@ -250,8 +271,7 @@ export class IdentityController {
         response.end(JSON.stringify(body));
     }
     async body(request) {
-        if (request.headers["content-type"]?.split(";")[0].trim() !==
-            "application/json")
+        if (request.headers["content-type"]?.split(";")[0].trim() !== "application/json")
             throw new IdentityError(415, "Use JSON request bodies.");
         const chunks = [];
         let size = 0;

package/dist/modules/identity/identity.migration.d.ts

@@ -1,2 +1 @@
-import type { Migration } from "kysely/migration";
-export declare const identityMigration: Migration;
+export {};

package/dist/modules/identity/identity.migration.js

@@ -1,79 +1 @@
-export const identityMigration = {
-    async up(db) {
-        await db.schema
-            .createTable("identity_users")
-            .addColumn("id", "text", (c) => c.primaryKey())
-            .addColumn("email", "text", (c) => c.notNull().unique())
-            .addColumn("name", "text", (c) => c.notNull())
-            .addColumn("password_hash", "text", (c) => c.notNull())
-            .addColumn("active", "integer", (c) => c.notNull().defaultTo(1))
-            .execute();
-        await db.schema
-            .createTable("identity_tenants")
-            .addColumn("id", "text", (c) => c.primaryKey())
-            .addColumn("name", "text", (c) => c.notNull())
-            .addColumn("active", "integer", (c) => c.notNull().defaultTo(1))
-            .execute();
-        await db.schema
-            .createTable("identity_roles")
-            .addColumn("id", "text", (c) => c.primaryKey())
-            .execute();
-        await db.schema
-            .createTable("identity_permissions")
-            .addColumn("id", "text", (c) => c.primaryKey())
-            .execute();
-        await db.schema
-            .createTable("identity_role_permissions")
-            .addColumn("role_id", "text", (c) => c.notNull().references("identity_roles.id"))
-            .addColumn("permission_id", "text", (c) => c.notNull().references("identity_permissions.id"))
-            .addPrimaryKeyConstraint("identity_role_permission_pk", [
-            "role_id",
-            "permission_id",
-        ])
-            .execute();
-        await db.schema
-            .createTable("identity_memberships")
-            .addColumn("user_id", "text", (c) => c.notNull().references("identity_users.id").onDelete("cascade"))
-            .addColumn("tenant_id", "text", (c) => c.notNull().references("identity_tenants.id").onDelete("cascade"))
-            .addColumn("role_id", "text", (c) => c.notNull().references("identity_roles.id"))
-            .addPrimaryKeyConstraint("identity_membership_pk", [
-            "user_id",
-            "tenant_id",
-            "role_id",
-        ])
-            .execute();
-        await db.schema
-            .createTable("identity_sessions")
-            .addColumn("token_hash", "text", (c) => c.primaryKey())
-            .addColumn("user_id", "text", (c) => c.notNull().references("identity_users.id").onDelete("cascade"))
-            .addColumn("tenant_id", "text", (c) => c.notNull().references("identity_tenants.id").onDelete("cascade"))
-            .addColumn("app_id", "text", (c) => c.notNull())
-            .addColumn("portal", "text", (c) => c.notNull())
-            .addColumn("expires_at", "text", (c) => c.notNull())
-            .execute();
-        await db.schema
-            .createIndex("identity_sessions_expiry")
-            .on("identity_sessions")
-            .column("expires_at")
-            .execute();
-        await db.schema
-            .createTable("identity_throttles")
-            .addColumn("key", "text", (c) => c.primaryKey())
-            .addColumn("attempts", "integer", (c) => c.notNull())
-            .addColumn("expires_at", "text", (c) => c.notNull())
-            .execute();
-    },
-    async down(db) {
-        for (const table of [
-            "identity_throttles",
-            "identity_sessions",
-            "identity_memberships",
-            "identity_role_permissions",
-            "identity_permissions",
-            "identity_roles",
-            "identity_tenants",
-            "identity_users",
-        ])
-            await db.schema.dropTable(table).execute();
-    },
-};
+export {};

package/dist/modules/identity/identity.provider.d.ts

@@ -1,6 +1,6 @@
 import type { Kysely } from "kysely";
 import type { IdentitySchema, IdentityProviderOptions } from "./identity.types.js";
-import { type IdentityPermissionDeclaration } from "./identity.permission-declarations.js";
+import { type IdentityPermissionDeclaration } from "./permission/index.js";
 export declare function createIdentityProvider(database: Kysely<IdentitySchema>, environment: NodeJS.ProcessEnv, options?: IdentityProviderOptions): {
     registerPermissions: (declaration: IdentityPermissionDeclaration) => Promise<{
         owner: string;
@@ -11,7 +11,7 @@ export declare function createIdentityProvider(database: Kysely<IdentitySchema>,
     authenticateRequest: (request: import("node:http").IncomingMessage, requestedPortal: import("./identity.types.js").Portal, signal?: AbortSignal) => Promise<import("./identity.types.js").Principal>;
     requirePermission: (principal: import("./identity.types.js").Principal, permission: string) => void;
     administration: {
-        list: (actor: import("./identity.types.js").Principal, resource: import("./identity.administration-schema.js").IdentityResource, query: import("./identity.administration-schema.js").IdentityListQuery) => Promise<{
+        list: (actor: import("./identity.types.js").Principal, resource: import("./index.js").IdentityResource, query: import("./index.js").IdentityListQuery) => Promise<{
             data: Record<string, unknown>[];
             meta: {
                 page: number;
@@ -19,14 +19,35 @@ export declare function createIdentityProvider(database: Kysely<IdentitySchema>,
                 total: number;
                 lastPage: number;
             };
+        } | {
+            data: {
+                portals: string[];
+            }[];
+            meta: {
+                page: number;
+                perPage: number;
+                total: number;
+                lastPage: number;
+            };
+        } | {
+            data: {
+                active: boolean;
+                version: number;
+            }[];
+            meta: {
+                page: number;
+                perPage: number;
+                total: number;
+                lastPage: number;
+            };
         }>;
-        show: (actor: import("./identity.types.js").Principal, resource: import("./identity.administration-schema.js").IdentityResource, id: string) => Promise<Record<string, unknown>>;
-        create: (actor: import("./identity.types.js").Principal, resource: import("./identity.administration-schema.js").IdentityResource, raw: unknown) => Promise<{
-            id: string;
-            name: string;
+        show: (actor: import("./identity.types.js").Principal, resource: import("./index.js").IdentityResource, id: string) => Promise<Record<string, unknown> | {
+            portals: string[];
+        } | {
             active: boolean;
             version: number;
-        } | {
+        }>;
+        create: (actor: import("./identity.types.js").Principal, resource: import("./index.js").IdentityResource, raw: unknown) => Promise<{
             id: string;
             userId: string;
             tenantId: string;
@@ -34,8 +55,17 @@ export declare function createIdentityProvider(database: Kysely<IdentitySchema>,
             portal: import("./identity.types.js").Portal;
             active: boolean;
             version: number;
+        } | {
+            id: string;
+            name: string;
+            active: boolean;
+            version: number;
         }>;
-        update: (actor: import("./identity.types.js").Principal, resource: import("./identity.administration-schema.js").IdentityResource, id: string, raw: unknown) => Promise<{
+        update: (actor: import("./identity.types.js").Principal, resource: import("./index.js").IdentityResource, id: string, raw: unknown) => Promise<{
+            id: string;
+            permissionIds: string[];
+            version: number;
+        } | {
             id: string;
             userId: string;
             tenantId: string;
@@ -48,12 +78,8 @@ export declare function createIdentityProvider(database: Kysely<IdentitySchema>,
             version: number;
             id: string;
             name: string;
-        } | {
-            id: string;
-            permissionIds: string[];
-            version: number;
         }>;
-        remove: (actor: import("./identity.types.js").Principal, resource: import("./identity.administration-schema.js").IdentityResource, id: string, expectedVersion?: number) => Promise<void>;
+        remove: (actor: import("./identity.types.js").Principal, resource: import("./index.js").IdentityResource, id: string, expectedVersion?: number) => Promise<void>;
         profile: (actor: import("./identity.types.js").Principal, raw?: unknown) => Promise<{
             active: boolean;
             version: number;

package/dist/modules/identity/identity.provider.js

@@ -1,11 +1,9 @@
 import { z } from "zod";
-import { IdentityRepository } from "./identity.repository.js";
-import { IdentityService } from "./identity.service.js";
+import { createIdentityUserProvider } from "./user/index.js";
 import { IdentityController } from "./identity.controller.js";
-import { IdentityAdministrationService } from "./identity.administration-service.js";
-import { IdentityLifecycleService } from "./identity.lifecycle-service.js";
-import { identityKeySchema } from "./identity.schema.js";
-import { registerIdentityPermissions } from "./identity.permission-declarations.js";
+import { IdentityAdministrationComposition } from "./composition/identity.composition.js";
+import { identityKeySchema } from "./user/index.js";
+import { createIdentityPermissionProvider } from "./permission/index.js";
 export function createIdentityProvider(database, environment, options = {}) {
     const config = z
         .object({
@@ -13,34 +11,35 @@ export function createIdentityProvider(database, environment, options = {}) {
         origin: z.url(),
         mode: z.enum(["single-client", "multi-tenant"]),
         tenantId: identityKeySchema,
-        sessionSeconds: z.coerce.number().int().min(300).max(86400),
+        sessionSeconds: z.coerce.number().int().min(300).max(86400)
     })
         .parse({
         appId: environment.APP_ID,
         origin: environment.APP_URL,
         mode: environment.IDENTITY_MODE ?? "single-client",
         tenantId: environment.IDENTITY_TENANT_ID ?? "default",
-        sessionSeconds: environment.IDENTITY_SESSION_SECONDS ?? 28800,
+        sessionSeconds: environment.IDENTITY_SESSION_SECONDS ?? 28800
     });
     const origin = new URL(config.origin);
-    if (origin.origin !== config.origin ||
-        !["http:", "https:"].includes(origin.protocol))
+    if (origin.origin !== config.origin || !["http:", "https:"].includes(origin.protocol))
         throw new Error("Identity requires a valid application origin.");
     if (origin.protocol !== "https:" &&
         !["127.0.0.1", "localhost", "[::1]"].includes(origin.hostname))
         throw new Error("Identity requires HTTPS outside loopback development.");
-    const service = new IdentityService(new IdentityRepository(database), config);
+    const permissions = createIdentityPermissionProvider(database);
     const appName = z
         .string()
         .trim()
         .min(1)
         .max(100)
         .parse(environment.APP_NAME || config.appId);
-    const administration = new IdentityAdministrationService(database, appName);
-    const lifecycle = new IdentityLifecycleService(database, config, options.delivery);
+    const administration = new IdentityAdministrationComposition(database, appName, permissions);
+    const user = createIdentityUserProvider(database, config, permissions, administration.userOwnership(), options);
+    const service = user.identity;
+    const lifecycle = user.lifecycle;
     const controller = new IdentityController(service, config, administration, lifecycle);
     return {
-        registerPermissions: (declaration) => registerIdentityPermissions(database, config.appId, declaration),
+        registerPermissions: (declaration) => permissions.register(config.appId, declaration),
         handle: controller.handle.bind(controller),
         authenticate: service.authenticate.bind(service),
         authenticateRequest: controller.authenticateRequest.bind(controller),
@@ -53,67 +52,14 @@ export function createIdentityProvider(database, environment, options = {}) {
             remove: administration.remove.bind(administration),
             profile: administration.profile.bind(administration),
             settings: administration.settings.bind(administration),
-            presentation: administration.presentation.bind(administration),
+            presentation: administration.presentation.bind(administration)
         },
         async verify() {
-            await database.selectFrom("identity_permission_declarations").select(["permission_id", "label"]).limit(1).execute();
+            await permissions.verify();
+            await user.verify();
+            await administration.verify();
             for (const declaration of options.permissions ?? [])
-                await registerIdentityPermissions(database, config.appId, declaration);
-            await database
-                .selectFrom("identity_roles")
-                .select("id")
-                .limit(1)
-                .execute();
-            await database
-                .selectFrom("identity_users")
-                .select("version")
-                .limit(1)
-                .execute();
-            await database
-                .selectFrom("identity_tenants")
-                .select("version")
-                .limit(1)
-                .execute();
-            await database
-                .selectFrom("identity_roles")
-                .select("version")
-                .limit(1)
-                .execute();
-            await database
-                .selectFrom("identity_settings")
-                .select("version")
-                .limit(1)
-                .execute();
-            await database
-                .selectFrom("identity_app_settings")
-                .select(["version", "session_seconds"])
-                .limit(1)
-                .execute();
-            await database
-                .selectFrom("identity_tokens")
-                .select(["delivered", "consumed_at"])
-                .limit(1)
-                .execute();
-            await database
-                .selectFrom("identity_audit_events")
-                .select("created_at")
-                .limit(1)
-                .execute();
-            await database
-                .selectFrom("identity_custom_roles")
-                .select(["app_id", "tenant_id", "version"])
-                .limit(1)
-                .execute();
-            await database
-                .selectFrom("identity_custom_role_permissions")
-                .select("permission_id")
-                .limit(1)
-                .execute();
-            await database
-                .selectFrom("identity_memberships")
-                .select(["custom_role_id", "active", "version"])
-                .limit(1)
-                .execute();
-        },
+                await permissions.register(config.appId, declaration);
+        }
     };
 }