@devxcrew/platform 0.1.2 → 0.1.6

package/dist/modules/identity/identity.public-schemas.d.ts

@@ -1,4 +1,10 @@
-export * from "./identity.administration-schema.js";
-export * from "./identity.lifecycle-schema.js";
-export { loginSchema, passwordSchema, portalSchema, } from "./identity.schema.js";
+export * from "./support/pagination.schema.js";
+export { userCreateSchema, userUpdateSchema, profileSchema, passwordSchema, accountSchema } from "./user/user.schema.js";
+export { invitationSchema, recoverySchema, tokenCompletionSchema } from "./user/user.lifecycle.schema.js";
+export { customRoleCreateSchema, customRoleUpdateSchema, roleUpdateSchema } from "./role/role.schema.js";
+export { membershipDeleteQuerySchema, membershipSchema, membershipUpdateSchema } from "./user-role/user-role.schema.js";
+export { loginSchema } from "./session/session.schema.js";
+export { settingsSchema, securitySettingsSchema } from "./settings/settings.schema.js";
+export { organizationCreateSchema, organizationUpdateSchema } from "./organization/organization.schema.js";
+export { identityKeySchema, portalSchema, resourceIdSchema } from "./support/identity.schema.js";
 export type { IdentityPermissionCatalogEntry } from "./identity.types.js";

package/dist/modules/identity/identity.public-schemas.js

@@ -1,3 +1,9 @@
-export * from "./identity.administration-schema.js";
-export * from "./identity.lifecycle-schema.js";
-export { loginSchema, passwordSchema, portalSchema, } from "./identity.schema.js";
+export * from "./support/pagination.schema.js";
+export { userCreateSchema, userUpdateSchema, profileSchema, passwordSchema, accountSchema } from "./user/user.schema.js";
+export { invitationSchema, recoverySchema, tokenCompletionSchema } from "./user/user.lifecycle.schema.js";
+export { customRoleCreateSchema, customRoleUpdateSchema, roleUpdateSchema } from "./role/role.schema.js";
+export { membershipDeleteQuerySchema, membershipSchema, membershipUpdateSchema } from "./user-role/user-role.schema.js";
+export { loginSchema } from "./session/session.schema.js";
+export { settingsSchema, securitySettingsSchema } from "./settings/settings.schema.js";
+export { organizationCreateSchema, organizationUpdateSchema } from "./organization/organization.schema.js";
+export { identityKeySchema, portalSchema, resourceIdSchema } from "./support/identity.schema.js";

package/dist/modules/identity/identity.repository.d.ts

@@ -1,40 +1 @@
-import { type Kysely } from "kysely";
-import type { IdentitySchema, Portal } from "./identity.types.js";
-export declare class IdentityRepository {
-    private readonly db;
-    constructor(db: Kysely<IdentitySchema>);
-    user(email: string): Promise<{
-        active: number;
-        email: string;
-        id: string;
-        name: string;
-        password_hash: string;
-        version: number;
-    } | undefined>;
-    sessionSeconds(appId: string, fallback: number): Promise<number>;
-    principal(userId: string, tenantId: string, portal: Portal, appId: string): Promise<{
-        user: {
-            id: string;
-            email: string;
-            name: string;
-        };
-        tenant: {
-            id: string;
-            name: string;
-        };
-        permissions: string[];
-    } | null>;
-    session(tokenHash: string, appId: string, portal: Portal, now: string): Promise<{
-        app_id: string;
-        expires_at: string;
-        portal: Portal;
-        tenant_id: string;
-        token_hash: string;
-        user_id: string;
-    } | undefined>;
-    createSession(session: IdentitySchema["identity_sessions"], expectedHash: string, previous?: string): Promise<boolean>;
-    revoke(tokenHash: string, appId: string, portal: Portal): Promise<void>;
-    throttle(key: string): Promise<number>;
-    clearThrottle(key: string): Promise<void>;
-    changePassword(userId: string, expectedHash: string, passwordHash: string): Promise<boolean>;
-}
+export {};

package/dist/modules/identity/identity.repository.js

@@ -1,196 +1 @@
-import { filterDeclaredPermissions } from "./identity.permission-declarations.js";
-import { sql } from "kysely";
-import { checkIdentityRequest } from "./identity.request-context.js";
-export class IdentityRepository {
-    db;
-    constructor(db) {
-        this.db = db;
-    }
-    user(email) {
-        return this.db
-            .selectFrom("identity_users")
-            .selectAll()
-            .where("email", "=", email)
-            .executeTakeFirst();
-    }
-    async sessionSeconds(appId, fallback) {
-        const row = await this.db
-            .selectFrom("identity_app_settings")
-            .select("session_seconds")
-            .where("app_id", "=", appId)
-            .executeTakeFirst();
-        return Number(row?.session_seconds ?? fallback);
-    }
-    async principal(userId, tenantId, portal, appId) {
-        const member = await this.db
-            .selectFrom("identity_memberships as m")
-            .innerJoin("identity_users as u", "u.id", "m.user_id")
-            .innerJoin("identity_tenants as t", "t.id", "m.tenant_id")
-            .select([
-            "u.id",
-            "u.email",
-            "u.name",
-            "t.id as tenantId",
-            "t.name as tenantName",
-            "m.custom_role_id as customRoleId",
-        ])
-            .where("u.id", "=", userId)
-            .where("m.tenant_id", "=", tenantId)
-            .where("m.role_id", "=", portal)
-            .where("m.active", "=", 1)
-            .where("u.active", "=", 1)
-            .where("t.active", "=", 1)
-            .executeTakeFirst();
-        if (!member)
-            return null;
-        if (member.customRoleId) {
-            const role = await this.db
-                .selectFrom("identity_custom_roles")
-                .select("id")
-                .where("id", "=", member.customRoleId)
-                .where("app_id", "=", appId)
-                .where("tenant_id", "=", tenantId)
-                .where("active", "=", 1)
-                .executeTakeFirst();
-            if (!role || portal !== "user")
-                return null;
-            const permissions = await this.db
-                .selectFrom("identity_custom_role_permissions")
-                .select("permission_id")
-                .where("role_id", "=", role.id)
-                .execute();
-            return {
-                user: { id: member.id, email: member.email, name: member.name },
-                tenant: { id: member.tenantId, name: member.tenantName },
-                permissions: await filterDeclaredPermissions(this.db, appId, portal, permissions.map((row) => row.permission_id)),
-            };
-        }
-        const permissions = await this.db
-            .selectFrom("identity_role_permissions")
-            .select("permission_id")
-            .where("role_id", "=", portal)
-            .execute();
-        return {
-            user: { id: member.id, email: member.email, name: member.name },
-            tenant: { id: member.tenantId, name: member.tenantName },
-            permissions: await filterDeclaredPermissions(this.db, appId, portal, permissions.map((p) => p.permission_id)),
-        };
-    }
-    async session(tokenHash, appId, portal, now) {
-        return this.db
-            .selectFrom("identity_sessions")
-            .selectAll()
-            .where("token_hash", "=", tokenHash)
-            .where("app_id", "=", appId)
-            .where("portal", "=", portal)
-            .where("expires_at", ">", now)
-            .executeTakeFirst();
-    }
-    async createSession(session, expectedHash, previous) {
-        return this.db.transaction().execute(async (trx) => {
-            checkIdentityRequest();
-            const current = await trx
-                .selectFrom("identity_users")
-                .select("id")
-                .where("id", "=", session.user_id)
-                .where("password_hash", "=", expectedHash)
-                .where("active", "=", 1)
-                .executeTakeFirst();
-            if (!current)
-                return false;
-            const membership = await trx
-                .selectFrom("identity_memberships")
-                .select("custom_role_id")
-                .where("user_id", "=", session.user_id)
-                .where("tenant_id", "=", session.tenant_id)
-                .where("role_id", "=", session.portal)
-                .where("active", "=", 1)
-                .executeTakeFirst();
-            if (!membership)
-                return false;
-            if (membership.custom_role_id) {
-                const role = await trx
-                    .selectFrom("identity_custom_roles")
-                    .select("id")
-                    .where("id", "=", membership.custom_role_id)
-                    .where("app_id", "=", session.app_id)
-                    .where("tenant_id", "=", session.tenant_id)
-                    .where("active", "=", 1)
-                    .executeTakeFirst();
-                if (!role)
-                    return false;
-            }
-            await trx
-                .deleteFrom("identity_sessions")
-                .where("expires_at", "<=", new Date().toISOString())
-                .execute();
-            if (previous)
-                await trx
-                    .deleteFrom("identity_sessions")
-                    .where("token_hash", "=", previous)
-                    .where("app_id", "=", session.app_id)
-                    .where("portal", "=", session.portal)
-                    .execute();
-            await trx.insertInto("identity_sessions").values(session).execute();
-            checkIdentityRequest();
-            return true;
-        });
-    }
-    async revoke(tokenHash, appId, portal) {
-        checkIdentityRequest();
-        await this.db
-            .deleteFrom("identity_sessions")
-            .where("token_hash", "=", tokenHash)
-            .where("app_id", "=", appId)
-            .where("portal", "=", portal)
-            .execute();
-    }
-    async throttle(key) {
-        const now = new Date();
-        return this.db.transaction().execute(async (trx) => {
-            await trx
-                .deleteFrom("identity_throttles")
-                .where("expires_at", "<=", now.toISOString())
-                .execute();
-            await trx
-                .insertInto("identity_throttles")
-                .values({
-                key,
-                attempts: 1,
-                expires_at: new Date(now.getTime() + 15 * 60 * 1000).toISOString(),
-            })
-                .onConflict((c) => c.column("key").doUpdateSet({ attempts: sql `attempts + 1` }))
-                .execute();
-            const row = await trx
-                .selectFrom("identity_throttles")
-                .select("attempts")
-                .where("key", "=", key)
-                .executeTakeFirstOrThrow();
-            return Number(row.attempts);
-        });
-    }
-    async clearThrottle(key) {
-        await this.db
-            .deleteFrom("identity_throttles")
-            .where("key", "=", key)
-            .execute();
-    }
-    async changePassword(userId, expectedHash, passwordHash) {
-        return this.db.transaction().execute(async (trx) => {
-            checkIdentityRequest();
-            const result = await trx
-                .updateTable("identity_users")
-                .set({ password_hash: passwordHash })
-                .where("id", "=", userId)
-                .where("password_hash", "=", expectedHash)
-                .executeTakeFirst();
-            if (result.numUpdatedRows !== 1n)
-                return false;
-            await trx
-                .deleteFrom("identity_sessions")
-                .where("user_id", "=", userId)
-                .execute();
-            return true;
-        });
-    }
-}
+export {};

package/dist/modules/identity/identity.routes.d.ts

@@ -1,4 +1,4 @@
-import type { Portal } from "./identity.types.js";
+import { portalRoutes } from "./session/index.js";
 export declare const identityRoutes: readonly [{
     readonly method: "POST";
     readonly path: "sessions";
@@ -16,7 +16,4 @@ export declare const identityRoutes: readonly [{
     readonly path: "password";
     readonly action: "password";
 }];
-export declare const portalRoutes: Record<Portal, {
-    login: string;
-    desk: string;
-}>;
+export { portalRoutes };

package/dist/modules/identity/identity.routes.js

@@ -1,11 +1,3 @@
-export const identityRoutes = [
-    { method: "POST", path: "sessions", action: "login" },
-    { method: "GET", path: "sessions/current", action: "session" },
-    { method: "DELETE", path: "sessions/current", action: "logout" },
-    { method: "PATCH", path: "password", action: "password" },
-];
-export const portalRoutes = {
-    user: { login: "/login", desk: "/desk" },
-    admin: { login: "/admin/login", desk: "/admin/desk" },
-    "super-admin": { login: "/sa/login", desk: "/sa/desk" },
-};
+import { sessionRoutes, portalRoutes } from "./session/index.js";
+export const identityRoutes = sessionRoutes;
+export { portalRoutes };

package/dist/modules/identity/identity.schema.d.ts

@@ -1,27 +1 @@
-import { z } from "zod";
-export declare const portalSchema: z.ZodEnum<{
-    admin: "admin";
-    "super-admin": "super-admin";
-    user: "user";
-}>;
-export declare const identityKeySchema: z.ZodString;
-export declare const loginSchema: z.ZodObject<{
-    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
-    password: z.ZodString;
-    tenantId: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-export declare const passwordSchema: z.ZodObject<{
-    currentPassword: z.ZodString;
-    password: z.ZodString;
-}, z.core.$strict>;
-export declare const accountSchema: z.ZodObject<{
-    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
-    name: z.ZodString;
-    password: z.ZodString;
-    portal: z.ZodEnum<{
-        admin: "admin";
-        "super-admin": "super-admin";
-        user: "user";
-    }>;
-    tenantId: z.ZodString;
-}, z.core.$strict>;
+export {};

package/dist/modules/identity/identity.schema.js

@@ -1,34 +1 @@
-import { z } from "zod";
-export const portalSchema = z.enum(["user", "admin", "super-admin"]);
-export const identityKeySchema = z
-    .string()
-    .regex(/^[a-zA-Z0-9._-]{1,100}$/)
-    .refine((value) => !/^\.+$/.test(value), "Use an identifier with a letter or number.");
-export const loginSchema = z
-    .object({
-    email: z
-        .email()
-        .max(254)
-        .transform((value) => value.trim().toLowerCase()),
-    password: z.string().min(1).max(256),
-    tenantId: identityKeySchema.optional(),
-})
-    .strict();
-export const passwordSchema = z
-    .object({
-    currentPassword: z.string().min(1).max(256),
-    password: z.string().min(12).max(256),
-})
-    .strict();
-export const accountSchema = z
-    .object({
-    email: z
-        .email()
-        .max(254)
-        .transform((value) => value.toLowerCase()),
-    name: z.string().trim().min(1).max(100),
-    password: z.string().min(12).max(256),
-    portal: portalSchema,
-    tenantId: identityKeySchema,
-})
-    .strict();
+export {};

package/dist/modules/identity/identity.seed.d.ts

@@ -1,3 +1 @@
-import type { Kysely } from "kysely";
-import type { IdentitySchema } from "./identity.types.js";
-export declare function seedIdentity(db: Kysely<IdentitySchema>, env: NodeJS.ProcessEnv): Promise<void>;
+export {};

package/dist/modules/identity/identity.seed.js

@@ -1,81 +1 @@
-import { randomUUID } from "node:crypto";
-import { accountSchema } from "./identity.schema.js";
-import { hashPassword } from "./identity.password.js";
-export async function seedIdentity(db, env) {
-    const tenantId = env.IDENTITY_TENANT_ID ?? "default";
-    const accounts = ["user", "admin", "super-admin"].flatMap((portal) => {
-        const prefix = `IDENTITY_SEED_${portal.toUpperCase().replace("-", "_")}`;
-        const email = env[`${prefix}_EMAIL`];
-        const password = env[`${prefix}_PASSWORD`];
-        if (!email && !password)
-            return [];
-        return [
-            accountSchema.parse({
-                email,
-                password,
-                name: env[`${prefix}_NAME`]?.trim() || portal,
-                portal,
-                tenantId,
-            }),
-        ];
-    });
-    await db.transaction().execute(async (trx) => {
-        await trx
-            .insertInto("identity_tenants")
-            .values({
-            id: tenantId,
-            name: env.IDENTITY_TENANT_NAME ?? "Default organization",
-            active: 1,
-        })
-            .onConflict((c) => c.column("id").doNothing())
-            .execute();
-        for (const portal of ["user", "admin", "super-admin"]) {
-            await trx
-                .insertInto("identity_roles")
-                .values({ id: portal })
-                .onConflict((c) => c.column("id").doNothing())
-                .execute();
-            for (const permission of [
-                `desk.${portal}`,
-                "identity.self",
-                "identity.password",
-                ...(portal === "user" ? [] : ["identity.manage"]),
-            ]) {
-                await trx
-                    .insertInto("identity_permissions")
-                    .values({ id: permission })
-                    .onConflict((c) => c.column("id").doNothing())
-                    .execute();
-                await trx
-                    .insertInto("identity_role_permissions")
-                    .values({ role_id: portal, permission_id: permission })
-                    .onConflict((c) => c.columns(["role_id", "permission_id"]).doNothing())
-                    .execute();
-            }
-        }
-        for (const account of accounts) {
-            const existing = await trx
-                .selectFrom("identity_users")
-                .select("id")
-                .where("email", "=", account.email)
-                .executeTakeFirst();
-            if (existing)
-                continue;
-            const id = randomUUID();
-            await trx
-                .insertInto("identity_users")
-                .values({
-                id,
-                email: account.email,
-                name: account.name,
-                password_hash: await hashPassword(account.password),
-                active: 1,
-            })
-                .execute();
-            await trx
-                .insertInto("identity_memberships")
-                .values({ user_id: id, tenant_id: tenantId, role_id: account.portal })
-                .execute();
-        }
-    });
-}
+export {};

package/dist/modules/identity/identity.service.d.ts

@@ -1,32 +1 @@
-import { IdentityRepository } from "./identity.repository.js";
-import type { IdentityConfig, Portal, Principal } from "./identity.types.js";
-import type { z } from "zod";
-import type { loginSchema, passwordSchema } from "./identity.schema.js";
-export declare class IdentityService {
-    private readonly repository;
-    private readonly config;
-    private readonly dummyHash;
-    constructor(repository: IdentityRepository, config: IdentityConfig);
-    login(portal: Portal, input: z.infer<typeof loginSchema>, address: string, previous?: string): Promise<{
-        token: string;
-        sessionSeconds: number;
-        principal: {
-            user: {
-                id: string;
-                email: string;
-                name: string;
-            };
-            tenant: {
-                id: string;
-                name: string;
-            };
-            permissions: string[];
-            appId: string;
-            portal: Portal;
-        };
-    }>;
-    authenticate(portal: Portal, token?: string): Promise<Principal>;
-    requirePermission(principal: Principal, permission: string): void;
-    logout(portal: Portal, token?: string): Promise<void>;
-    changePassword(principal: Principal, input: z.infer<typeof passwordSchema>): Promise<void>;
-}
+export {};

package/dist/modules/identity/identity.service.js

@@ -1,83 +1 @@
-import { randomBytes } from "node:crypto";
-import { digest, hashPassword, verifyPassword } from "./identity.password.js";
-import { IdentityError } from "./identity.error.js";
-export class IdentityService {
-    repository;
-    config;
-    dummyHash = hashPassword(randomBytes(32).toString("hex"));
-    constructor(repository, config) {
-        this.repository = repository;
-        this.config = config;
-    }
-    async login(portal, input, address, previous) {
-        const key = digest(`${this.config.appId}:${portal}:${address}:${input.email}`);
-        const ipKey = digest(`${this.config.appId}:ip:${address}`);
-        if ((await this.repository.throttle(ipKey)) > 100 ||
-            (await this.repository.throttle(key)) > 10)
-            throw new IdentityError(429, "Too many sign-in attempts. Try again later.");
-        const user = await this.repository.user(input.email);
-        const valid = await verifyPassword(input.password, user?.password_hash ?? (await this.dummyHash));
-        const tenantId = this.config.mode === "single-client"
-            ? this.config.tenantId
-            : input.tenantId;
-        if (!valid ||
-            !user ||
-            !Number(user.active) ||
-            !tenantId ||
-            (this.config.mode === "single-client" &&
-                input.tenantId &&
-                input.tenantId !== tenantId))
-            throw new IdentityError(401, "Invalid credentials or portal access.");
-        const principal = await this.repository.principal(user.id, tenantId, portal, this.config.appId);
-        if (!principal?.permissions.includes(`desk.${portal}`))
-            throw new IdentityError(401, "Invalid credentials or portal access.");
-        const token = randomBytes(32).toString("base64url");
-        const sessionSeconds = await this.repository.sessionSeconds(this.config.appId, this.config.sessionSeconds);
-        const created = await this.repository.createSession({
-            token_hash: digest(token),
-            user_id: user.id,
-            tenant_id: tenantId,
-            app_id: this.config.appId,
-            portal,
-            expires_at: new Date(Date.now() + sessionSeconds * 1000).toISOString(),
-        }, user.password_hash, previous ? digest(previous) : undefined);
-        if (!created)
-            throw new IdentityError(401, "Invalid credentials or portal access.");
-        await this.repository.clearThrottle(key);
-        return {
-            token,
-            sessionSeconds,
-            principal: { ...principal, appId: this.config.appId, portal },
-        };
-    }
-    async authenticate(portal, token) {
-        if (!token || !/^[A-Za-z0-9_-]{43}$/.test(token))
-            throw new IdentityError(401, "Sign in to continue.");
-        const session = await this.repository.session(digest(token), this.config.appId, portal, new Date().toISOString());
-        if (!session ||
-            (this.config.mode === "single-client" &&
-                session.tenant_id !== this.config.tenantId))
-            throw new IdentityError(401, "Sign in to continue.");
-        const principal = await this.repository.principal(session.user_id, session.tenant_id, portal, this.config.appId);
-        if (!principal)
-            throw new IdentityError(401, "Sign in to continue.");
-        return { ...principal, appId: this.config.appId, portal };
-    }
-    requirePermission(principal, permission) {
-        if (!principal.permissions.includes(permission))
-            throw new IdentityError(403, "Access denied.");
-    }
-    async logout(portal, token) {
-        if (token)
-            await this.repository.revoke(digest(token), this.config.appId, portal);
-    }
-    async changePassword(principal, input) {
-        this.requirePermission(principal, "identity.password");
-        const user = await this.repository.user(principal.user.email);
-        if (!user ||
-            !(await verifyPassword(input.currentPassword, user.password_hash)))
-            throw new IdentityError(422, "Current password is incorrect.");
-        if (!(await this.repository.changePassword(user.id, user.password_hash, await hashPassword(input.password))))
-            throw new IdentityError(409, "Account changed. Sign in again.");
-    }
-}
+export {};