@devxcrew/platform 0.1.2 → 0.1.6

package/dist/modules/identity/role/role.controller.d.ts

@@ -0,0 +1,42 @@
+import type { Principal } from "../identity.types.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+import type { IdentityRoleProvider } from "./role.provider.js";
+export declare class IdentityRoleController {
+    private readonly service;
+    constructor(service: IdentityRoleProvider);
+    index(actor: Principal, query: IdentityListQuery): Promise<{
+        data: {
+            version: number;
+            active: boolean;
+            system: boolean;
+            permissionIds: string[];
+        }[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show(actor: Principal, id: string): Promise<{
+        version: number;
+        active: boolean;
+        system: boolean;
+        permissionIds: string[];
+    } | undefined>;
+    store(actor: Principal, raw: unknown): Promise<{
+        id: `${string}-${string}-${string}-${string}-${string}`;
+        name: string;
+        tenantId: string;
+        portal: string;
+        system: boolean;
+        active: boolean;
+        version: number;
+        permissionIds: string[];
+    }>;
+    update(actor: Principal, id: string, raw: unknown): Promise<{
+        id: string;
+        permissionIds: string[];
+        version: number;
+    }>;
+}

package/dist/modules/identity/role/role.controller.js

@@ -0,0 +1,25 @@
+import { IdentityError } from "../support/identity.error.js";
+export class IdentityRoleController {
+    service;
+    constructor(service) {
+        this.service = service;
+    }
+    index(actor, query) {
+        return this.service.list(actor, query);
+    }
+    show(actor, id) {
+        return this.service.show(actor, id);
+    }
+    store(actor, raw) {
+        return this.service.create(actor, raw);
+    }
+    async update(actor, id, raw) {
+        if (["user", "admin", "super-admin"].includes(id)) {
+            const row = await this.show(actor, id);
+            if (!row)
+                throw new IdentityError(404, "Resource not found.");
+            return this.service.updateSystemPermissions(actor, id, raw);
+        }
+        return this.service.update(actor, id, raw);
+    }
+}

package/dist/modules/identity/{identity.roles-migration.js → role/role.migration.js}

@@ -8,20 +8,13 @@ export const identityRolesMigration = {
             .addColumn("name", "text", (c) => c.notNull())
             .addColumn("active", "integer", (c) => c.notNull().defaultTo(1))
             .addColumn("version", "integer", (c) => c.notNull().defaultTo(0))
-            .addUniqueConstraint("identity_custom_role_name", [
-            "app_id",
-            "tenant_id",
-            "name",
-        ])
+            .addUniqueConstraint("identity_custom_role_name", ["app_id", "tenant_id", "name"])
             .execute();
         await db.schema
             .createTable("identity_custom_role_permissions")
             .addColumn("role_id", "text", (c) => c.notNull().references("identity_custom_roles.id").onDelete("cascade"))
             .addColumn("permission_id", "text", (c) => c.notNull().references("identity_permissions.id"))
-            .addPrimaryKeyConstraint("identity_custom_role_permission_pk", [
-            "role_id",
-            "permission_id",
-        ])
+            .addPrimaryKeyConstraint("identity_custom_role_permission_pk", ["role_id", "permission_id"])
             .execute();
         await db.schema
             .alterTable("identity_memberships")
@@ -45,20 +38,14 @@ export const identityRolesMigration = {
         const restrictedMembership = await db
             .selectFrom("identity_memberships")
             .select("user_id")
-            .where((eb) => eb.or([
-            eb("custom_role_id", "is not", null),
-            eb("active", "!=", 1),
-        ]))
+            .where((eb) => eb.or([eb("custom_role_id", "is not", null), eb("active", "!=", 1)]))
             .limit(1)
             .executeTakeFirst();
         if (customRole || restrictedMembership)
             throw new Error("Role rollback would remove access restrictions. Restore a compatible database snapshot instead.");
         for (const column of ["custom_role_id", "active", "version"])
-            await db.schema
-                .alterTable("identity_memberships")
-                .dropColumn(column)
-                .execute();
+            await db.schema.alterTable("identity_memberships").dropColumn(column).execute();
         await db.schema.dropTable("identity_custom_role_permissions").execute();
         await db.schema.dropTable("identity_custom_roles").execute();
-    },
+    }
 };

package/dist/modules/identity/role/role.provider.d.ts

@@ -0,0 +1,14 @@
+import type { Kysely, Transaction } from "kysely";
+import type { IdentityMutation, IdentitySchema, Principal } from "../identity.types.js";
+import type { IdentityPermissionProvider } from "../permission/index.js";
+import { IdentityRolesService } from "./role.service.js";
+import { activeCustomRole, customRoleInApp, customRoleIdsSource, customRoleNameSource } from "./role.repository.js";
+export type IdentityRoleProvider = Pick<IdentityRolesService, "list" | "show" | "resolve" | "create" | "update" | "updateSystemPermissions"> & {
+    verify(): Promise<void>;
+    activeCustomRole: typeof activeCustomRole;
+    customRoleInApp: typeof customRoleInApp;
+    customRoleNameSource: typeof customRoleNameSource;
+    customRoleIdsSource: typeof customRoleIdsSource;
+    permissionIds(db: Kysely<IdentitySchema>, portal: "user" | "admin" | "super-admin", customRoleId: string | null, appId: string, tenantId: string): Promise<string[] | null>;
+};
+export declare function createIdentityRoleProvider(database: Kysely<IdentitySchema>, permissions: IdentityPermissionProvider, mutate: IdentityMutation, recordAudit: (trx: Transaction<IdentitySchema>, actor: Principal, tenantId: string, action: string, id: string) => Promise<void>, activeOrganization: (trx: Transaction<IdentitySchema>, id: string) => Promise<unknown>, revokeRoleSessions: (trx: Transaction<IdentitySchema>, appId: string, tenantId: string, roleId: string) => Promise<void>): IdentityRoleProvider;

package/dist/modules/identity/role/role.provider.js

@@ -0,0 +1,30 @@
+import { createIdentityRolePermissionProvider } from "../role-permission/index.js";
+import { IdentityRolesService } from "./role.service.js";
+import { activeCustomRole, customRoleInApp, customRoleIdsSource, customRoleNameSource, verifyRoleSchema } from "./role.repository.js";
+export function createIdentityRoleProvider(database, permissions, mutate, recordAudit, activeOrganization, revokeRoleSessions) {
+    const rolePermissions = createIdentityRolePermissionProvider(database, permissions);
+    const service = new IdentityRolesService(database, rolePermissions, mutate, recordAudit, activeOrganization, revokeRoleSessions);
+    return Object.freeze({
+        activeCustomRole,
+        customRoleInApp,
+        customRoleNameSource,
+        customRoleIdsSource,
+        async permissionIds(db, portal, customRoleId, appId, tenantId) {
+            if (!customRoleId)
+                return rolePermissions.permissionIds(db, portal, false);
+            if (portal !== "user" || !(await activeCustomRole(db, customRoleId, appId, tenantId)))
+                return null;
+            return rolePermissions.permissionIds(db, customRoleId, true);
+        },
+        async verify() {
+            await verifyRoleSchema(database);
+            await rolePermissions.verify();
+        },
+        list: service.list.bind(service),
+        show: service.show.bind(service),
+        resolve: service.resolve.bind(service),
+        create: service.create.bind(service),
+        update: service.update.bind(service),
+        updateSystemPermissions: service.updateSystemPermissions.bind(service)
+    });
+}

package/dist/modules/identity/role/role.repository.d.ts

@@ -0,0 +1,38 @@
+import { type Kysely, type RawBuilder } from "kysely";
+import type { IdentitySchema, Principal } from "../identity.types.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+export declare function listRoles(db: Kysely<IdentitySchema>, actor: Principal, query: IdentityListQuery, permissionJson: {
+    system(id: RawBuilder<unknown>): RawBuilder<unknown>;
+    custom(id: RawBuilder<unknown>): RawBuilder<unknown>;
+}): Promise<{
+    data: {
+        version: number;
+        active: boolean;
+        system: boolean;
+        permissionIds: string[];
+    }[];
+    meta: {
+        page: number;
+        perPage: number;
+        total: number;
+        lastPage: number;
+    };
+}>;
+export declare function showRole(db: Kysely<IdentitySchema>, actor: Principal, id: string, permissionJson: {
+    system(id: RawBuilder<unknown>): RawBuilder<unknown>;
+    custom(id: RawBuilder<unknown>): RawBuilder<unknown>;
+}): Promise<{
+    version: number;
+    active: boolean;
+    system: boolean;
+    permissionIds: string[];
+} | undefined>;
+export declare function verifyRoleSchema(db: Kysely<IdentitySchema>): Promise<void>;
+export declare function activeCustomRole(db: Kysely<IdentitySchema>, id: string, appId: string, tenantId: string): Promise<{
+    id: string;
+} | undefined>;
+export declare function customRoleInApp(db: Kysely<IdentitySchema>, id: string, appId: string): Promise<{
+    id: string;
+} | undefined>;
+export declare const customRoleNameSource: () => RawBuilder<unknown>;
+export declare const customRoleIdsSource: (appId: string) => RawBuilder<unknown>;

package/dist/modules/identity/role/role.repository.js

@@ -0,0 +1,46 @@
+import { sql } from "kysely";
+import { listRows, showRow } from "../support/pagination.js";
+const presentRole = (row) => ({
+    ...row,
+    version: Number(row.version),
+    active: Boolean(row.active),
+    system: Boolean(row.system),
+    permissionIds: JSON.parse(String(row.permissionIds))
+});
+export function listRoles(db, actor, query, permissionJson) {
+    return listRows(db, roleListSource(actor, permissionJson), ["id", "name"], query, presentRole);
+}
+export function showRole(db, actor, id, permissionJson) {
+    return showRow(db, roleListSource(actor, permissionJson), id, presentRole);
+}
+export async function verifyRoleSchema(db) {
+    await db.selectFrom("identity_roles").select(["id", "version"]).limit(1).execute();
+    await db
+        .selectFrom("identity_custom_roles")
+        .select(["app_id", "tenant_id", "version"])
+        .limit(1)
+        .execute();
+}
+export function activeCustomRole(db, id, appId, tenantId) {
+    return db
+        .selectFrom("identity_custom_roles")
+        .select("id")
+        .where("id", "=", id)
+        .where("app_id", "=", appId)
+        .where("tenant_id", "=", tenantId)
+        .where("active", "=", 1)
+        .executeTakeFirst();
+}
+export function customRoleInApp(db, id, appId) {
+    return db.selectFrom("identity_custom_roles").select("id")
+        .where("id", "=", id).where("app_id", "=", appId).executeTakeFirst();
+}
+export const customRoleNameSource = () => sql `select id,name,app_id from identity_custom_roles`;
+export const customRoleIdsSource = (appId) => sql `select id from identity_custom_roles where app_id=${appId}`;
+function roleListSource(actor, permissionJson) {
+    const global = actor.portal === "super-admin";
+    return sql `select r.id,r.id as name,r.id as portal,1 as system,null as tenantId,1 as active,r.version,${permissionJson.system(sql.ref("r.id"))} as permissionIds from identity_roles r
+    union all select c.id,c.name,'user' as portal,0 as system,c.tenant_id as tenantId,c.active,c.version,
+    ${permissionJson.custom(sql.ref("c.id"))} as permissionIds
+    from identity_custom_roles c where c.app_id=${actor.appId} ${global ? sql `` : sql `and c.tenant_id=${actor.tenant.id}`}`;
+}

package/dist/modules/identity/role/role.routes.d.ts

@@ -0,0 +1,5 @@
+export declare const roleResource: "roles";
+export declare const roleResourceRoute: (controller: import("./role.controller.js").IdentityRoleController) => {
+    resource: "roles";
+    controller: import("./role.controller.js").IdentityRoleController;
+};

package/dist/modules/identity/role/role.routes.js

@@ -0,0 +1,2 @@
+export const roleResource = "roles";
+export const roleResourceRoute = (controller) => ({ resource: roleResource, controller });

package/dist/modules/identity/role/role.schema.d.ts

@@ -0,0 +1,16 @@
+import { z } from "zod";
+export declare const roleUpdateSchema: z.ZodObject<{
+    permissionIds: z.ZodArray<z.ZodString>;
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;
+export declare const customRoleCreateSchema: z.ZodObject<{
+    name: z.ZodString;
+    permissionIds: z.ZodArray<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const customRoleUpdateSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    permissionIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    active: z.ZodOptional<z.ZodBoolean>;
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;

package/dist/modules/identity/role/role.schema.js

@@ -0,0 +1,27 @@
+import { z } from "zod";
+import { identityKeySchema } from "../support/identity.schema.js";
+import { permissionIdsSchema } from "../role-permission/role-permission.schema.js";
+const name = z.string().trim().min(1).max(100);
+const expectedVersion = z.number().int().min(0);
+export const roleUpdateSchema = z
+    .object({
+    permissionIds: permissionIdsSchema,
+    expectedVersion
+})
+    .strict();
+export const customRoleCreateSchema = z
+    .object({
+    name,
+    permissionIds: permissionIdsSchema,
+    tenantId: identityKeySchema.optional()
+})
+    .strict();
+export const customRoleUpdateSchema = z
+    .object({
+    name: name.optional(),
+    permissionIds: permissionIdsSchema.optional(),
+    active: z.boolean().optional(),
+    expectedVersion
+})
+    .strict()
+    .refine((input) => Object.keys(input).length > 1, "Provide a changed field.");

package/dist/modules/identity/role/role.seed.d.ts

@@ -0,0 +1,3 @@
+import type { Transaction } from "kysely";
+import type { IdentitySchema } from "../identity.types.js";
+export declare function seedRoles(trx: Transaction<IdentitySchema>): Promise<void>;

package/dist/modules/identity/role/role.seed.js

@@ -0,0 +1,8 @@
+export async function seedRoles(trx) {
+    for (const portal of ["user", "admin", "super-admin"])
+        await trx
+            .insertInto("identity_roles")
+            .values({ id: portal })
+            .onConflict((c) => c.column("id").doNothing())
+            .execute();
+}

package/dist/modules/identity/role/role.service.d.ts

@@ -0,0 +1,69 @@
+import type { IdentityRolePermissionProvider } from "../role-permission/index.js";
+import { type Kysely, type Transaction } from "kysely";
+import type { IdentityMutation, IdentitySchema, Portal, Principal } from "../identity.types.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+export declare class IdentityRolesService {
+    private readonly db;
+    private readonly rolePermissions;
+    private readonly mutate;
+    private readonly recordAudit;
+    private readonly activeOrganization;
+    private readonly revokeRoleSessions;
+    constructor(db: Kysely<IdentitySchema>, rolePermissions: IdentityRolePermissionProvider, mutate: IdentityMutation, recordAudit: (trx: Transaction<IdentitySchema>, actor: Principal, tenantId: string, action: string, id: string) => Promise<void>, activeOrganization: (trx: Transaction<IdentitySchema>, id: string) => Promise<unknown>, revokeRoleSessions: (trx: Transaction<IdentitySchema>, appId: string, tenantId: string, roleId: string) => Promise<void>);
+    list(actor: Principal, query: IdentityListQuery): Promise<{
+        data: {
+            version: number;
+            active: boolean;
+            system: boolean;
+            permissionIds: string[];
+        }[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show(actor: Principal, id: string): Promise<{
+        version: number;
+        active: boolean;
+        system: boolean;
+        permissionIds: string[];
+    } | undefined>;
+    resolve(database: Kysely<IdentitySchema>, actor: Principal, roleId: string, tenantId: string): Promise<{
+        portal: Portal;
+        customRoleId: null;
+    } | {
+        portal: "user";
+        customRoleId: string;
+    }>;
+    create(actor: Principal, raw: unknown): Promise<{
+        id: `${string}-${string}-${string}-${string}-${string}`;
+        name: string;
+        tenantId: string;
+        portal: string;
+        system: boolean;
+        active: boolean;
+        version: number;
+        permissionIds: string[];
+    }>;
+    update(actor: Principal, id: string, raw: unknown): Promise<{
+        id: string;
+        name: string;
+        tenantId: string;
+        portal: string;
+        system: boolean;
+        active: boolean;
+        version: number;
+        permissionIds: string[];
+    }>;
+    updateSystemPermissions(actor: Principal, id: string, raw: unknown): Promise<{
+        id: string;
+        permissionIds: string[];
+        version: number;
+    }>;
+    private manage;
+    private scope;
+    private uniqueName;
+    private audit;
+}

package/dist/modules/identity/role/role.service.js

@@ -0,0 +1,192 @@
+import { randomUUID } from "node:crypto";
+import { sql } from "kysely";
+import { IdentityError } from "../support/identity.error.js";
+import { checkIdentityRequest } from "../support/identity.request-context.js";
+import { customRoleCreateSchema, customRoleUpdateSchema, roleUpdateSchema } from "./role.schema.js";
+import { listRoles, showRole } from "./role.repository.js";
+export class IdentityRolesService {
+    db;
+    rolePermissions;
+    mutate;
+    recordAudit;
+    activeOrganization;
+    revokeRoleSessions;
+    constructor(db, rolePermissions, mutate, recordAudit, activeOrganization, revokeRoleSessions) {
+        this.db = db;
+        this.rolePermissions = rolePermissions;
+        this.mutate = mutate;
+        this.recordAudit = recordAudit;
+        this.activeOrganization = activeOrganization;
+        this.revokeRoleSessions = revokeRoleSessions;
+    }
+    list(actor, query) {
+        if (actor.portal === "user")
+            throw new IdentityError(403, "Access denied.");
+        return listRoles(this.db, actor, query, {
+            system: this.rolePermissions.systemPermissionJson,
+            custom: this.rolePermissions.customPermissionJson
+        });
+    }
+    show(actor, id) {
+        if (actor.portal === "user")
+            throw new IdentityError(403, "Access denied.");
+        return showRole(this.db, actor, id, {
+            system: this.rolePermissions.systemPermissionJson,
+            custom: this.rolePermissions.customPermissionJson
+        });
+    }
+    async resolve(database, actor, roleId, tenantId) {
+        if (["user", "admin", "super-admin"].includes(roleId)) {
+            if (actor.portal !== "super-admin" && roleId !== "user")
+                throw new IdentityError(403, "Only super administrators can assign privileged roles.");
+            return { portal: roleId, customRoleId: null };
+        }
+        const role = await database
+            .selectFrom("identity_custom_roles")
+            .select("id")
+            .where("id", "=", roleId)
+            .where("app_id", "=", actor.appId)
+            .where("tenant_id", "=", tenantId)
+            .where("active", "=", 1)
+            .executeTakeFirst();
+        if (!role)
+            throw new IdentityError(422, "Select an active role in this organization.");
+        return { portal: "user", customRoleId: role.id };
+    }
+    async create(actor, raw) {
+        this.manage(actor);
+        const input = customRoleCreateSchema.parse(raw);
+        const tenantId = input.tenantId ?? actor.tenant.id;
+        this.scope(actor, tenantId);
+        return this.db.transaction().execute(async (trx) => {
+            checkIdentityRequest();
+            const tenant = await this.activeOrganization(trx, tenantId);
+            if (!tenant)
+                throw new IdentityError(422, "Organization is inactive or unavailable.");
+            await this.rolePermissions.validate(trx, input.permissionIds, actor.appId);
+            await this.uniqueName(trx, actor.appId, tenantId, input.name);
+            const id = randomUUID();
+            await trx
+                .insertInto("identity_custom_roles")
+                .values({
+                id,
+                app_id: actor.appId,
+                tenant_id: tenantId,
+                name: input.name
+            })
+                .execute();
+            await this.rolePermissions.replace(trx, id, input.permissionIds);
+            await this.audit(trx, actor, tenantId, "identity.role.created", id);
+            checkIdentityRequest();
+            return {
+                id,
+                name: input.name,
+                tenantId,
+                portal: "user",
+                system: false,
+                active: true,
+                version: 0,
+                permissionIds: [...new Set(input.permissionIds)]
+            };
+        });
+    }
+    async update(actor, id, raw) {
+        this.manage(actor);
+        const input = customRoleUpdateSchema.parse(raw);
+        return this.db.transaction().execute(async (trx) => {
+            checkIdentityRequest();
+            const role = await trx
+                .selectFrom("identity_custom_roles")
+                .selectAll()
+                .where("id", "=", id)
+                .where("app_id", "=", actor.appId)
+                .executeTakeFirst();
+            if (!role || (actor.portal !== "super-admin" && role.tenant_id !== actor.tenant.id))
+                throw new IdentityError(404, "Role not found.");
+            if (Number(role.version) !== input.expectedVersion)
+                throw new IdentityError(409, "This record changed. Reload before saving.");
+            if (input.permissionIds)
+                await this.rolePermissions.validate(trx, input.permissionIds, actor.appId);
+            if (input.name)
+                await this.uniqueName(trx, actor.appId, role.tenant_id, input.name, id);
+            const updated = await trx
+                .updateTable("identity_custom_roles")
+                .set({
+                name: input.name ?? role.name,
+                active: input.active === undefined ? role.active : Number(input.active),
+                version: input.expectedVersion + 1
+            })
+                .where("id", "=", id)
+                .where("version", "=", input.expectedVersion)
+                .executeTakeFirst();
+            if (updated.numUpdatedRows !== 1n)
+                throw new IdentityError(409, "This record changed. Reload before saving.");
+            if (input.permissionIds)
+                await this.rolePermissions.replace(trx, id, input.permissionIds);
+            await this.revokeRoleSessions(trx, actor.appId, role.tenant_id, id);
+            await this.audit(trx, actor, role.tenant_id, "identity.role.changed", id);
+            const permissions = await this.rolePermissions.permissionIds(trx, id, true);
+            checkIdentityRequest();
+            return {
+                id,
+                name: input.name ?? role.name,
+                tenantId: role.tenant_id,
+                portal: "user",
+                system: false,
+                active: input.active ?? Boolean(role.active),
+                version: input.expectedVersion + 1,
+                permissionIds: permissions
+            };
+        });
+    }
+    async updateSystemPermissions(actor, id, raw) {
+        this.manage(actor);
+        if (actor.portal !== "super-admin")
+            throw new IdentityError(403, "Only super administrators can change this resource.");
+        const input = roleUpdateSchema.parse(raw);
+        return this.mutate(actor, "roles", id, async (trx) => {
+            const current = await trx
+                .selectFrom("identity_roles")
+                .select("version")
+                .where("id", "=", id)
+                .executeTakeFirst();
+            if (!current)
+                throw new IdentityError(404, "Role not found.");
+            if (Number(current.version) !== input.expectedVersion)
+                throw new IdentityError(409, "This record changed. Reload before saving.");
+            await this.rolePermissions.replaceSystem(trx, id, actor.appId, input.permissionIds);
+            await trx
+                .updateTable("identity_roles")
+                .set({ version: sql `version + 1` })
+                .where("id", "=", id)
+                .execute();
+            return {
+                id,
+                permissionIds: [...new Set(input.permissionIds)],
+                version: input.expectedVersion + 1
+            };
+        });
+    }
+    manage(actor) {
+        if (actor.portal === "user" || !actor.permissions.includes("identity.manage"))
+            throw new IdentityError(403, "Access denied.");
+    }
+    scope(actor, tenantId) {
+        if (actor.portal !== "super-admin" && tenantId !== actor.tenant.id)
+            throw new IdentityError(403, "Access denied.");
+    }
+    async uniqueName(trx, appId, tenantId, name, exceptId = "") {
+        if (await trx
+            .selectFrom("identity_custom_roles")
+            .select("id")
+            .where("app_id", "=", appId)
+            .where("tenant_id", "=", tenantId)
+            .where("name", "=", name)
+            .where("id", "!=", exceptId)
+            .executeTakeFirst())
+            throw new IdentityError(409, "A role with this name already exists.");
+    }
+    async audit(trx, actor, tenantId, action, resourceId) {
+        await this.recordAudit(trx, actor, tenantId, action, resourceId);
+    }
+}

package/dist/modules/identity/role/role.types.d.ts

@@ -0,0 +1,17 @@
+import type { Generated } from "kysely";
+export interface IdentityRoleTables {
+    identity_roles: {
+        id: string;
+        version: Generated<number>;
+    };
+    identity_custom_roles: {
+        id: string;
+        app_id: string;
+        tenant_id: string;
+        name: string;
+        active: Generated<number>;
+        version: Generated<number>;
+    };
+}
+export type IdentityRoleRow = IdentityRoleTables["identity_roles"];
+export type IdentityCustomRoleRow = IdentityRoleTables["identity_custom_roles"];

package/dist/modules/identity/role/role.types.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/role-permission/index.d.ts

@@ -0,0 +1,6 @@
+export { createIdentityRolePermissionProvider } from "./role-permission.provider.js";
+export type { IdentityRolePermissionProvider } from "./role-permission.provider.js";
+export { seedRolePermissions } from "./role-permission.seed.js";
+export { rolePermissionRoutes } from "./role-permission.routes.js";
+export { permissionIdsSchema } from "./role-permission.schema.js";
+export type { IdentityRolePermissionRow, IdentityCustomRolePermissionRow } from "./role-permission.types.js";

package/dist/modules/identity/role-permission/index.js

@@ -0,0 +1,4 @@
+export { createIdentityRolePermissionProvider } from "./role-permission.provider.js";
+export { seedRolePermissions } from "./role-permission.seed.js";
+export { rolePermissionRoutes } from "./role-permission.routes.js";
+export { permissionIdsSchema } from "./role-permission.schema.js";

package/dist/modules/identity/role-permission/role-permission.controller.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/role-permission/role-permission.controller.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/role-permission/role-permission.migration.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/role-permission/role-permission.migration.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/role-permission/role-permission.provider.d.ts

@@ -0,0 +1,14 @@
+import type { Kysely, Transaction } from "kysely";
+import type { IdentitySchema } from "../identity.types.js";
+import type { IdentityPermissionProvider } from "../permission/index.js";
+import { systemPermissionJson, customPermissionJson } from "./role-permission.repository.js";
+export interface IdentityRolePermissionProvider {
+    verify(): Promise<void>;
+    permissionIds(db: Kysely<IdentitySchema>, roleId: string, custom: boolean): Promise<string[]>;
+    systemPermissionJson: typeof systemPermissionJson;
+    customPermissionJson: typeof customPermissionJson;
+    validate(trx: Transaction<IdentitySchema>, ids: string[], appId: string): Promise<void>;
+    replace(trx: Transaction<IdentitySchema>, roleId: string, permissions: string[]): Promise<void>;
+    replaceSystem(trx: Transaction<IdentitySchema>, roleId: string, appId: string, permissions: string[]): Promise<void>;
+}
+export declare function createIdentityRolePermissionProvider(database: Kysely<IdentitySchema>, permissions: IdentityPermissionProvider): IdentityRolePermissionProvider;