@devxcrew/platform 0.1.2 → 0.1.6

package/dist/modules/identity/role-permission/role-permission.provider.js

@@ -0,0 +1,15 @@
+import { IdentityRolePermissionRepository, systemPermissionJson, customPermissionJson } from "./role-permission.repository.js";
+import { IdentityRolePermissionService } from "./role-permission.service.js";
+export function createIdentityRolePermissionProvider(database, permissions) {
+    const repository = new IdentityRolePermissionRepository(database);
+    const service = new IdentityRolePermissionService(permissions, repository);
+    return Object.freeze({
+        verify: repository.verifySchema.bind(repository),
+        permissionIds: repository.permissionIds.bind(repository),
+        systemPermissionJson,
+        customPermissionJson,
+        validate: service.validate.bind(service),
+        replace: service.replace.bind(service),
+        replaceSystem: service.replaceSystem.bind(service)
+    });
+}

package/dist/modules/identity/role-permission/role-permission.repository.d.ts

@@ -0,0 +1,12 @@
+import { type Kysely, type RawBuilder, type Transaction } from "kysely";
+import type { IdentitySchema } from "../identity.types.js";
+export declare class IdentityRolePermissionRepository {
+    private readonly db;
+    constructor(db: Kysely<IdentitySchema>);
+    verifySchema(): Promise<void>;
+    permissionIds(db: Kysely<IdentitySchema>, roleId: string, custom: boolean): Promise<string[]>;
+    replaceCustom(trx: Transaction<IdentitySchema>, roleId: string, ids: string[]): Promise<void>;
+    replaceSystem(trx: Transaction<IdentitySchema>, roleId: string, ids: string[]): Promise<void>;
+}
+export declare const systemPermissionJson: (roleId: RawBuilder<unknown>) => RawBuilder<unknown>;
+export declare const customPermissionJson: (roleId: RawBuilder<unknown>) => RawBuilder<unknown>;

package/dist/modules/identity/role-permission/role-permission.repository.js

@@ -0,0 +1,51 @@
+import { sql } from "kysely";
+export class IdentityRolePermissionRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async verifySchema() {
+        await this.db
+            .selectFrom("identity_role_permissions")
+            .select("permission_id")
+            .limit(1)
+            .execute();
+        await this.db
+            .selectFrom("identity_custom_role_permissions")
+            .select("permission_id")
+            .limit(1)
+            .execute();
+    }
+    async permissionIds(db, roleId, custom) {
+        const table = custom
+            ? "identity_custom_role_permissions"
+            : "identity_role_permissions";
+        const rows = await db
+            .selectFrom(table)
+            .select("permission_id")
+            .where("role_id", "=", roleId)
+            .execute();
+        return rows.map((row) => row.permission_id);
+    }
+    async replaceCustom(trx, roleId, ids) {
+        await trx
+            .deleteFrom("identity_custom_role_permissions")
+            .where("role_id", "=", roleId)
+            .execute();
+        for (const permission of new Set(ids))
+            await trx
+                .insertInto("identity_custom_role_permissions")
+                .values({ role_id: roleId, permission_id: permission })
+                .execute();
+    }
+    async replaceSystem(trx, roleId, ids) {
+        await trx.deleteFrom("identity_role_permissions").where("role_id", "=", roleId).execute();
+        for (const permission of new Set(ids))
+            await trx
+                .insertInto("identity_role_permissions")
+                .values({ role_id: roleId, permission_id: permission })
+                .execute();
+    }
+}
+export const systemPermissionJson = (roleId) => sql `(select json_group_array(permission_id) from identity_role_permissions p where p.role_id=${roleId})`;
+export const customPermissionJson = (roleId) => sql `(select json_group_array(permission_id) from identity_custom_role_permissions p where p.role_id=${roleId})`;

package/dist/modules/identity/role-permission/role-permission.routes.d.ts

@@ -0,0 +1 @@
+export declare const rolePermissionRoutes: readonly [];

package/dist/modules/identity/role-permission/role-permission.routes.js

@@ -0,0 +1,2 @@
+// Role permission changes use the role resource endpoint.
+export const rolePermissionRoutes = [];

package/dist/modules/identity/role-permission/role-permission.schema.d.ts

@@ -0,0 +1,2 @@
+import { z } from "zod";
+export declare const permissionIdsSchema: z.ZodArray<z.ZodString>;

package/dist/modules/identity/role-permission/role-permission.schema.js

@@ -0,0 +1,3 @@
+import { z } from "zod";
+import { resourceIdSchema } from "../support/identity.schema.js";
+export const permissionIdsSchema = z.array(resourceIdSchema).max(100);

package/dist/modules/identity/role-permission/role-permission.seed.d.ts

@@ -0,0 +1,3 @@
+import type { Transaction } from "kysely";
+import type { IdentitySchema } from "../identity.types.js";
+export declare function seedRolePermissions(trx: Transaction<IdentitySchema>): Promise<void>;

package/dist/modules/identity/role-permission/role-permission.seed.js

@@ -0,0 +1,10 @@
+import { defaultPermissions } from "../permission/index.js";
+export async function seedRolePermissions(trx) {
+    for (const portal of ["user", "admin", "super-admin"])
+        for (const permission of defaultPermissions(portal))
+            await trx
+                .insertInto("identity_role_permissions")
+                .values({ role_id: portal, permission_id: permission })
+                .onConflict((c) => c.columns(["role_id", "permission_id"]).doNothing())
+                .execute();
+}

package/dist/modules/identity/role-permission/role-permission.service.d.ts

@@ -0,0 +1,13 @@
+import type { Transaction } from "kysely";
+import type { IdentitySchema } from "../identity.types.js";
+import type { IdentityPermissionProvider } from "../permission/index.js";
+import { IdentityRolePermissionRepository } from "./role-permission.repository.js";
+export declare class IdentityRolePermissionService {
+    private readonly permissions;
+    private readonly repository;
+    constructor(permissions: IdentityPermissionProvider, repository: IdentityRolePermissionRepository);
+    validate(trx: Transaction<IdentitySchema>, ids: string[], appId: string): Promise<void>;
+    replace(trx: Transaction<IdentitySchema>, roleId: string, ids: string[]): Promise<void>;
+    replaceSystem(trx: Transaction<IdentitySchema>, roleId: string, appId: string, ids: string[]): Promise<void>;
+    private validateKnown;
+}

package/dist/modules/identity/role-permission/role-permission.service.js

@@ -0,0 +1,35 @@
+import { IdentityError } from "../support/identity.error.js";
+export class IdentityRolePermissionService {
+    permissions;
+    repository;
+    constructor(permissions, repository) {
+        this.permissions = permissions;
+        this.repository = repository;
+    }
+    async validate(trx, ids, appId) {
+        await this.permissions.validateDeclared(trx, appId, "user", ids);
+        if (!ids.includes("desk.user"))
+            throw new IdentityError(422, "Keep the user desk permission.");
+        if (ids.some((id) => id === "identity.manage" || (id.startsWith("desk.") && id !== "desk.user")))
+            throw new IdentityError(403, "Custom user roles cannot grant administration access.");
+        await this.validateKnown(trx, ids);
+    }
+    async replace(trx, roleId, ids) {
+        await this.repository.replaceCustom(trx, roleId, ids);
+    }
+    async replaceSystem(trx, roleId, appId, ids) {
+        const portal = roleId;
+        if (!ids.includes(`desk.${portal}`) || !ids.includes("identity.password"))
+            throw new IdentityError(409, "Keep required portal and password permissions.");
+        if (portal !== "user" && !ids.includes("identity.manage"))
+            throw new IdentityError(409, "Keep administration permission on administrator roles.");
+        await this.permissions.validateDeclared(trx, appId, portal, ids);
+        await this.validateKnown(trx, ids);
+        if (portal === "user" && ids.some((id) => id.startsWith("identity.manage")))
+            throw new IdentityError(403, "User roles cannot receive administration permissions.");
+        await this.repository.replaceSystem(trx, portal, ids);
+    }
+    async validateKnown(trx, ids) {
+        await this.permissions.validateKnown(trx, ids);
+    }
+}

package/dist/modules/identity/role-permission/role-permission.types.d.ts

@@ -0,0 +1,12 @@
+export interface IdentityRolePermissionTables {
+    identity_role_permissions: {
+        role_id: string;
+        permission_id: string;
+    };
+    identity_custom_role_permissions: {
+        role_id: string;
+        permission_id: string;
+    };
+}
+export type IdentityRolePermissionRow = IdentityRolePermissionTables["identity_role_permissions"];
+export type IdentityCustomRolePermissionRow = IdentityRolePermissionTables["identity_custom_role_permissions"];

package/dist/modules/identity/role-permission/role-permission.types.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/session/index.d.ts

@@ -0,0 +1,6 @@
+export { createIdentitySessionProvider } from "./session.provider.js";
+export { sessionResource, sessionResourceRoute, sessionRoutes, portalRoutes } from "./session.routes.js";
+export { loginSchema } from "./session.schema.js";
+export type { IdentitySessionRow } from "./session.types.js";
+export { IdentitySessionAuthenticationController } from "./session.authentication.controller.js";
+export { IdentitySessionController } from "./session.controller.js";

package/dist/modules/identity/session/index.js

@@ -0,0 +1,5 @@
+export { createIdentitySessionProvider } from "./session.provider.js";
+export { sessionResource, sessionResourceRoute, sessionRoutes, portalRoutes } from "./session.routes.js";
+export { loginSchema } from "./session.schema.js";
+export { IdentitySessionAuthenticationController } from "./session.authentication.controller.js";
+export { IdentitySessionController } from "./session.controller.js";

package/dist/modules/identity/session/session.authentication.controller.d.ts

@@ -0,0 +1,30 @@
+import type { IdentityConfig, Portal, Principal } from "../identity.types.js";
+import type { IdentityUserProvider } from "../user/index.js";
+export declare class IdentitySessionAuthenticationController {
+    private readonly identity;
+    private readonly config;
+    constructor(identity: IdentityUserProvider["identity"], config: IdentityConfig);
+    login(portal: Portal, raw: unknown, address: string, previous?: string): Promise<{
+        token: string;
+        sessionSeconds: number;
+        principal: {
+            user: {
+                id: string;
+                email: string;
+                name: string;
+            };
+            tenant: {
+                id: string;
+                name: string;
+            };
+            permissions: string[];
+            appId: string;
+            portal: Portal;
+        };
+    }>;
+    authenticate(portal: Portal, token?: string): Promise<Principal>;
+    current(principal: Principal, portal: Portal): Principal;
+    logout(portal: Portal, token?: string): Promise<void>;
+    changePassword(principal: Principal, raw: unknown): Promise<void>;
+    requireDesk(principal: Principal, portal: Portal): void;
+}

package/dist/modules/identity/session/session.authentication.controller.js

@@ -0,0 +1,37 @@
+import { IdentityError } from "../support/identity.error.js";
+import { loginSchema } from "./session.schema.js";
+import { passwordSchema } from "../user/index.js";
+export class IdentitySessionAuthenticationController {
+    identity;
+    config;
+    constructor(identity, config) {
+        this.identity = identity;
+        this.config = config;
+    }
+    login(portal, raw, address, previous) {
+        const input = loginSchema
+            .refine((value) => this.config.mode !== "multi-tenant" || Boolean(value.tenantId), {
+            path: ["tenantId"],
+            message: "Enter an organization ID."
+        })
+            .parse(raw);
+        return this.identity.login(portal, input, address, previous);
+    }
+    authenticate(portal, token) {
+        return this.identity.authenticate(portal, token);
+    }
+    current(principal, portal) {
+        this.identity.requirePermission(principal, `desk.${portal}`);
+        return principal;
+    }
+    logout(portal, token) {
+        return this.identity.logout(portal, token);
+    }
+    changePassword(principal, raw) {
+        return this.identity.changePassword(principal, passwordSchema.parse(raw));
+    }
+    requireDesk(principal, portal) {
+        if (!principal.permissions.includes(`desk.${portal}`))
+            throw new IdentityError(403, "Access denied.");
+    }
+}

package/dist/modules/identity/session/session.controller.d.ts

@@ -0,0 +1,18 @@
+import type { Principal } from "../identity.types.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+import type { createIdentitySessionProvider } from "./session.provider.js";
+export declare class IdentitySessionController {
+    private readonly service;
+    constructor(service: ReturnType<typeof createIdentitySessionProvider>);
+    index(actor: Principal, query: IdentityListQuery): Promise<{
+        data: Record<string, unknown>[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show(actor: Principal, id: string): Promise<Record<string, unknown> | undefined>;
+    destroy(actor: Principal, id: string): Promise<void>;
+}

package/dist/modules/identity/session/session.controller.js

@@ -0,0 +1,15 @@
+export class IdentitySessionController {
+    service;
+    constructor(service) {
+        this.service = service;
+    }
+    index(actor, query) {
+        return this.service.list(actor, query);
+    }
+    show(actor, id) {
+        return this.service.show(actor, id);
+    }
+    destroy(actor, id) {
+        return this.service.remove(actor, id);
+    }
+}

package/dist/modules/identity/session/session.migration.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/session/session.migration.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/session/session.provider.d.ts

@@ -0,0 +1,34 @@
+import type { Kysely } from "kysely";
+import type { IdentityMutation, IdentitySchema } from "../identity.types.js";
+export declare function createIdentitySessionProvider(database: Kysely<IdentitySchema>, mutate: IdentityMutation): Readonly<{
+    verify: () => Promise<void>;
+    list: (actor: import("../identity.types.js").Principal, query: import("../index.js").IdentityListQuery) => Promise<{
+        data: Record<string, unknown>[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show: (actor: import("../identity.types.js").Principal, id: string) => Promise<Record<string, unknown> | undefined>;
+    remove: (actor: import("../identity.types.js").Principal, id: string) => Promise<void>;
+    revokeTenant: (trx: import("kysely").Transaction<IdentitySchema>, tenantId: string) => Promise<void>;
+    revokeApp: (trx: import("kysely").Transaction<IdentitySchema>, appId: string) => Promise<void>;
+    revokeOne: (trx: import("kysely").Transaction<IdentitySchema>, appId: string, tokenHash: string) => Promise<void>;
+    revokeUser: (trx: import("kysely").Transaction<IdentitySchema>, userId: string) => Promise<void>;
+    revokeMembership: (trx: import("kysely").Transaction<IdentitySchema>, appId: string, userId: string, tenantId: string, portal: import("../identity.types.js").Portal) => Promise<void>;
+    revokeRoleMembers: (trx: import("kysely").Transaction<IdentitySchema>, appId: string, tenantId: string, userIds: string[]) => Promise<void>;
+    active: (tokenHash: string, appId: string, portal: import("../identity.types.js").Portal, now: string) => Promise<{
+        app_id: string;
+        expires_at: string;
+        portal: import("../identity.types.js").Portal;
+        tenant_id: string;
+        token_hash: string;
+        user_id: string;
+    } | undefined>;
+    create: (session: IdentitySchema["identity_sessions"], previous: string | undefined, eligible: (trx: import("kysely").Transaction<IdentitySchema>) => Promise<boolean>) => Promise<boolean>;
+    revoke: (tokenHash: string, appId: string, portal: import("../identity.types.js").Portal) => Promise<void>;
+    throttle: (key: string) => Promise<number>;
+    clearThrottle: (key: string) => Promise<void>;
+}>;

package/dist/modules/identity/session/session.provider.js

@@ -0,0 +1,23 @@
+import { IdentitySessionRepository } from "./session.repository.js";
+import { IdentitySessionService } from "./session.service.js";
+export function createIdentitySessionProvider(database, mutate) {
+    const repository = new IdentitySessionRepository(database);
+    const service = new IdentitySessionService(repository, mutate);
+    return Object.freeze({
+        verify: repository.verifySchema.bind(repository),
+        list: service.list.bind(service),
+        show: service.show.bind(service),
+        remove: service.remove.bind(service),
+        revokeTenant: repository.revokeTenant.bind(repository),
+        revokeApp: repository.revokeApp.bind(repository),
+        revokeOne: repository.revokeOne.bind(repository),
+        revokeUser: repository.revokeUser.bind(repository),
+        revokeMembership: repository.revokeMembership.bind(repository),
+        revokeRoleMembers: repository.revokeRoleMembers.bind(repository),
+        active: repository.active.bind(repository),
+        create: repository.create.bind(repository),
+        revoke: repository.revoke.bind(repository),
+        throttle: repository.throttle.bind(repository),
+        clearThrottle: repository.clearThrottle.bind(repository)
+    });
+}

package/dist/modules/identity/session/session.repository.d.ts

@@ -0,0 +1,36 @@
+import { type Kysely, type Transaction } from "kysely";
+import type { IdentitySchema, Portal, Principal } from "../identity.types.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+export declare class IdentitySessionRepository {
+    private readonly db;
+    constructor(db: Kysely<IdentitySchema>);
+    verifySchema(): Promise<void>;
+    active(tokenHash: string, appId: string, portal: Portal, now: string): Promise<{
+        app_id: string;
+        expires_at: string;
+        portal: Portal;
+        tenant_id: string;
+        token_hash: string;
+        user_id: string;
+    } | undefined>;
+    create(session: IdentitySchema["identity_sessions"], previous: string | undefined, eligible: (trx: Transaction<IdentitySchema>) => Promise<boolean>): Promise<boolean>;
+    revoke(tokenHash: string, appId: string, portal: Portal): Promise<void>;
+    throttle(key: string): Promise<number>;
+    clearThrottle(key: string): Promise<void>;
+    list(actor: Principal, query: IdentityListQuery): Promise<{
+        data: Record<string, unknown>[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show(actor: Principal, id: string): Promise<Record<string, unknown> | undefined>;
+    revokeTenant(trx: Transaction<IdentitySchema>, tenantId: string): Promise<void>;
+    revokeApp(trx: Transaction<IdentitySchema>, appId: string): Promise<void>;
+    revokeOne(trx: Transaction<IdentitySchema>, appId: string, tokenHash: string): Promise<void>;
+    revokeUser(trx: Transaction<IdentitySchema>, userId: string): Promise<void>;
+    revokeMembership(trx: Transaction<IdentitySchema>, appId: string, userId: string, tenantId: string, portal: Portal): Promise<void>;
+    revokeRoleMembers(trx: Transaction<IdentitySchema>, appId: string, tenantId: string, userIds: string[]): Promise<void>;
+}

package/dist/modules/identity/session/session.repository.js

@@ -0,0 +1,128 @@
+import { sql } from "kysely";
+import { checkIdentityRequest } from "../support/identity.request-context.js";
+import { listRows, showRow } from "../support/pagination.js";
+function sessionListSource(actor) {
+    const global = actor.portal === "super-admin";
+    return sql `select token_hash as id,user_id as userId,tenant_id as tenantId,portal,expires_at as expiresAt from identity_sessions
+    where app_id=${actor.appId} and expires_at>${new Date().toISOString()}
+    ${global ? sql `` : sql `and tenant_id=${actor.tenant.id}`}
+    ${actor.portal === "user" ? sql `and user_id=${actor.user.id}` : sql ``}`;
+}
+export class IdentitySessionRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async verifySchema() {
+        await this.db.selectFrom("identity_sessions").select("token_hash").limit(1).execute();
+        await this.db.selectFrom("identity_throttles").select("key").limit(1).execute();
+    }
+    active(tokenHash, appId, portal, now) {
+        return this.db
+            .selectFrom("identity_sessions")
+            .selectAll()
+            .where("token_hash", "=", tokenHash)
+            .where("app_id", "=", appId)
+            .where("portal", "=", portal)
+            .where("expires_at", ">", now)
+            .executeTakeFirst();
+    }
+    async create(session, previous, eligible) {
+        return this.db.transaction().execute(async (trx) => {
+            checkIdentityRequest();
+            if (!(await eligible(trx)))
+                return false;
+            await trx
+                .deleteFrom("identity_sessions")
+                .where("expires_at", "<=", new Date().toISOString())
+                .execute();
+            if (previous)
+                await trx
+                    .deleteFrom("identity_sessions")
+                    .where("token_hash", "=", previous)
+                    .where("app_id", "=", session.app_id)
+                    .where("portal", "=", session.portal)
+                    .execute();
+            await trx.insertInto("identity_sessions").values(session).execute();
+            checkIdentityRequest();
+            return true;
+        });
+    }
+    async revoke(tokenHash, appId, portal) {
+        checkIdentityRequest();
+        await this.db
+            .deleteFrom("identity_sessions")
+            .where("token_hash", "=", tokenHash)
+            .where("app_id", "=", appId)
+            .where("portal", "=", portal)
+            .execute();
+    }
+    async throttle(key) {
+        const now = new Date();
+        return this.db.transaction().execute(async (trx) => {
+            await trx
+                .deleteFrom("identity_throttles")
+                .where("expires_at", "<=", now.toISOString())
+                .execute();
+            await trx
+                .insertInto("identity_throttles")
+                .values({
+                key,
+                attempts: 1,
+                expires_at: new Date(now.getTime() + 15 * 60 * 1000).toISOString()
+            })
+                .onConflict((c) => c.column("key").doUpdateSet({ attempts: sql `attempts + 1` }))
+                .execute();
+            const row = await trx
+                .selectFrom("identity_throttles")
+                .select("attempts")
+                .where("key", "=", key)
+                .executeTakeFirstOrThrow();
+            return Number(row.attempts);
+        });
+    }
+    async clearThrottle(key) {
+        await this.db.deleteFrom("identity_throttles").where("key", "=", key).execute();
+    }
+    list(actor, query) {
+        return listRows(this.db, sessionListSource(actor), ["id"], query, (row) => row);
+    }
+    show(actor, id) {
+        return showRow(this.db, sessionListSource(actor), id, (row) => row);
+    }
+    async revokeTenant(trx, tenantId) {
+        await trx.deleteFrom("identity_sessions").where("tenant_id", "=", tenantId).execute();
+    }
+    async revokeApp(trx, appId) {
+        await trx.deleteFrom("identity_sessions").where("app_id", "=", appId).execute();
+    }
+    async revokeOne(trx, appId, tokenHash) {
+        await trx
+            .deleteFrom("identity_sessions")
+            .where("token_hash", "=", tokenHash)
+            .where("app_id", "=", appId)
+            .execute();
+    }
+    async revokeUser(trx, userId) {
+        await trx.deleteFrom("identity_sessions").where("user_id", "=", userId).execute();
+    }
+    async revokeMembership(trx, appId, userId, tenantId, portal) {
+        await trx
+            .deleteFrom("identity_sessions")
+            .where("app_id", "=", appId)
+            .where("user_id", "=", userId)
+            .where("tenant_id", "=", tenantId)
+            .where("portal", "=", portal)
+            .execute();
+    }
+    async revokeRoleMembers(trx, appId, tenantId, userIds) {
+        if (userIds.length === 0)
+            return;
+        await trx
+            .deleteFrom("identity_sessions")
+            .where("app_id", "=", appId)
+            .where("tenant_id", "=", tenantId)
+            .where("user_id", "in", userIds)
+            .execute();
+    }
+}

package/dist/modules/identity/session/session.routes.d.ts

@@ -0,0 +1,27 @@
+import type { Portal } from "../identity.types.js";
+export declare const sessionResource: "sessions";
+export declare const sessionResourceRoute: (controller: import("./session.controller.js").IdentitySessionController) => {
+    resource: "sessions";
+    controller: import("./session.controller.js").IdentitySessionController;
+};
+export declare const sessionRoutes: readonly [{
+    readonly method: "POST";
+    readonly path: "sessions";
+    readonly action: "login";
+}, {
+    readonly method: "GET";
+    readonly path: "sessions/current";
+    readonly action: "session";
+}, {
+    readonly method: "DELETE";
+    readonly path: "sessions/current";
+    readonly action: "logout";
+}, {
+    readonly method: "PATCH";
+    readonly path: "password";
+    readonly action: "password";
+}];
+export declare const portalRoutes: Record<Portal, {
+    login: string;
+    desk: string;
+}>;

package/dist/modules/identity/session/session.routes.js

@@ -0,0 +1,13 @@
+export const sessionResource = "sessions";
+export const sessionResourceRoute = (controller) => ({ resource: sessionResource, controller });
+export const sessionRoutes = [
+    { method: "POST", path: "sessions", action: "login" },
+    { method: "GET", path: "sessions/current", action: "session" },
+    { method: "DELETE", path: "sessions/current", action: "logout" },
+    { method: "PATCH", path: "password", action: "password" }
+];
+export const portalRoutes = {
+    user: { login: "/login", desk: "/desk" },
+    admin: { login: "/admin/login", desk: "/admin/desk" },
+    "super-admin": { login: "/sa/login", desk: "/sa/desk" }
+};

package/dist/modules/identity/session/session.schema.d.ts

@@ -0,0 +1,6 @@
+import { z } from "zod";
+export declare const loginSchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    password: z.ZodString;
+    tenantId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;

package/dist/modules/identity/session/session.schema.js

@@ -0,0 +1,12 @@
+import { z } from "zod";
+import { identityKeySchema } from "../support/identity.schema.js";
+export const loginSchema = z
+    .object({
+    email: z
+        .email()
+        .max(254)
+        .transform((value) => value.trim().toLowerCase()),
+    password: z.string().min(1).max(256),
+    tenantId: identityKeySchema.optional()
+})
+    .strict();

package/dist/modules/identity/session/session.seed.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/session/session.seed.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/session/session.service.d.ts

@@ -0,0 +1,20 @@
+import type { IdentityMutation, Principal } from "../identity.types.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+import { IdentitySessionRepository } from "./session.repository.js";
+export declare class IdentitySessionService {
+    private readonly repository;
+    private readonly mutate;
+    constructor(repository: IdentitySessionRepository, mutate: IdentityMutation);
+    list(actor: Principal, query: IdentityListQuery): Promise<{
+        data: Record<string, unknown>[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show(actor: Principal, id: string): Promise<Record<string, unknown> | undefined>;
+    remove(actor: Principal, id: string): Promise<void>;
+    private allow;
+}