@devxcrew/platform 0.1.2 → 0.1.6

package/dist/modules/identity/support/resource-controller.d.ts

@@ -0,0 +1,14 @@
+import type { Principal } from "../identity.types.js";
+import type { IdentityListQuery } from "./pagination.schema.js";
+import type { IdentityResource } from "./pagination.schema.js";
+export interface IdentityResourceController {
+    index(actor: Principal, query: IdentityListQuery): Promise<unknown>;
+    show(actor: Principal, id: string): Promise<unknown>;
+    store?(actor: Principal, raw: unknown): Promise<unknown>;
+    update?(actor: Principal, id: string, raw: unknown): Promise<unknown>;
+    destroy?(actor: Principal, id: string, expectedVersion?: number): Promise<void>;
+}
+export interface IdentityResourceRoute {
+    readonly resource: IdentityResource;
+    readonly controller: IdentityResourceController;
+}

package/dist/modules/identity/support/resource-controller.js

@@ -0,0 +1 @@
+export {};

package/dist/modules/identity/user/index.d.ts

@@ -0,0 +1,13 @@
+export { createIdentityUserProvider } from "./user.provider.js";
+export { createIdentityUserAdministrationProvider } from "./user.provider.js";
+export type { IdentityUserProvider, IdentityUserOwnership } from "./user.provider.js";
+export { seedAccounts, seedUsers } from "./user.seed.js";
+export { userResource, userResourceRoute, userLifecyclePaths } from "./user.routes.js";
+export { accountSchema, passwordSchema, userCreateSchema, userUpdateSchema, profileSchema } from "./user.schema.js";
+export { identityKeySchema, portalSchema } from "../support/identity.schema.js";
+export { hashPassword, verifyPassword } from "./user.password.js";
+export type { IdentityUserRow } from "./user.types.js";
+export { IdentityUserLifecycleController } from "./user.lifecycle.controller.js";
+export { IdentityUserController } from "./user.controller.js";
+export { userNameSource, activeUserIds } from "./user.repository.js";
+export * from "./user.lifecycle.schema.js";

package/dist/modules/identity/user/index.js

@@ -0,0 +1,11 @@
+export { createIdentityUserProvider } from "./user.provider.js";
+export { createIdentityUserAdministrationProvider } from "./user.provider.js";
+export { seedAccounts, seedUsers } from "./user.seed.js";
+export { userResource, userResourceRoute, userLifecyclePaths } from "./user.routes.js";
+export { accountSchema, passwordSchema, userCreateSchema, userUpdateSchema, profileSchema } from "./user.schema.js";
+export { identityKeySchema, portalSchema } from "../support/identity.schema.js";
+export { hashPassword, verifyPassword } from "./user.password.js";
+export { IdentityUserLifecycleController } from "./user.lifecycle.controller.js";
+export { IdentityUserController } from "./user.controller.js";
+export { userNameSource, activeUserIds } from "./user.repository.js";
+export * from "./user.lifecycle.schema.js";

package/dist/modules/identity/user/user.administration.service.d.ts

@@ -0,0 +1,59 @@
+import { type Kysely, type RawBuilder, type Transaction } from "kysely";
+import type { IdentityMutation, IdentitySchema, Principal } from "../identity.types.js";
+import type { IdentityRoleResolver } from "../role/index.js";
+import type { IdentityUserRoleProvider } from "../user-role/index.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+export declare class IdentityUserAdministrationService {
+    private readonly db;
+    private readonly visibility;
+    private readonly resolveRole;
+    private readonly assignInitialMembership;
+    private readonly mutate;
+    private readonly activeOrganization;
+    private readonly isManageableUser;
+    private readonly protectAdministrators;
+    private readonly revokeUserSessions;
+    constructor(db: Kysely<IdentitySchema>, visibility: (actor: Principal, userId: RawBuilder<unknown>) => RawBuilder<unknown>, resolveRole: IdentityRoleResolver, assignInitialMembership: IdentityUserRoleProvider["assignInitialMembership"], mutate: IdentityMutation, activeOrganization: (trx: Transaction<IdentitySchema>, id: string) => Promise<unknown>, isManageableUser: IdentityUserRoleProvider["isManageableUser"], protectAdministrators: IdentityUserRoleProvider["protectAdministrators"], revokeUserSessions: (trx: Transaction<IdentitySchema>, userId: string) => Promise<void>);
+    list(actor: Principal, query: IdentityListQuery): Promise<{
+        data: {
+            active: boolean;
+            version: number;
+        }[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show(actor: Principal, id: string): Promise<{
+        active: boolean;
+        version: number;
+    } | undefined>;
+    create(actor: Principal, raw: unknown): Promise<{
+        id: string;
+        email: string;
+        name: string;
+        active: boolean;
+        version: number;
+    }>;
+    update(actor: Principal, id: string, raw: unknown): Promise<{
+        id: string;
+        name: string;
+        email: string;
+        active: boolean;
+        version: number;
+    }>;
+    profile(actor: Principal, raw?: unknown): Promise<{
+        active: boolean;
+        version: number;
+        email: string;
+        id: string;
+        name: string;
+    }>;
+    private tenantId;
+    private manage;
+    private activeTenant;
+    private unprivilegedUser;
+    private revision;
+}

package/dist/modules/identity/user/user.administration.service.js

@@ -0,0 +1,159 @@
+import { randomUUID } from "node:crypto";
+import { sql } from "kysely";
+import { IdentityError } from "../support/identity.error.js";
+import { hashPassword } from "./user.password.js";
+import { profileSchema, userCreateSchema, userUpdateSchema } from "./user.schema.js";
+import { listUsers, showUser } from "./user.repository.js";
+export class IdentityUserAdministrationService {
+    db;
+    visibility;
+    resolveRole;
+    assignInitialMembership;
+    mutate;
+    activeOrganization;
+    isManageableUser;
+    protectAdministrators;
+    revokeUserSessions;
+    constructor(db, visibility, resolveRole, assignInitialMembership, mutate, activeOrganization, isManageableUser, protectAdministrators, revokeUserSessions) {
+        this.db = db;
+        this.visibility = visibility;
+        this.resolveRole = resolveRole;
+        this.assignInitialMembership = assignInitialMembership;
+        this.mutate = mutate;
+        this.activeOrganization = activeOrganization;
+        this.isManageableUser = isManageableUser;
+        this.protectAdministrators = protectAdministrators;
+        this.revokeUserSessions = revokeUserSessions;
+    }
+    list(actor, query) {
+        this.manage(actor);
+        return listUsers(this.db, query, this.visibility(actor, sql.ref("u.id")));
+    }
+    show(actor, id) {
+        this.manage(actor);
+        return showUser(this.db, id, this.visibility(actor, sql.ref("u.id")));
+    }
+    async create(actor, raw) {
+        this.manage(actor);
+        const input = userCreateSchema.parse(raw);
+        const tenantId = this.tenantId(actor, input.tenantId);
+        await this.resolveRole(this.db, actor, input.roleId, tenantId);
+        const passwordHash = await hashPassword(input.password);
+        return this.mutate(actor, "users", randomUUID(), async (trx, id) => {
+            await this.activeTenant(trx, tenantId);
+            if (await trx
+                .selectFrom("identity_users")
+                .select("id")
+                .where("email", "=", input.email)
+                .executeTakeFirst())
+                throw new IdentityError(409, "Email already exists.");
+            await trx
+                .insertInto("identity_users")
+                .values({
+                id,
+                email: input.email,
+                name: input.name,
+                active: 1,
+                password_hash: passwordHash
+            })
+                .execute();
+            await this.assignInitialMembership(trx, actor, id, tenantId, input.roleId);
+            return { id, email: input.email, name: input.name, active: true, version: 0 };
+        }, tenantId);
+    }
+    async update(actor, id, raw) {
+        this.manage(actor);
+        if (!(await this.show(actor, id)))
+            throw new IdentityError(404, "Resource not found.");
+        const input = userUpdateSchema.parse(raw);
+        return this.mutate(actor, "users", id, async (trx) => {
+            const current = await trx
+                .selectFrom("identity_users")
+                .selectAll()
+                .where("id", "=", id)
+                .executeTakeFirstOrThrow();
+            this.revision(current.version, input.expectedVersion);
+            if (actor.portal !== "super-admin")
+                await this.unprivilegedUser(trx, id);
+            if (input.active === false) {
+                await this.protectAdministrators(trx, id);
+                await this.revokeUserSessions(trx, id);
+            }
+            if (input.email &&
+                (await trx
+                    .selectFrom("identity_users")
+                    .select("id")
+                    .where("email", "=", input.email)
+                    .where("id", "!=", id)
+                    .executeTakeFirst()))
+                throw new IdentityError(409, "Email already exists.");
+            const { expectedVersion, ...fields } = input;
+            await trx
+                .updateTable("identity_users")
+                .set({
+                ...fields,
+                version: sql `version + 1`,
+                active: input.active === undefined ? current.active : Number(input.active)
+            })
+                .where("id", "=", id)
+                .execute();
+            return {
+                id,
+                name: input.name ?? current.name,
+                email: input.email ?? current.email,
+                active: input.active ?? Boolean(current.active),
+                version: expectedVersion + 1
+            };
+        });
+    }
+    async profile(actor, raw) {
+        if (!actor.permissions.includes("identity.self"))
+            throw new IdentityError(403, "Access denied.");
+        if (raw !== undefined) {
+            const input = profileSchema.parse(raw);
+            await this.mutate(actor, "profile", actor.user.id, async (trx) => {
+                const changed = await trx
+                    .updateTable("identity_users")
+                    .set({
+                    name: input.name,
+                    version: sql `version + 1`
+                })
+                    .where("id", "=", actor.user.id)
+                    .where("version", "=", input.expectedVersion)
+                    .executeTakeFirst();
+                if (changed.numUpdatedRows !== 1n)
+                    throw new IdentityError(409, "This record changed. Reload before saving.");
+            });
+        }
+        const user = await this.db
+            .selectFrom("identity_users")
+            .select(["id", "name", "email", "active", "version"])
+            .where("id", "=", actor.user.id)
+            .executeTakeFirstOrThrow();
+        return { ...user, active: Boolean(user.active), version: Number(user.version) };
+    }
+    tenantId(actor, requested) {
+        if (requested && requested !== actor.tenant.id && actor.portal !== "super-admin")
+            throw new IdentityError(403, "Access denied.");
+        return requested ?? actor.tenant.id;
+    }
+    manage(actor) {
+        if (actor.portal === "user" || !actor.permissions.includes("identity.manage"))
+            throw new IdentityError(403, "Access denied.");
+    }
+    async activeTenant(trx, id) {
+        if (!(await this.activeOrganization(trx, id)))
+            throw new IdentityError(422, "Organization is inactive or unavailable.");
+    }
+    async unprivilegedUser(trx, id) {
+        const scope = await this.isManageableUser(trx, id);
+        if (scope === "privileged")
+            throw new IdentityError(403, "Only super administrators can change privileged accounts.");
+        if (scope === "shared")
+            throw new IdentityError(403, "Only super administrators can change shared accounts.");
+    }
+    revision(current, expected) {
+        if (Number(current) !== expected)
+            throw new IdentityError(409, "This record changed. Reload before saving.");
+    }
+}

package/dist/modules/identity/user/user.controller.d.ts

@@ -0,0 +1,44 @@
+import type { Principal } from "../identity.types.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+import type { createIdentityUserAdministrationProvider } from "./user.provider.js";
+export declare class IdentityUserController {
+    private readonly service;
+    constructor(service: ReturnType<typeof createIdentityUserAdministrationProvider>);
+    index(actor: Principal, query: IdentityListQuery): Promise<{
+        data: {
+            active: boolean;
+            version: number;
+        }[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show(actor: Principal, id: string): Promise<{
+        active: boolean;
+        version: number;
+    } | undefined>;
+    store(actor: Principal, raw: unknown): Promise<{
+        id: string;
+        email: string;
+        name: string;
+        active: boolean;
+        version: number;
+    }>;
+    update(actor: Principal, id: string, raw: unknown): Promise<{
+        id: string;
+        name: string;
+        email: string;
+        active: boolean;
+        version: number;
+    }>;
+    profile(actor: Principal, raw?: unknown): Promise<{
+        active: boolean;
+        version: number;
+        email: string;
+        id: string;
+        name: string;
+    }>;
+}

package/dist/modules/identity/user/user.controller.js

@@ -0,0 +1,21 @@
+export class IdentityUserController {
+    service;
+    constructor(service) {
+        this.service = service;
+    }
+    index(actor, query) {
+        return this.service.list(actor, query);
+    }
+    show(actor, id) {
+        return this.service.show(actor, id);
+    }
+    store(actor, raw) {
+        return this.service.create(actor, raw);
+    }
+    update(actor, id, raw) {
+        return this.service.update(actor, id, raw);
+    }
+    profile(actor, raw) {
+        return this.service.profile(actor, raw);
+    }
+}

package/dist/modules/identity/user/user.lifecycle.controller.d.ts

@@ -0,0 +1,58 @@
+import type { Portal, Principal } from "../identity.types.js";
+import type { IdentityUserProvider } from "./user.provider.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+export declare class IdentityUserLifecycleController {
+    private readonly service;
+    constructor(service: IdentityUserProvider["lifecycle"]);
+    requestRecovery(portal: Portal, raw: unknown, address: string): Promise<{
+        message: string;
+    }>;
+    complete(portal: Portal, kind: "invitation" | "recovery", raw: unknown, address: string): Promise<{
+        message: string;
+    }>;
+    index(actor: Principal, query: IdentityListQuery): Promise<{
+        data: {
+            id: string;
+            email: string;
+            name: string;
+            roleId: Portal;
+            tenantId: string;
+            expiresAt: string;
+            status: string;
+        }[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show(actor: Principal, id: string): Promise<{
+        id: string;
+        email: string;
+        name: string;
+        roleId: Portal;
+        tenantId: string;
+        expiresAt: string;
+        status: string;
+    }>;
+    store(actor: Principal, raw: unknown): Promise<{
+        id: string;
+        email: string;
+        name: string;
+        roleId: Portal;
+        tenantId: string;
+        expiresAt: string;
+        status: string;
+    }>;
+    resend(actor: Principal, id: string): Promise<{
+        id: string;
+        email: string;
+        name: string;
+        roleId: Portal;
+        tenantId: string;
+        expiresAt: string;
+        status: string;
+    }>;
+    destroy(actor: Principal, id: string): Promise<void>;
+}

package/dist/modules/identity/user/user.lifecycle.controller.js

@@ -0,0 +1,27 @@
+export class IdentityUserLifecycleController {
+    service;
+    constructor(service) {
+        this.service = service;
+    }
+    requestRecovery(portal, raw, address) {
+        return this.service.requestRecovery(portal, raw, address);
+    }
+    complete(portal, kind, raw, address) {
+        return this.service.complete(portal, kind, raw, address);
+    }
+    index(actor, query) {
+        return this.service.list(actor, query);
+    }
+    show(actor, id) {
+        return this.service.show(actor, id);
+    }
+    store(actor, raw) {
+        return this.service.invite(actor, raw);
+    }
+    resend(actor, id) {
+        return this.service.resend(actor, id);
+    }
+    destroy(actor, id) {
+        return this.service.revoke(actor, id);
+    }
+}

package/dist/modules/identity/{identity.lifecycle-schema.js → user/user.lifecycle.schema.js}

@@ -1,6 +1,6 @@
 import { z } from "zod";
-import { portalSchema } from "./identity.schema.js";
-import { resourceIdSchema } from "./identity.administration-schema.js";
+import { portalSchema } from "./user.schema.js";
+import { resourceIdSchema } from "../support/identity.schema.js";
 export const invitationSchema = z
     .object({
     email: z
@@ -9,7 +9,7 @@ export const invitationSchema = z
         .transform((v) => v.trim().toLowerCase()),
     name: z.string().trim().min(1).max(100),
     roleId: portalSchema.default("user"),
-    tenantId: resourceIdSchema.optional(),
+    tenantId: resourceIdSchema.optional()
 })
     .strict();
 export const recoverySchema = z
@@ -18,12 +18,12 @@ export const recoverySchema = z
         .email()
         .max(254)
         .transform((v) => v.trim().toLowerCase()),
-    tenantId: resourceIdSchema.optional(),
+    tenantId: resourceIdSchema.optional()
 })
     .strict();
 export const tokenCompletionSchema = z
     .object({
     token: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
-    password: z.string().min(12).max(256),
+    password: z.string().min(12).max(256)
 })
     .strict();

package/dist/modules/identity/{identity.lifecycle-service.d.ts → user/user.lifecycle.service.d.ts}

@@ -1,11 +1,15 @@
 import type { Kysely } from "kysely";
-import type { IdentityConfig, IdentityDeliveryProvider, IdentitySchema, Portal, Principal } from "./identity.types.js";
-import type { IdentityListQuery } from "./identity.administration-schema.js";
+import type { IdentityUserOwnership } from "./user.provider.js";
+import type { IdentityConfig, IdentityDeliveryProvider, IdentitySchema, Portal, Principal } from "../identity.types.js";
+import type { IdentityListQuery } from "../support/pagination.schema.js";
+import type { IdentityPermissionProvider } from "../permission/index.js";
 export declare class IdentityLifecycleService {
     private readonly db;
     private readonly config;
-    private readonly delivery?;
-    constructor(db: Kysely<IdentitySchema>, config: IdentityConfig, delivery?: IdentityDeliveryProvider | undefined);
+    private readonly delivery;
+    private readonly permissions;
+    private readonly ownership;
+    constructor(db: Kysely<IdentitySchema>, config: IdentityConfig, delivery: IdentityDeliveryProvider | undefined, permissions: IdentityPermissionProvider, ownership: IdentityUserOwnership);
     invite(actor: Principal, raw: unknown): Promise<{
         id: string;
         email: string;