@devxcrew/platform 0.1.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Devxcrew
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,82 @@
+# Platform Core
+
+Source repository: https://github.com/devxcrew/platform.
+Package: `@devxcrew/platform`, version `0.1.0`.
+
+Platform Core owns database identity, sessions, role permissions, and tenant membership.
+Applications consume its public provider. Framework remains responsible for business-neutral runtime primitives.
+
+Public exports include `createIdentityProvider`, `identityMigration`, `seedIdentity`, and identity contract types.
+The application provides its Kysely connection and validated environment. Platform Core owns all identity SQL and rules.
+
+## Identity foundation
+
+Three portal identities are supported: user, admin, and super-admin.
+Each portal requires an explicit tenant membership and its own desk permission.
+Administrator and super-administrator sessions do not grant access to other portals implicitly.
+
+Passwords use salted scrypt with N=32768, r=8, and p=3.
+Opaque session tokens use 32 random bytes. Only SHA-256 token hashes are stored in the database.
+Cookies are app- and portal-specific, HttpOnly, and SameSite=Strict.
+HTTPS uses Secure and the __Host- cookie prefix. HTTP is allowed only on loopback hosts.
+Unsafe HTTP requests require the configured application Origin. Login attempts have persistent per-address and per-account limits.
+
+Single-client mode resolves the configured tenant on the server.
+Multi-tenant mode accepts a tenant ID only after verifying database membership.
+Every session lookup rechecks account status, tenant status, membership, and current permissions.
+Password changes revoke every session belonging to the account.
+
+## Seed behavior
+
+Seeds create the configured organization, three roles, and foundation permissions.
+Optional bootstrap accounts require explicit email and password environment values.
+There are no default passwords. Existing users and memberships are not elevated or overwritten by the seed.
+
+## Development
+
+Run `npm install`, `npm test`, and `npm run build` in this package.
+Retrieve workspace instructions with this owner's authenticated npm run mcp:connect before edits.
+The package name is `@devxcrew/platform`. Cxsun consumes a user-approved bundled development snapshot.
+Owner authentication works. Deployed repository metadata remains pending. This package is not published to npm.
+
+Invitation and recovery APIs support injected delivery. Real provider delivery remains a release gate.
+Administration resources and settings are implemented. MFA and email verification remain explicit policy decisions.
+This foundation does not claim production security certification or enterprise operational readiness.
+
+## Owner checks
+
+Run npm run release:check for tests, build, dependency order, version alignment, LF and dry-run package checks.
+Maintenance uses the installed public @devxcrew/tools package. agent/CHANGELOG.md owns release metadata.
+Use version-bump, fix:line-endings, lines:check and check:versions before a coordinated release.
+Publication, Git delivery and deployment require authorization.
+
+## Module permission extensions
+
+Use the public identity.registerPermissions API or provider permissions options.
+Register identityPermissionDeclarationsMigration after the roles migration. verify registers option declarations.
+IDs use APP_ID.owner.action and declared allowed portals. Registration grants no roles automatically.
+See agent/PERMISSION-EXTENSIONS.md for the complete contract and local evidence.
+
+Module controllers use identity.authenticateRequest(request, portal, signal), then identity.requirePermission.
+Platform owns portal cookies, unsafe Origin validation and cancellation. Raw-token authenticate remains supported.
+
+Permission declarations may include an owner-written label. Permission catalog DTOs expose id, label, owner, appId and portals.
+Register identityPermissionLabelsMigration after declarations. Filter role choices by allowed portals and retain server validation.
+
+## Identity delivery failure contract
+
+Platform owns invitation and recovery tokens. Email owns transport and receipt validation.
+A successful send must return a nonempty receipt before the token becomes usable.
+A transport error, timeout, canceled request, or missing receipt removes the newly issued token and returns a safe unavailable error.
+A provider can accept a message before its response times out. That message can contain an unusable link.
+The UI must offer a new explicit request after failure. It must not promise delivery or retry silently.
+Successful resend creates a new token, then revokes the old invitation. A failed resend leaves the old invitation available.
+Recovery requests invalidate earlier recovery tokens for the same account.
+Recovery links expire after 30 minutes. Invitations expire after 24 hours. Completion claims one token once.
+Disabled delivery returns unavailable and does not create a simulated success.
+No automatic retry queue or durable outbox is implemented in this profile.
+Actual SMTP delivery acceptance remains deferred. Local failure and concurrency checks do not establish real recipient delivery.
+
+## Distribution
+
+First-party package code uses the MIT license. Dependency licenses and notices retain their original terms.

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { createIdentityProvider, IdentityError, identityMigration, identityAdministrationMigration, identityRolesMigration, identityPermissionDeclarationsMigration, identityPermissionLabelsMigration, seedIdentity, } from "./modules/identity/index.js";
+export type { IdentityPermissionDeclaration } from "./modules/identity/index.js";
+export { listSchema, userCreateSchema, userUpdateSchema, organizationCreateSchema, organizationUpdateSchema, membershipSchema, roleUpdateSchema, profileSchema, settingsSchema, } from "./modules/identity/index.js";
+export type { IdentityListQuery, IdentityResource, } from "./modules/identity/index.js";
+export type { IdentitySchema, IdentityConfig, Principal, Portal, IdentityDeliveryProvider, IdentityProviderOptions, IdentityPermissionCatalogEntry, } from "./modules/identity/index.js";

package/dist/index.js

@@ -0,0 +1,2 @@
+export { createIdentityProvider, IdentityError, identityMigration, identityAdministrationMigration, identityRolesMigration, identityPermissionDeclarationsMigration, identityPermissionLabelsMigration, seedIdentity, } from "./modules/identity/index.js";
+export { listSchema, userCreateSchema, userUpdateSchema, organizationCreateSchema, organizationUpdateSchema, membershipSchema, roleUpdateSchema, profileSchema, settingsSchema, } from "./modules/identity/index.js";

package/dist/modules/identity/identity.administration-migration.d.ts

@@ -0,0 +1,2 @@
+import type { Migration } from "kysely/migration";
+export declare const identityAdministrationMigration: Migration;

package/dist/modules/identity/identity.administration-migration.js

@@ -0,0 +1,75 @@
+export const identityAdministrationMigration = {
+    async up(db) {
+        for (const table of [
+            "identity_users",
+            "identity_tenants",
+            "identity_roles",
+        ])
+            await db.schema
+                .alterTable(table)
+                .addColumn("version", "integer", (c) => c.notNull().defaultTo(0))
+                .execute();
+        await db.schema
+            .createTable("identity_app_settings")
+            .addColumn("app_id", "text", (c) => c.primaryKey())
+            .addColumn("display_name", "text", (c) => c.notNull())
+            .addColumn("locale", "text", (c) => c.notNull().defaultTo("en"))
+            .addColumn("time_zone", "text", (c) => c.notNull().defaultTo("UTC"))
+            .addColumn("session_seconds", "integer", (c) => c.notNull().defaultTo(28800))
+            .execute();
+        await db.schema
+            .alterTable("identity_app_settings")
+            .addColumn("version", "integer", (c) => c.notNull().defaultTo(0))
+            .execute();
+        await db.schema
+            .createTable("identity_tokens")
+            .addColumn("id", "text", (c) => c.primaryKey())
+            .addColumn("token_hash", "text", (c) => c.notNull().unique())
+            .addColumn("app_id", "text", (c) => c.notNull())
+            .addColumn("tenant_id", "text", (c) => c.notNull().references("identity_tenants.id"))
+            .addColumn("kind", "text", (c) => c.notNull())
+            .addColumn("email", "text", (c) => c.notNull())
+            .addColumn("name", "text", (c) => c.notNull())
+            .addColumn("role_id", "text", (c) => c.notNull().references("identity_roles.id"))
+            .addColumn("user_id", "text")
+            .addColumn("expires_at", "text", (c) => c.notNull())
+            .addColumn("consumed_at", "text")
+            .addColumn("delivered", "integer", (c) => c.notNull().defaultTo(0))
+            .execute();
+        await db.schema
+            .createTable("identity_settings")
+            .addColumn("tenant_id", "text", (c) => c.primaryKey().references("identity_tenants.id").onDelete("cascade"))
+            .addColumn("display_name", "text", (c) => c.notNull())
+            .addColumn("locale", "text", (c) => c.notNull().defaultTo("en"))
+            .addColumn("time_zone", "text", (c) => c.notNull().defaultTo("UTC"))
+            .addColumn("version", "integer", (c) => c.notNull().defaultTo(0))
+            .execute();
+        await db.schema
+            .createTable("identity_audit_events")
+            .addColumn("id", "text", (c) => c.primaryKey())
+            .addColumn("app_id", "text", (c) => c.notNull())
+            .addColumn("actor_id", "text", (c) => c.notNull())
+            .addColumn("tenant_id", "text", (c) => c.notNull())
+            .addColumn("action", "text", (c) => c.notNull())
+            .addColumn("resource_id", "text", (c) => c.notNull())
+            .addColumn("created_at", "text", (c) => c.notNull())
+            .execute();
+        await db.schema
+            .createIndex("identity_audit_scope")
+            .on("identity_audit_events")
+            .columns(["app_id", "tenant_id", "created_at"])
+            .execute();
+    },
+    async down(db) {
+        for (const table of [
+            "identity_users",
+            "identity_tenants",
+            "identity_roles",
+        ])
+            await db.schema.alterTable(table).dropColumn("version").execute();
+        await db.schema.dropTable("identity_app_settings").execute();
+        await db.schema.dropTable("identity_tokens").execute();
+        await db.schema.dropTable("identity_audit_events").execute();
+        await db.schema.dropTable("identity_settings").execute();
+    },
+};

package/dist/modules/identity/identity.administration-repository.d.ts

@@ -0,0 +1,19 @@
+import { type Kysely } from "kysely";
+import type { IdentitySchema, Principal } from "./identity.types.js";
+import type { IdentityListQuery, IdentityResource } from "./identity.administration-schema.js";
+export declare class IdentityAdministrationRepository {
+    private readonly db;
+    constructor(db: Kysely<IdentitySchema>);
+    list(actor: Principal, resource: IdentityResource, query: IdentityListQuery): Promise<{
+        data: Record<string, unknown>[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show(actor: Principal, resource: IdentityResource, id: string): Promise<Record<string, unknown> | undefined>;
+    private source;
+    private present;
+}

package/dist/modules/identity/identity.administration-repository.js

@@ -0,0 +1,102 @@
+import { sql } from "kysely";
+import { IdentityError } from "./identity.error.js";
+export class IdentityAdministrationRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async list(actor, resource, query) {
+        const source = this.source(actor, resource);
+        const fields = resource === "users"
+            ? ["id", "name", "email"]
+            : resource === "organizations" || resource === "roles"
+                ? ["id", "name"]
+                : resource === "memberships"
+                    ? ["id", "userName", "organizationName", "roleName"]
+                    : ["id"];
+        if (!fields.includes(query.sort))
+            throw new IdentityError(422, "This sort field is not supported for this resource.");
+        const search = query.search
+            ? sql `where ${sql.join(fields.map((field) => sql `lower(cast(${sql.ref(field)} as text)) like ${`%${query.search.toLowerCase()}%`}`), sql ` or `)}`
+            : sql ``;
+        const count = await sql `select count(*) as total from (${source}) as resources ${search}`.execute(this.db);
+        const sort = query.sort;
+        const rows = await sql `select * from (${source}) as resources ${search}
+      order by ${sql.ref(sort)} ${query.direction === "asc" ? sql `asc` : sql `desc`}, id asc
+      limit ${query.perPage} offset ${(query.page - 1) * query.perPage}`.execute(this.db);
+        const total = Number(count.rows[0].total);
+        return {
+            data: rows.rows.map((row) => this.present(resource, row)),
+            meta: {
+                page: query.page,
+                perPage: query.perPage,
+                total,
+                lastPage: Math.max(1, Math.ceil(total / query.perPage)),
+            },
+        };
+    }
+    async show(actor, resource, id) {
+        const result = await sql `select * from (${this.source(actor, resource)}) as resources where id = ${id} limit 1`.execute(this.db);
+        return result.rows[0] ? this.present(resource, result.rows[0]) : undefined;
+    }
+    source(actor, resource) {
+        const global = actor.portal === "super-admin";
+        if (resource === "users")
+            return sql `select u.id,u.name,u.email,u.active,u.version from identity_users u
+      where exists (select 1 from identity_memberships m left join identity_custom_roles c on c.id=m.custom_role_id
+        where m.user_id=u.id and (m.custom_role_id is null or c.app_id=${actor.appId})
+        ${global ? sql `` : sql `and m.tenant_id=${actor.tenant.id}`})
+        ${global ? sql `or not exists(select 1 from identity_memberships m where m.user_id=u.id)` : sql ``}`;
+        if (resource === "organizations")
+            return sql `select id,name,active,version from identity_tenants ${global ? sql `` : sql `where id=${actor.tenant.id}`}`;
+        if (resource === "memberships")
+            return sql `select m.user_id||'~'||m.tenant_id||'~'||m.role_id as id,m.user_id as userId,m.tenant_id as tenantId,
+      coalesce(m.custom_role_id,m.role_id) as roleId,m.role_id as portal,m.active,m.version,u.name as userName,t.name as organizationName,
+      coalesce(c.name,m.role_id) as roleName from identity_memberships m
+      join identity_users u on u.id=m.user_id join identity_tenants t on t.id=m.tenant_id
+      left join identity_custom_roles c on c.id=m.custom_role_id
+      where (m.custom_role_id is null or c.app_id=${actor.appId}) ${global ? sql `` : sql `and m.tenant_id=${actor.tenant.id}`}`;
+        if (resource === "roles")
+            return sql `select r.id,r.id as name,r.id as portal,1 as system,null as tenantId,1 as active,r.version,(select json_group_array(permission_id) from identity_role_permissions p where p.role_id=r.id) as permissionIds from identity_roles r
+        union all select c.id,c.name,'user' as portal,0 as system,c.tenant_id as tenantId,c.active,c.version,
+        (select json_group_array(permission_id) from identity_custom_role_permissions p where p.role_id=c.id) as permissionIds
+        from identity_custom_roles c where c.app_id=${actor.appId} ${global ? sql `` : sql `and c.tenant_id=${actor.tenant.id}`}`;
+        if (resource === "permissions")
+            return sql `select p.id,coalesce(d.label,p.id) as label,
+        coalesce(d.owner,case when p.id like 'desk.%' then 'desk' else 'identity' end) as owner,
+        d.app_id as appId,
+        coalesce(d.portals,case when p.id='desk.user' then '["user"]' when p.id='desk.admin' then '["admin"]'
+          when p.id='desk.super-admin' then '["super-admin"]' when p.id='identity.manage' then '["admin","super-admin"]'
+          else '["user","admin","super-admin"]' end) as portals
+        from identity_permissions p left join identity_permission_declarations d on d.permission_id=p.id
+        where d.permission_id is null or d.app_id=${actor.appId}`;
+        if (resource === "sessions")
+            return sql `select token_hash as id,user_id as userId,tenant_id as tenantId,portal,expires_at as expiresAt from identity_sessions
+      where app_id=${actor.appId} and expires_at>${new Date().toISOString()}
+      ${global ? sql `` : sql `and tenant_id=${actor.tenant.id}`}
+      ${actor.portal === "user" ? sql `and user_id=${actor.user.id}` : sql ``}`;
+        return sql `select id,actor_id as actorId,tenant_id as tenantId,action,resource_id as resourceId,created_at as createdAt
+      from identity_audit_events where app_id=${actor.appId} ${global ? sql `` : sql `and tenant_id=${actor.tenant.id}`}`;
+    }
+    present(resource, row) {
+        if (resource === "permissions")
+            return { ...row, portals: JSON.parse(String(row.portals)) };
+        if (resource === "roles")
+            return {
+                ...row,
+                version: Number(row.version),
+                active: Boolean(row.active),
+                system: Boolean(row.system),
+                permissionIds: JSON.parse(String(row.permissionIds)),
+            };
+        if (resource === "users" ||
+            resource === "organizations" ||
+            resource === "memberships")
+            return {
+                ...row,
+                active: Boolean(row.active),
+                version: Number(row.version),
+            };
+        return row;
+    }
+}

package/dist/modules/identity/identity.administration-schema.d.ts

@@ -0,0 +1,113 @@
+import { z } from "zod";
+export declare const resourceIdSchema: z.ZodString;
+export declare const listSchema: z.ZodObject<{
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    perPage: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    search: z.ZodDefault<z.ZodString>;
+    sort: z.ZodDefault<z.ZodEnum<{
+        email: "email";
+        id: "id";
+        name: "name";
+    }>>;
+    direction: z.ZodDefault<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+}, z.core.$strict>;
+export declare const resourceListQuerySchema: z.ZodPipe<z.ZodObject<{
+    page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    search: z.ZodDefault<z.ZodString>;
+    sort: z.ZodDefault<z.ZodEnum<{
+        email: "email";
+        id: "id";
+        name: "name";
+    }>>;
+    direction: z.ZodDefault<z.ZodEnum<{
+        asc: "asc";
+        desc: "desc";
+    }>>;
+    per_page: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strict>, z.ZodTransform<{
+    page: number;
+    search: string;
+    sort: "email" | "id" | "name";
+    direction: "asc" | "desc";
+    perPage: number;
+}, {
+    page: number;
+    search: string;
+    sort: "email" | "id" | "name";
+    direction: "asc" | "desc";
+    per_page: number;
+}>>;
+export declare const membershipDeleteQuerySchema: z.ZodObject<{
+    expectedVersion: z.ZodPipe<z.ZodString, z.ZodTransform<number, string>>;
+}, z.core.$strict>;
+export declare const userCreateSchema: z.ZodObject<{
+    name: z.ZodString;
+    email: z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>;
+    password: z.ZodString;
+    roleId: z.ZodDefault<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const userUpdateSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodPipe<z.ZodEmail, z.ZodTransform<string, string>>>;
+    active: z.ZodOptional<z.ZodBoolean>;
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;
+export declare const organizationCreateSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    active: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>;
+export declare const organizationUpdateSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    active: z.ZodOptional<z.ZodBoolean>;
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;
+export declare const membershipSchema: z.ZodObject<{
+    userId: z.ZodString;
+    tenantId: z.ZodOptional<z.ZodString>;
+    roleId: z.ZodString;
+}, z.core.$strict>;
+export declare const roleUpdateSchema: z.ZodObject<{
+    permissionIds: z.ZodArray<z.ZodString>;
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;
+export declare const profileSchema: z.ZodObject<{
+    name: z.ZodString;
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;
+export declare const customRoleCreateSchema: z.ZodObject<{
+    name: z.ZodString;
+    permissionIds: z.ZodArray<z.ZodString>;
+    tenantId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const customRoleUpdateSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    permissionIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    active: z.ZodOptional<z.ZodBoolean>;
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;
+export declare const membershipUpdateSchema: z.ZodObject<{
+    roleId: z.ZodString;
+    active: z.ZodBoolean;
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;
+export declare const settingsSchema: z.ZodObject<{
+    displayName: z.ZodString;
+    expectedVersion: z.ZodNumber;
+    locale: z.ZodEnum<{
+        en: "en";
+        "en-GB": "en-GB";
+        "en-US": "en-US";
+    }>;
+    timeZone: z.ZodString;
+}, z.core.$strict>;
+export declare const securitySettingsSchema: z.ZodObject<{
+    sessionSeconds: z.ZodNumber;
+    expectedVersion: z.ZodNumber;
+}, z.core.$strict>;
+export type IdentityListQuery = z.infer<typeof listSchema>;
+export type IdentityResource = "users" | "organizations" | "memberships" | "roles" | "permissions" | "sessions" | "audit-events";

package/dist/modules/identity/identity.administration-schema.js

@@ -0,0 +1,121 @@
+import { z } from "zod";
+import { identityKeySchema } from "./identity.schema.js";
+export const resourceIdSchema = z
+    .string()
+    .regex(/^[a-zA-Z0-9._~-]{1,300}$/)
+    .refine((value) => !/^\.+$/.test(value), "Use an identifier with a letter or number.");
+export const listSchema = z
+    .object({
+    page: z.coerce.number().int().min(1).max(100000).default(1),
+    perPage: z.coerce.number().int().min(1).max(100).default(20),
+    search: z.string().trim().max(100).default(""),
+    sort: z.enum(["id", "name", "email"]).default("id"),
+    direction: z.enum(["asc", "desc"]).default("asc"),
+})
+    .strict();
+export const resourceListQuerySchema = listSchema
+    .omit({ perPage: true })
+    .extend({ per_page: listSchema.shape.perPage })
+    .strict()
+    .transform(({ per_page, ...input }) => ({ ...input, perPage: per_page }));
+export const membershipDeleteQuerySchema = z
+    .object({
+    expectedVersion: z
+        .string()
+        .regex(/^(0|[1-9][0-9]{0,9})$/)
+        .transform(Number),
+})
+    .strict();
+const name = z.string().trim().min(1).max(100);
+const email = z
+    .email()
+    .max(254)
+    .transform((v) => v.trim().toLowerCase());
+export const userCreateSchema = z
+    .object({
+    name,
+    email,
+    password: z.string().min(12).max(256),
+    roleId: resourceIdSchema.default("user"),
+    tenantId: identityKeySchema.optional(),
+})
+    .strict();
+const expectedVersion = z.number().int().min(0);
+export const userUpdateSchema = z
+    .object({
+    name: name.optional(),
+    email: email.optional(),
+    active: z.boolean().optional(),
+    expectedVersion,
+})
+    .strict()
+    .refine((v) => Object.keys(v).length > 1, "Provide a changed field.");
+export const organizationCreateSchema = z
+    .object({ id: identityKeySchema, name, active: z.boolean().default(true) })
+    .strict();
+export const organizationUpdateSchema = z
+    .object({
+    name: name.optional(),
+    active: z.boolean().optional(),
+    expectedVersion,
+})
+    .strict()
+    .refine((v) => Object.keys(v).length > 1, "Provide a changed field.");
+export const membershipSchema = z
+    .object({
+    userId: identityKeySchema,
+    tenantId: identityKeySchema.optional(),
+    roleId: resourceIdSchema,
+})
+    .strict();
+export const roleUpdateSchema = z
+    .object({
+    permissionIds: z.array(resourceIdSchema).max(100),
+    expectedVersion,
+})
+    .strict();
+export const profileSchema = z.object({ name, expectedVersion }).strict();
+export const customRoleCreateSchema = z
+    .object({
+    name,
+    permissionIds: z.array(resourceIdSchema).max(100),
+    tenantId: identityKeySchema.optional(),
+})
+    .strict();
+export const customRoleUpdateSchema = z
+    .object({
+    name: name.optional(),
+    permissionIds: z.array(resourceIdSchema).max(100).optional(),
+    active: z.boolean().optional(),
+    expectedVersion,
+})
+    .strict()
+    .refine((input) => Object.keys(input).length > 1, "Provide a changed field.");
+export const membershipUpdateSchema = z
+    .object({ roleId: resourceIdSchema, active: z.boolean(), expectedVersion })
+    .strict();
+export const settingsSchema = z
+    .object({
+    displayName: name,
+    expectedVersion,
+    locale: z.enum(["en", "en-US", "en-GB"]),
+    timeZone: z
+        .string()
+        .max(100)
+        .refine((v) => {
+        try {
+            new Intl.DateTimeFormat("en", { timeZone: v });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }, "Use a supported IANA time zone."),
+})
+    .strict();
+export const securitySettingsSchema = z
+    .object({
+    sessionSeconds: z.number().int().min(300).max(86400),
+    expectedVersion,
+})
+    .strict();

package/dist/modules/identity/identity.administration-service.d.ts

@@ -0,0 +1,97 @@
+import { type Kysely } from "kysely";
+import type { IdentitySchema, Principal } from "./identity.types.js";
+import { type IdentityListQuery, type IdentityResource } from "./identity.administration-schema.js";
+export declare class IdentityAdministrationService {
+    private readonly db;
+    private readonly appName;
+    private readonly repository;
+    private readonly roles;
+    private readonly presentationService;
+    constructor(db: Kysely<IdentitySchema>, appName: string);
+    list(actor: Principal, resource: IdentityResource, query: IdentityListQuery): Promise<{
+        data: Record<string, unknown>[];
+        meta: {
+            page: number;
+            perPage: number;
+            total: number;
+            lastPage: number;
+        };
+    }>;
+    show(actor: Principal, resource: IdentityResource, id: string): Promise<Record<string, unknown>>;
+    create(actor: Principal, resource: IdentityResource, raw: unknown): Promise<{
+        id: string;
+        name: string;
+        active: boolean;
+        version: number;
+    } | {
+        id: string;
+        userId: string;
+        tenantId: string;
+        roleId: string;
+        portal: import("./identity.types.js").Portal;
+        active: boolean;
+        version: number;
+    }>;
+    update(actor: Principal, resource: IdentityResource, id: string, raw: unknown): Promise<{
+        id: string;
+        userId: string;
+        tenantId: string;
+        roleId: string;
+        portal: import("./identity.types.js").Portal;
+        active: boolean;
+        version: number;
+    } | {
+        active: boolean;
+        version: number;
+        id: string;
+        name: string;
+    } | {
+        id: string;
+        permissionIds: string[];
+        version: number;
+    }>;
+    remove(actor: Principal, resource: IdentityResource, id: string, expectedVersion?: number): Promise<void>;
+    profile(actor: Principal, raw?: unknown): Promise<{
+        active: boolean;
+        version: number;
+        email: string;
+        id: string;
+        name: string;
+    }>;
+    settings(actor: Principal, raw?: unknown): Promise<{
+        displayName: string;
+        locale: string;
+        timeZone: string;
+        version: number;
+    }>;
+    applicationSettings(actor: Principal, security: boolean, raw: unknown, fallbackSeconds: number): Promise<{
+        sessionSeconds: number;
+        version: number;
+        displayName?: undefined;
+        locale?: undefined;
+        timeZone?: undefined;
+    } | {
+        sessionSeconds?: undefined;
+        displayName: string;
+        locale: string;
+        timeZone: string;
+        version: number;
+    }>;
+    private revision;
+    presentation(actor: Principal): Promise<{
+        displayName: string;
+        organizationDisplayName: string;
+        locale: string;
+        timeZone: string;
+    }>;
+    configuration(appId: string, requiresOrganizationId: boolean): Promise<{
+        displayName: string;
+        requiresOrganizationId: boolean;
+    }>;
+    private allow;
+    private tenant;
+    private assignableRole;
+    private activeTenant;
+    private unprivilegedUser;
+    private mutate;
+}