@endora-commerce/mod-admin-users 0.100.0

package/dist/backend/index.d.ts

@@ -0,0 +1,77 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { FastifyRequest } from 'fastify';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import type { AdminRolePort, AuthSessionPort, CustomerAccountReadPort, PermissionCataloguePort, PermissionReadPort } from '@endora-commerce/contracts';
+import type { ModuleContext } from '@endora-commerce/platform/kernel';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+import { adminModule } from './plugin.js';
+import { AdminUser } from './entities/admin-user.entity.js';
+/**
+ * `admin_users` — who the admin is, and who is allowed to say so (feature 072,
+ * wave 2, T121).
+ *
+ * Four of its five services came from other modules and are ports now:
+ * `sessionService` from `auth`, and `permissionService`,
+ * `permissionCatalogueService` and `adminRoleService` from `admin_roles`. The
+ * last was optional, with a fallback that built a second `AdminRoleService`
+ * inside this module — a shape neither composition ever ran, and one that would
+ * have written role changes through a different audit path than the one
+ * `/admin-roles` reads.
+ *
+ * **The MFA port is a `degrades-without` edge this module resolves itself**
+ * (D-96). Absent, admin login is password-only, which is a real deployment
+ * rather than a broken one; declaring `mfa` in `dependencies` would make the
+ * lifecycle refuse to disable MFA while admin login is on, which is backwards —
+ * and `mfa` declares *this* module, so the ordinary declaration would close a
+ * cycle. The manifest says so in `nonBindingDependencies` instead, and the
+ * probe below is what that declaration is held to.
+ *
+ * It used to be a contribution both roots filled from one getter, which is how
+ * a gated port came to be resolved on this module's behalf (composition
+ * checklist item 6) — and how the harness came to capture the gate at compose
+ * time, so no off-state test could observe `mfa` switched off at all.
+ *
+ * **`auditActorResolver` stays a root contribution**, against the prediction in
+ * `audit_logs/backend.ts` that it would move here. `audit_logs` owns that name
+ * and defaults it absent, and the generated composer runs `admin_users` before
+ * `audit_logs` — so a registration here would be overwritten by the owner's
+ * default a moment later. What the conversion does buy is the gate: the root's
+ * adapter now reads the `adminUserService` **port**, whose own gate raises
+ * `ModuleDisabledError` when this module is off, so no composition root has to
+ * hard-code `isPresent('admin_users')` to decide it.
+ */
+/** What `admin_users` resolves from the container, and the names it owns. */
+export interface AdminUsersCradle {
+    readonly emFactory: () => EntityManager;
+    readonly auditLogService: AuditPort;
+    readonly requireAdmin: RequireAdminFactory;
+    /** Who the acting admin is — production reads `actor`, the harness `testActor`. */
+    readonly adminContextResolver: (req: FastifyRequest) => {
+        adminUserId: string;
+    };
+    readonly authSessionPort: AuthSessionPort;
+    readonly permissionService: PermissionReadPort;
+    readonly permissionCataloguePort: PermissionCataloguePort;
+    readonly adminRolePort: AdminRolePort;
+    readonly customerAccountReadPort: CustomerAccountReadPort;
+    readonly admin: ReturnType<typeof adminModule>;
+    readonly adminUserService: ReturnType<typeof adminModule>['handle']['adminUserService'];
+}
+export declare function registerModule(ctx: ModuleContext): void;
+/**
+ * The module's persisted entity classes, on the `./backend` subpath, as one
+ * array and **no named class export** (D-168).
+ *
+ * This is the shape the platform reads when the package is *installed*: the
+ * boot-time loader (`src/packages/package-runtime.ts`, `exported['entities']`)
+ * and the static declaration reader (`scripts/lib/package-declarations.ts`),
+ * which is the third source of `check:module-boundary`'s `table->owner` map and
+ * the package pass of `check-entity-tenant-classification`. A missing array is
+ * answered with `[]` — zero entities registered, no error anywhere.
+ *
+ * The order is the one `db/entities-registry.generated.ts` declared before this
+ * module became a package, so the registered set is the same list in the same
+ * sequence.
+ */
+export declare const entities: (typeof AdminUser)[];
+//# sourceMappingURL=index.d.ts.map

package/dist/backend/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,KAAK,EAEV,aAAa,EAGb,eAAe,EACf,uBAAuB,EAIvB,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAGtE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAS5D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,6EAA6E;AAC7E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,aAAa,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC;IACpC,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,mFAAmF;IACnF,QAAQ,CAAC,oBAAoB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAChF,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAC/C,QAAQ,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;IAC1D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,uBAAuB,EAAE,uBAAuB,CAAC;IAC1D,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC;IAC/C,QAAQ,CAAC,gBAAgB,EAAE,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,QAAQ,CAAC,CAAC,kBAAkB,CAAC,CAAC;CACzF;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,aAAa,GAAG,IAAI,CAmIvD;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,QAAQ,sBAEpB,CAAC"}

package/dist/backend/index.js

@@ -0,0 +1,111 @@
+import { lazyPort } from '@endora-commerce/platform/kernel';
+import { effectiveState } from '@endora-commerce/platform/kernel';
+import { adminModule } from './plugin.js';
+import { AdminUser } from './entities/admin-user.entity.js';
+import { AdminUserReadService, createAdminPasswordVerificationPort, createAdminUserPreferencePort, createImpersonationPort, } from './services/admin-user-ports.js';
+export function registerModule(ctx) {
+    // D-96 — resolved once, called through on every login. The gate `mfa`'s
+    // `providePort` put on this name is transient, so the proxy asks about the
+    // module's effective state at each call rather than at composition.
+    const mfaLoginPort = lazyPort(ctx, 'mfaLoginPort');
+    // The live source of `twoFactorEnabled`, on the same terms as the login port
+    // above and for the same reason. This module's own `two_factor_confirmed_at`
+    // column has never had a writer, so the field derived from it was a provably
+    // constant `false` on `/admin-users`, on `/admin/me` and on the login
+    // response the Admin UI seeds its auth context from.
+    const mfaEnrolmentStatePort = lazyPort(ctx, 'mfaEnrolmentStatePort');
+    /**
+     * The degrade is performed by **not resolving**, exactly as `getMfaLoginPort`
+     * below does it — presence is decided first and there is deliberately no
+     * `catch` anywhere near the port. An admin list is the wrong place for a 503,
+     * and `false` is not a substitute for the answer here: with `mfa` absent no
+     * sign-in asks for a second factor, so no account is protected by one. The
+     * sentence an operator is shown before the flip is this module's
+     * `degrades-without` entry for `mfaEnrolmentStatePort`.
+     */
+    const twoFactorEnrolments = async (adminUserIds) => {
+        if (!effectiveState.isPresent('mfa'))
+            return new Set();
+        return new Set(await mfaEnrolmentStatePort.activeSubjectIds('admin', adminUserIds));
+    };
+    ctx.di.register({
+        admin: ctx
+            .asFunction(({ emFactory, auditLogService }) => adminModule({
+            emFactory,
+            auditLogService,
+            // Feature 075, Phase C — every collaborator below is another
+            // module's published port, resolved lazily by a string literal so
+            // the gate answers per call and nothing captures it.
+            authSessionPort: lazyPort(ctx, 'authSessionPort'),
+            permissionService: lazyPort(ctx, 'permissionService'),
+            permissionCataloguePort: lazyPort(ctx, 'permissionCataloguePort'),
+            adminRolePort: lazyPort(ctx, 'adminRolePort'),
+            customerAccountReadPort: lazyPort(ctx, 'customerAccountReadPort'),
+            requireAdmin: (permission) => async (req, reply) => ctx.cradle().requireAdmin(permission)(req, reply),
+            resolveAdminContext: (req) => ctx.cradle().adminContextResolver(req),
+            // D-96 — the degrade is performed by **not resolving**. The port's
+            // gate throws `ModuleDisabledError` when `mfa` is absent, and there
+            // is deliberately no `catch` anywhere near this: a caught gate is a
+            // fail-open degrade nobody declared. Deciding presence first is the
+            // `auth`/`api_keys` shape, and `AdminAuthService`'s `if (mfaPort)`
+            // branch — the password-only fallback of feature 042 FR-033 — is what
+            // `undefined` selects.
+            getMfaLoginPort: () => (effectiveState.isPresent('mfa') ? mfaLoginPort : undefined),
+            twoFactorEnrolments,
+        }))
+            .singleton(),
+    });
+    ctx.di.providePort('adminUserService', ctx.asFunction(({ admin }) => admin.handle.adminUserService).singleton());
+    // ---------------------------------------------------------------------------
+    // Feature 075, Phase P — the published surface.
+    //
+    // Seven of the eleven inbound sites read the `AdminUser` **entity** to put a
+    // name beside an id, and none of them wants a service: `admin_roles`
+    // resolving a user's role, `quote_requests` listing the admins a
+    // notification fans out to, `catalog` attributing a bulk operation,
+    // `organizations` rendering the sales-rep picker. `adminUserReadPort` is
+    // that read.
+    //
+    // The two adapters narrow the module's services to what one consumer each
+    // calls — `_i18n` writes a language preference, `customers` starts and ends
+    // an impersonation — and neither hands an entity across.
+    // ---------------------------------------------------------------------------
+    ctx.di.providePort('adminUserReadPort', ctx
+        .asFunction(({ emFactory }) => new AdminUserReadService(emFactory, twoFactorEnrolments))
+        .singleton());
+    // Feature 080 (T052) — step-up re-verification, for `mfa`. Both composition
+    // roots used to read `passwordHash` off this module's entity and compare it
+    // with the platform hasher themselves; the column and the comparison are
+    // this module's, so the boolean is what crosses.
+    ctx.di.providePort('adminPasswordVerificationPort', ctx
+        .asFunction(({ emFactory }) => createAdminPasswordVerificationPort(emFactory))
+        .singleton());
+    ctx.di.providePort('adminUserPreferencePort', ctx
+        .asFunction(() => createAdminUserPreferencePort(() => ctx.cradle().adminUserService, twoFactorEnrolments))
+        .singleton());
+    ctx.di.providePort('impersonationPort', ctx
+        .asFunction(({ admin }) => createImpersonationPort(() => admin.handle.impersonationService))
+        .singleton());
+    ctx.routes(async (app) => {
+        await ctx.cradle().admin.plugin(app);
+    });
+}
+/**
+ * The module's persisted entity classes, on the `./backend` subpath, as one
+ * array and **no named class export** (D-168).
+ *
+ * This is the shape the platform reads when the package is *installed*: the
+ * boot-time loader (`src/packages/package-runtime.ts`, `exported['entities']`)
+ * and the static declaration reader (`scripts/lib/package-declarations.ts`),
+ * which is the third source of `check:module-boundary`'s `table->owner` map and
+ * the package pass of `check-entity-tenant-classification`. A missing array is
+ * answered with `[]` — zero entities registered, no error anywhere.
+ *
+ * The order is the one `db/entities-registry.generated.ts` declared before this
+ * module became a package, so the registered set is the same list in the same
+ * sequence.
+ */
+export const entities = [
+    AdminUser,
+];
+//# sourceMappingURL=index.js.map

package/dist/backend/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,QAAQ,EAAE,MAAM,kCAAkC,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAC;AAC5D,OAAO,EACL,oBAAoB,EACpB,mCAAmC,EACnC,6BAA6B,EAC7B,uBAAuB,GACxB,MAAM,gCAAgC,CAAC;AAsDxC,MAAM,UAAU,cAAc,CAAC,GAAkB;IAC/C,wEAAwE;IACxE,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,YAAY,GAAG,QAAQ,CAAe,GAAG,EAAE,cAAc,CAAC,CAAC;IAEjE,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,sEAAsE;IACtE,qDAAqD;IACrD,MAAM,qBAAqB,GAAG,QAAQ,CAAwB,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAE5F;;;;;;;;OAQG;IACH,MAAM,mBAAmB,GAA6B,KAAK,EAAE,YAAY,EAAE,EAAE;QAC3E,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAU,CAAC;QAC/D,OAAO,IAAI,GAAG,CAAC,MAAM,qBAAqB,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC;QACd,KAAK,EAAE,GAAG;aACP,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAoB,EAAE,EAAE,CAC/D,WAAW,CAAC;YACV,SAAS;YACT,eAAe;YACf,6DAA6D;YAC7D,kEAAkE;YAClE,qDAAqD;YACrD,eAAe,EAAE,QAAQ,CAAkB,GAAG,EAAE,iBAAiB,CAAC;YAClE,iBAAiB,EAAE,QAAQ,CAAqB,GAAG,EAAE,mBAAmB,CAAC;YACzE,uBAAuB,EAAE,QAAQ,CAC/B,GAAG,EACH,yBAAyB,CAC1B;YACD,aAAa,EAAE,QAAQ,CAAgB,GAAG,EAAE,eAAe,CAAC;YAC5D,uBAAuB,EAAE,QAAQ,CAC/B,GAAG,EACH,yBAAyB,CAC1B;YACD,YAAY,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CACjD,GAAG,CAAC,MAAM,EAAoB,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC;YACrE,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,EAAoB,CAAC,oBAAoB,CAAC,GAAG,CAAC;YACtF,mEAAmE;YACnE,oEAAoE;YACpE,oEAAoE;YACpE,oEAAoE;YACpE,mEAAmE;YACnE,sEAAsE;YACtE,uBAAuB;YACvB,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YACnF,mBAAmB;SACpB,CAAC,CACH;aACA,SAAS,EAAE;KACf,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,kBAAkB,EAClB,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,EAAoB,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAC3F,CAAC;IAEF,8EAA8E;IAC9E,gDAAgD;IAChD,EAAE;IACF,6EAA6E;IAC7E,qEAAqE;IACrE,iEAAiE;IACjE,oEAAoE;IACpE,yEAAyE;IACzE,aAAa;IACb,EAAE;IACF,0EAA0E;IAC1E,4EAA4E;IAC5E,yDAAyD;IACzD,8EAA8E;IAE9E,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,mBAAmB,EACnB,GAAG;SACA,UAAU,CACT,CAAC,EAAE,SAAS,EAAoB,EAAE,EAAE,CAClC,IAAI,oBAAoB,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAC3D;SACA,SAAS,EAAE,CACf,CAAC;IAEF,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,iDAAiD;IACjD,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,+BAA+B,EAC/B,GAAG;SACA,UAAU,CAAC,CAAC,EAAE,SAAS,EAAoB,EAAE,EAAE,CAC9C,mCAAmC,CAAC,SAAS,CAAC,CAC/C;SACA,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,yBAAyB,EACzB,GAAG;SACA,UAAU,CAAC,GAAG,EAAE,CACf,6BAA6B,CAC3B,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAoB,CAAC,gBAAgB,EACrD,mBAAmB,CACpB,CACF;SACA,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,EAAE,CAAC,WAAW,CAChB,mBAAmB,EACnB,GAAG;SACA,UAAU,CAAC,CAAC,EAAE,KAAK,EAAoB,EAAE,EAAE,CAC1C,uBAAuB,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,CACjE;SACA,SAAS,EAAE,CACf,CAAC;IAEF,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACvB,MAAM,GAAG,CAAC,MAAM,EAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,SAAS;CACV,CAAC"}

package/dist/backend/plugin.d.ts

@@ -0,0 +1,70 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import type { EntityManager } from '@mikro-orm/postgresql';
+import type { AdminRolePort, AuthSessionPort, CustomerAccountReadPort, MfaLoginPort, PermissionCataloguePort, PermissionReadPort } from '@endora-commerce/contracts';
+import { AdminAuthService } from './services/admin-auth-service.js';
+import { ImpersonationService } from './services/impersonation-service.js';
+import { AdminUserService } from './services/admin-user-service.js';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+import type { TwoFactorEnrolmentReader } from './services/two-factor-enrolments.js';
+/**
+ * Every collaborator this module does not own is named by its **container
+ * name** and typed by the contract its owner publishes (feature 075, Phase C).
+ * The field names are the port names `backend.ts` resolves, so the option
+ * object, the `lazyPort` literal and the manifest dependency read as one thing.
+ */
+export interface AdminModuleOptions {
+    emFactory: () => EntityManager;
+    /** `auth`'s session surface — mints, loads and destroys the session rows. */
+    authSessionPort: AuthSessionPort;
+    auditLogService: AuditPort;
+    /** `admin_roles` — the effective permission codes of one admin user. */
+    permissionService: PermissionReadPort;
+    /** `admin_roles` — the codes an operator may actually grant. */
+    permissionCataloguePort: PermissionCataloguePort;
+    /**
+     * Required since feature 072 (T121). It was optional with an in-module
+     * fallback that built a second `AdminRoleService`; both compositions passed
+     * `admin_roles`' own instance, and the fallback would have written role
+     * changes through a different audit path than `/admin-roles` reads.
+     */
+    adminRolePort: AdminRolePort;
+    /** `customer_accounts` — who an impersonation is started against. */
+    customerAccountReadPort: CustomerAccountReadPort;
+    requireAdmin: RequireAdminFactory;
+    /** Resolves the current admin's id from `request.actor` (prod) or
+     *  `request.testActor` (test harness). Used by `GET /admin/me`. */
+    resolveAdminContext: (req: FastifyRequest) => {
+        adminUserId: string;
+    };
+    /** Feature 042 — lazily resolved MFA login port (absent ⇒ password-only). */
+    getMfaLoginPort?: () => MfaLoginPort | undefined;
+    /**
+     * Which admins hold a second factor. Required, not optional: the field it
+     * feeds has a value on every response that carries an admin user, and the
+     * defect being repaired is exactly what a plausible default produces.
+     */
+    twoFactorEnrolments: TwoFactorEnrolmentReader;
+}
+export interface AdminModuleHandle {
+    adminAuthService: AdminAuthService;
+    impersonationService: ImpersonationService;
+    permissionService: PermissionReadPort;
+    auditLogService: AuditPort;
+    /**
+     * Exposed so a composition root can contribute `auditActorResolver` to
+     * `audit_logs` (feature 072, T084). That module used to be mounted from
+     * inside this plugin and reached `listByIds` directly; it owns its routes
+     * now, and identity lookup is the one thing it still wants from here.
+     */
+    adminUserService: AdminUserService;
+}
+/**
+ * Admin module composition root. Returns a handle so tests + production
+ * boot code can subscribe other modules to AuditPort etc.
+ */
+export declare function adminModule(options: AdminModuleOptions): {
+    plugin: (app: FastifyInstance) => Promise<void>;
+    handle: AdminModuleHandle;
+};
+//# sourceMappingURL=plugin.d.ts.map

package/dist/backend/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/backend/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EACV,aAAa,EACb,eAAe,EACf,uBAAuB,EACvB,YAAY,EACZ,uBAAuB,EACvB,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAIlE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AAEpF;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,aAAa,CAAC;IAC/B,6EAA6E;IAC7E,eAAe,EAAE,eAAe,CAAC;IACjC,eAAe,EAAE,SAAS,CAAC;IAC3B,wEAAwE;IACxE,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,gEAAgE;IAChE,uBAAuB,EAAE,uBAAuB,CAAC;IACjD;;;;;OAKG;IACH,aAAa,EAAE,aAAa,CAAC;IAC7B,qEAAqE;IACrE,uBAAuB,EAAE,uBAAuB,CAAC;IACjD,YAAY,EAAE,mBAAmB,CAAC;IAClC;uEACmE;IACnE,mBAAmB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,YAAY,GAAG,SAAS,CAAC;IACjD;;;;OAIG;IACH,mBAAmB,EAAE,wBAAwB,CAAC;CAC/C;AAED,MAAM,WAAW,iBAAiB;IAChC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,eAAe,EAAE,SAAS,CAAC;IAC3B;;;;;OAKG;IACH,gBAAgB,EAAE,gBAAgB,CAAC;CACpC;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,kBAAkB,GAC1B;IAAE,MAAM,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE,CAqDhF"}

package/dist/backend/plugin.js

@@ -0,0 +1,50 @@
+import { AdminAuthService } from './services/admin-auth-service.js';
+import { ImpersonationService } from './services/impersonation-service.js';
+import { AdminUserService } from './services/admin-user-service.js';
+import { registerAdminPublicRoutes } from './routes.public.js';
+import { registerImpersonationRoutes } from './routes.impersonation.js';
+import { registerAdminUsersAdminRoutes } from './routes.admin.js';
+/**
+ * Admin module composition root. Returns a handle so tests + production
+ * boot code can subscribe other modules to AuditPort etc.
+ */
+export function adminModule(options) {
+    const adminAuthService = new AdminAuthService(options.emFactory, options.authSessionPort, options.getMfaLoginPort, options.auditLogService);
+    const impersonationService = new ImpersonationService(options.emFactory, options.authSessionPort, options.customerAccountReadPort, options.auditLogService);
+    const adminUserService = new AdminUserService(options.emFactory, options.adminRolePort, options.authSessionPort, options.auditLogService);
+    const handle = {
+        adminAuthService,
+        impersonationService,
+        permissionService: options.permissionService,
+        auditLogService: options.auditLogService,
+        adminUserService,
+    };
+    return {
+        handle,
+        plugin: async (app) => {
+            await registerAdminPublicRoutes(app, {
+                adminAuthService,
+                twoFactorEnrolments: options.twoFactorEnrolments,
+            });
+            await registerImpersonationRoutes(app, {
+                impersonationService,
+                requireAdmin: options.requireAdmin,
+                // The production actor. This route used to read `request.testActor`
+                // and 401 whenever it was absent, which is every production request
+                // (feature 080, T051) — the module already had the right resolver in
+                // hand for `GET /admin/me`.
+                resolveAdminUserId: (req) => options.resolveAdminContext(req).adminUserId,
+            });
+            await registerAdminUsersAdminRoutes(app, {
+                adminUserService,
+                adminRolePort: options.adminRolePort,
+                permissionCataloguePort: options.permissionCataloguePort,
+                permissionService: options.permissionService,
+                requireAdmin: options.requireAdmin,
+                resolveAdminContext: options.resolveAdminContext,
+                twoFactorEnrolments: options.twoFactorEnrolments,
+            });
+        },
+    };
+}
+//# sourceMappingURL=plugin.js.map

package/dist/backend/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/backend/plugin.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAwDlE;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,OAA2B;IAE3B,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,eAAe,CACxB,CAAC;IACF,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,CACnD,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,uBAAuB,EAC/B,OAAO,CAAC,eAAe,CACxB,CAAC;IACF,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAC3C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,eAAe,EACvB,OAAO,CAAC,eAAe,CACxB,CAAC;IACF,MAAM,MAAM,GAAsB;QAChC,gBAAgB;QAChB,oBAAoB;QACpB,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,gBAAgB;KACjB,CAAC;IACF,OAAO;QACL,MAAM;QACN,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACpB,MAAM,yBAAyB,CAAC,GAAG,EAAE;gBACnC,gBAAgB;gBAChB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;aACjD,CAAC,CAAC;YACH,MAAM,2BAA2B,CAAC,GAAG,EAAE;gBACrC,oBAAoB;gBACpB,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,oEAAoE;gBACpE,oEAAoE;gBACpE,qEAAqE;gBACrE,4BAA4B;gBAC5B,kBAAkB,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,WAAW;aAC1E,CAAC,CAAC;YACH,MAAM,6BAA6B,CAAC,GAAG,EAAE;gBACvC,gBAAgB;gBAChB,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;gBACxD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;gBAChD,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;aACjD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/backend/routes.admin.d.ts

@@ -0,0 +1,32 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import { type AdminRolePort, type PermissionCataloguePort, type PermissionReadPort } from '@endora-commerce/contracts';
+import type { AdminUserService } from './services/admin-user-service.js';
+import type { TwoFactorEnrolmentReader } from './services/two-factor-enrolments.js';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+/**
+ * Admin user + role CRUD (T193 / FR-080..FR-083). All gated by
+ * `admin_users:manage`. The wildcard `*` is intentionally not exposed
+ * by this surface — bootstrap-only.
+ */
+export interface AdminUsersAdminDeps {
+    adminUserService: AdminUserService;
+    adminRolePort: AdminRolePort;
+    permissionCataloguePort: PermissionCataloguePort;
+    permissionService: PermissionReadPort;
+    requireAdmin: RequireAdminFactory;
+    /** Resolves the current admin's id — reads `request.actor` in production
+     *  and `request.testActor` under the test harness. */
+    resolveAdminContext: (req: FastifyRequest) => {
+        adminUserId: string;
+    };
+    /**
+     * `mfa`'s answer to "which of these admins hold a second factor", already
+     * narrowed to this module's subject type. `twoFactorEnabled` used to be
+     * `!!u.twoFactorConfirmedAt` — a column on this module's own table that has
+     * never been written — so the 2FA column on `/admin-users` read `—` for an
+     * admin who had enrolled an hour earlier.
+     */
+    twoFactorEnrolments: TwoFactorEnrolmentReader;
+}
+export declare function registerAdminUsersAdminRoutes(app: FastifyInstance, deps: AdminUsersAdminDeps): Promise<void>;
+//# sourceMappingURL=routes.admin.d.ts.map

package/dist/backend/routes.admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.d.ts","sourceRoot":"","sources":["../../src/backend/routes.admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAML,KAAK,aAAa,EAElB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAEzE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAE5E;;;;GAIG;AAEH,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,aAAa,EAAE,aAAa,CAAC;IAC7B,uBAAuB,EAAE,uBAAuB,CAAC;IACjD,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,YAAY,EAAE,mBAAmB,CAAC;IAClC;0DACsD;IACtD,mBAAmB,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK;QAAE,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IACtE;;;;;;OAMG;IACH,mBAAmB,EAAE,wBAAwB,CAAC;CAC/C;AAED,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,IAAI,CAAC,CAiOf"}

package/dist/backend/routes.admin.js

@@ -0,0 +1,192 @@
+import { createAdminUserRequestSchema, resetAdminUserPasswordRequestSchema, updateAdminUserRequestSchema, updateAdminUserSelfRequestSchema, upsertAdminRoleRequestSchema, } from '@endora-commerce/contracts';
+export async function registerAdminUsersAdminRoutes(app, deps) {
+    const { adminUserService, adminRolePort, permissionCataloguePort, permissionService, requireAdmin, resolveAdminContext, twoFactorEnrolments, } = deps;
+    /** One `mfa` read per response, whether the response carries one admin or a page. */
+    async function serializeAdminUsers(users) {
+        if (users.length === 0)
+            return [];
+        const enrolled = await twoFactorEnrolments(users.map((u) => u.id));
+        return users.map((u) => serializeAdminUser(u, enrolled.has(u.id)));
+    }
+    async function serializeOneAdminUser(user) {
+        return (await serializeAdminUsers([user]))[0];
+    }
+    // --- Current admin (for the UI auth gate) ---------------------------------
+    app.get('/api/v1/admin/me', { preHandler: requireAdmin() }, async (request) => {
+        const ctx = resolveAdminContext(request);
+        const adminUser = await adminUserService.getById(ctx.adminUserId);
+        const permissions = await permissionService.listPermissions(adminUser.id);
+        // No `.catch(() => null)` around the port call (feature 075, Phase C,
+        // FR-032): it would swallow `ModuleDisabledError` and answer "this admin
+        // has no role" for "`admin_roles` is not here", which is the fail-open
+        // the gate exists to prevent. Nothing is lost by dropping it —
+        // `admin_users_admin_role_fk` is `on delete restrict`
+        // (`migrations/20260425T053028_admin_users_init.ts:41`), so a non-null
+        // `adminRoleId` always names a live role.
+        const role = adminUser.adminRoleId
+            ? await adminRolePort.getById(adminUser.adminRoleId)
+            : null;
+        return {
+            data: {
+                adminUser: await serializeOneAdminUser(adminUser),
+                role: role ? serializeAdminRole(role) : null,
+                permissions,
+            },
+        };
+    });
+    // --- Self profile edit ------------------------------------------------------
+    // Any authenticated admin can edit their own first/last name and rotate
+    // their password without holding `admin_users:manage`. Role + status
+    // changes are intentionally NOT exposed here.
+    app.patch('/api/v1/admin/me', {
+        preHandler: requireAdmin(),
+        schema: { body: updateAdminUserSelfRequestSchema },
+    }, async (request) => {
+        const ctx = resolveAdminContext(request);
+        const body = updateAdminUserSelfRequestSchema.parse(request.body);
+        const user = await adminUserService.update(ctx.adminUserId, {
+            ...(body.firstName !== undefined ? { firstName: body.firstName } : {}),
+            ...(body.lastName !== undefined ? { lastName: body.lastName } : {}),
+            ...(body.password !== undefined ? { password: body.password } : {}),
+        });
+        return { data: await serializeOneAdminUser(user) };
+    });
+    // --- Permissions catalogue -------------------------------------------------
+    app.get('/api/v1/admin/permissions', { preHandler: requireAdmin('admin_users:manage') }, async () => ({ data: permissionCataloguePort.listAssignable() }));
+    // --- Admin users -----------------------------------------------------------
+    app.get('/api/v1/admin/admin-users', { preHandler: requireAdmin('admin_users:manage') }, async (request) => {
+        const q = (request.query ?? {});
+        const search = q['q']?.trim();
+        const result = await adminUserService.list({
+            ...(search ? { q: search } : {}),
+            ...(q['page'] ? { page: Number.parseInt(q['page'], 10) } : {}),
+            ...(q['pageSize'] ? { pageSize: Number.parseInt(q['pageSize'], 10) } : {}),
+        });
+        return {
+            data: await serializeAdminUsers(result.items),
+            pagination: {
+                page: result.page,
+                pageSize: result.pageSize,
+                total: result.total,
+                cursor: null,
+                hasMore: (result.page + 1) * result.pageSize < result.total,
+                limit: result.items.length,
+            },
+        };
+    });
+    app.post('/api/v1/admin/admin-users', {
+        preHandler: requireAdmin('admin_users:manage'),
+        schema: { body: createAdminUserRequestSchema },
+    }, async (request, reply) => {
+        const body = createAdminUserRequestSchema.parse(request.body);
+        const user = await adminUserService.create({
+            email: body.email,
+            password: body.password,
+            firstName: body.firstName,
+            lastName: body.lastName,
+            ...(body.adminRoleId !== undefined ? { adminRoleId: body.adminRoleId } : {}),
+        });
+        reply.status(201);
+        return { data: await serializeOneAdminUser(user) };
+    });
+    app.patch('/api/v1/admin/admin-users/:id', {
+        preHandler: requireAdmin('admin_users:manage'),
+        schema: { body: updateAdminUserRequestSchema },
+    }, async (request) => {
+        const body = updateAdminUserRequestSchema.parse(request.body);
+        const user = await adminUserService.update(request.params.id, {
+            ...(body.firstName !== undefined ? { firstName: body.firstName } : {}),
+            ...(body.lastName !== undefined ? { lastName: body.lastName } : {}),
+            ...(body.adminRoleId !== undefined ? { adminRoleId: body.adminRoleId } : {}),
+            ...(body.status !== undefined ? { status: body.status } : {}),
+        });
+        return { data: await serializeOneAdminUser(user) };
+    });
+    // --- Peer password reset (issue #252) ---------------------------------------
+    //
+    // The capability `admin_users`' manifest has always promised. Gated by
+    // `admin_users:manage`, the same code that already gates creating an admin
+    // user and assigning it any role — including the role holding `*`. A
+    // narrower code would be absent from every role on every deployment that
+    // exists today, so shipping one would leave the lockout it closes open until
+    // somebody with `*` edited the roles, which is the bootstrap problem again.
+    //
+    // An operator holding the code may target themselves. There is no role
+    // hierarchy here to rank a reset against, and the same code already assigns
+    // any role including the one holding `*`, so a self-target guard would close
+    // nothing — while making this route disagree with the e-mail-keyed flow that
+    // follows, which is self-targeted by construction.
+    //
+    // Own path rather than a `password` field on the PATCH: setting a password
+    // has its own audit action and revokes the target's sessions, and a request
+    // that renamed and reset in one call would have to answer for both.
+    // `/password-reset` is deliberately left free for the e-mail-keyed flow that
+    // follows, so the two never collide on one verb — this one **sets** a
+    // password, that one will **send** a link, exactly as
+    // `POST /api/v1/admin/customers/:id/password-reset` already does.
+    app.post('/api/v1/admin/admin-users/:id/password', {
+        preHandler: requireAdmin('admin_users:manage'),
+        schema: { body: resetAdminUserPasswordRequestSchema },
+    }, async (request) => {
+        const body = resetAdminUserPasswordRequestSchema.parse(request.body);
+        const user = await adminUserService.resetPassword(request.params.id, body.password);
+        return { data: await serializeOneAdminUser(user) };
+    });
+    app.delete('/api/v1/admin/admin-users/:id', { preHandler: requireAdmin('admin_users:manage') }, async (request, reply) => {
+        await adminUserService.softDelete(request.params.id);
+        return reply.status(204).send();
+    });
+    // --- Admin roles -----------------------------------------------------------
+    app.get('/api/v1/admin/admin-roles', { preHandler: requireAdmin('admin_users:manage') }, async () => {
+        const rows = await adminRolePort.list();
+        return { data: rows.map(serializeAdminRole) };
+    });
+    app.put('/api/v1/admin/admin-roles/:code', {
+        preHandler: requireAdmin('admin_users:manage'),
+        schema: { body: upsertAdminRoleRequestSchema },
+    }, async (request) => {
+        const body = upsertAdminRoleRequestSchema.parse(request.body);
+        const role = await adminRolePort.upsertByCode({
+            code: request.params.code,
+            name: body.name,
+            permissions: body.permissions,
+            ...(body.requiresTwoFactor !== undefined
+                ? { requiresTwoFactor: body.requiresTwoFactor }
+                : {}),
+        });
+        return { data: serializeAdminRole(role) };
+    });
+    app.delete('/api/v1/admin/admin-roles/:id', { preHandler: requireAdmin('admin_users:manage') }, async (request, reply) => {
+        await adminRolePort.remove(request.params.id);
+        return reply.status(204).send();
+    });
+}
+function serializeAdminUser(u, twoFactorEnabled) {
+    return {
+        id: u.id,
+        email: u.email,
+        firstName: u.firstName,
+        lastName: u.lastName,
+        adminRoleId: u.adminRoleId ?? null,
+        twoFactorEnabled,
+        status: u.status,
+        // Feature 019: surface the per-user Admin UI language preference so the
+        // SPA's TranslationProvider can seed itself without a separate fetch.
+        preferredLanguage: u.preferredLanguage ?? null,
+        lastLoginAt: u.lastLoginAt?.toISOString() ?? null,
+        createdAt: u.createdAt.toISOString(),
+        updatedAt: u.updatedAt.toISOString(),
+    };
+}
+function serializeAdminRole(r) {
+    return {
+        id: r.id,
+        code: r.code,
+        name: r.name,
+        permissions: r.permissions,
+        requiresTwoFactor: r.requiresTwoFactor,
+        createdAt: r.createdAt.toISOString(),
+        updatedAt: r.updatedAt.toISOString(),
+    };
+}
+//# sourceMappingURL=routes.admin.js.map

package/dist/backend/routes.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.js","sourceRoot":"","sources":["../../src/backend/routes.admin.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,EAC5B,mCAAmC,EACnC,4BAA4B,EAC5B,gCAAgC,EAChC,4BAA4B,GAK7B,MAAM,4BAA4B,CAAC;AA+BpC,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,GAAoB,EACpB,IAAyB;IAEzB,MAAM,EACJ,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,iBAAiB,EACjB,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,GACpB,GAAG,IAAI,CAAC;IAET,qFAAqF;IACrF,KAAK,UAAU,mBAAmB,CAAC,KAA2B;QAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,KAAK,UAAU,qBAAqB,CAAC,IAAe;QAClD,OAAO,CAAC,MAAM,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;IACjD,CAAC;IAED,6EAA6E;IAC7E,GAAG,CAAC,GAAG,CACL,kBAAkB,EAClB,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,EAC9B,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAClE,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC1E,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,+DAA+D;QAC/D,sDAAsD;QACtD,uEAAuE;QACvE,0CAA0C;QAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW;YAChC,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC;YACpD,CAAC,CAAC,IAAI,CAAC;QACT,OAAO;YACL,IAAI,EAAE;gBACJ,SAAS,EAAE,MAAM,qBAAqB,CAAC,SAAS,CAAC;gBACjD,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBAC5C,WAAW;aACZ;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,+EAA+E;IAC/E,wEAAwE;IACxE,qEAAqE;IACrE,8CAA8C;IAC9C,GAAG,CAAC,KAAK,CACP,kBAAkB,EAClB;QACE,UAAU,EAAE,YAAY,EAAE;QAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE;KACnD,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,gCAAgC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE;YAC1D,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;IACrD,CAAC,CACF,CAAC;IAEF,8EAA8E;IAC9E,GAAG,CAAC,GAAG,CACL,2BAA2B,EAC3B,EAAE,UAAU,EAAE,YAAY,CAAC,oBAAoB,CAAC,EAAE,EAClD,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,uBAAuB,CAAC,cAAc,EAAE,EAAE,CAAC,CACjE,CAAC;IAEF,8EAA8E;IAC9E,GAAG,CAAC,GAAG,CACL,2BAA2B,EAC3B,EAAE,UAAU,EAAE,YAAY,CAAC,oBAAoB,CAAC,EAAE,EAClD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAuC,CAAC;QACtE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC;YACzC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,CAAC,CAAC;QACH,OAAO;YACL,IAAI,EAAE,MAAM,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC;YAC7C,UAAU,EAAE;gBACV,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,KAAK;gBAC3D,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;aAC3B;SACF,CAAC;IACJ,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,2BAA2B,EAC3B;QACE,UAAU,EAAE,YAAY,CAAC,oBAAoB,CAAC;QAC9C,MAAM,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE;KAC/C,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC;YACzC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;IACrD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,KAAK,CACP,+BAA+B,EAC/B;QACE,UAAU,EAAE,YAAY,CAAC,oBAAoB,CAAC;QAC9C,MAAM,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE;KAC/C,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE;YAC5D,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;IACrD,CAAC,CACF,CAAC;IAEF,+EAA+E;IAC/E,EAAE;IACF,uEAAuE;IACvE,2EAA2E;IAC3E,qEAAqE;IACrE,yEAAyE;IACzE,6EAA6E;IAC7E,4EAA4E;IAC5E,EAAE;IACF,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,mDAAmD;IACnD,EAAE;IACF,2EAA2E;IAC3E,4EAA4E;IAC5E,oEAAoE;IACpE,6EAA6E;IAC7E,sEAAsE;IACtE,sDAAsD;IACtD,kEAAkE;IAClE,GAAG,CAAC,IAAI,CACN,wCAAwC,EACxC;QACE,UAAU,EAAE,YAAY,CAAC,oBAAoB,CAAC;QAC9C,MAAM,EAAE,EAAE,IAAI,EAAE,mCAAmC,EAAE;KACtD,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,mCAAmC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpF,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;IACrD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,+BAA+B,EAC/B,EAAE,UAAU,EAAE,YAAY,CAAC,oBAAoB,CAAC,EAAE,EAClD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,gBAAgB,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC,CACF,CAAC;IAEF,8EAA8E;IAC9E,GAAG,CAAC,GAAG,CACL,2BAA2B,EAC3B,EAAE,UAAU,EAAE,YAAY,CAAC,oBAAoB,CAAC,EAAE,EAClD,KAAK,IAAI,EAAE;QACT,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;IAChD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,iCAAiC,EACjC;QACE,UAAU,EAAE,YAAY,CAAC,oBAAoB,CAAC;QAC9C,MAAM,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE;KAC/C,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC;YAC5C,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;IAC5C,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,+BAA+B,EAC/B,EAAE,UAAU,EAAE,YAAY,CAAC,oBAAoB,CAAC,EAAE,EAClD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAY,EAAE,gBAAyB;IACjE,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;QAClC,gBAAgB;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,wEAAwE;QACxE,sEAAsE;QACtE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,IAAI,IAAI;QAC9C,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,IAAI,IAAI;QACjD,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAkB;IAC5C,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;QACtC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;QACpC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;KACrC,CAAC;AACJ,CAAC"}

package/dist/backend/routes.impersonation.d.ts

@@ -0,0 +1,25 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import type { ImpersonationService } from './services/impersonation-service.js';
+import type { RequireAdminFactory } from '@endora-commerce/platform/kernel';
+export interface ImpersonationDeps {
+    impersonationService: ImpersonationService;
+    requireAdmin: RequireAdminFactory;
+    /**
+     * The acting admin's id, resolved from the request the
+     * `requireAdmin('customers:impersonate')` guard has already accepted.
+     *
+     * It used to be read here from `request.testActor`, narrowed through
+     * `http/test-actor-carrier` — a file `contracts/host-package.md` §1.4j
+     * classifies **A**, because it exists to keep this repository's test-harness
+     * Fastify augmentation out of production code and an installed package has no
+     * relationship to that harness. Nothing under `src/` writes that field, so the
+     * inline check answered `401 Admin session required` to every production
+     * request while the guard in front of it was doing the real gating.
+     *
+     * Both composition roots supply it from `adminContextResolver`, which reads
+     * the production actor and throws 401 for a non-admin.
+     */
+    resolveAdminUserId: (request: FastifyRequest) => string;
+}
+export declare function registerImpersonationRoutes(app: FastifyInstance, deps: ImpersonationDeps): Promise<void>;
+//# sourceMappingURL=routes.impersonation.d.ts.map

package/dist/backend/routes.impersonation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.impersonation.d.ts","sourceRoot":"","sources":["../../src/backend/routes.impersonation.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAgB,cAAc,EAAE,MAAM,SAAS,CAAC;AAQ7E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAChF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAiB5E,MAAM,WAAW,iBAAiB;IAChC,oBAAoB,EAAE,oBAAoB,CAAC;IAC3C,YAAY,EAAE,mBAAmB,CAAC;IAClC;;;;;;;;;;;;;;OAcG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,MAAM,CAAC;CACzD;AAED,wBAAsB,2BAA2B,CAC/C,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC,CAqFf"}