@endora-commerce/mod-admin-users 0.100.0

package/dist/backend/services/admin-user-service.d.ts

@@ -0,0 +1,134 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { type AdminRolePort, type AuthSessionPort } from '@endora-commerce/contracts';
+import { AdminUser } from '../entities/admin-user.entity.js';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+/**
+ * AdminUserService (T193 / FR-080..FR-083). Backs the admin panel's
+ * Users & Roles module. Mutations are gated by `admin_users:manage` at the
+ * route layer; this service trusts the caller and focuses on data integrity:
+ *
+ *   - email uniqueness (DB partial unique enforces, mapped to 409)
+ *   - role existence on assignment
+ *   - password rehash on create, on self-rotation, and on a peer reset
+ *   - soft delete via `deletedAt`; status flip is the everyday lever
+ */
+export interface CreateAdminUserInput {
+    email: string;
+    password: string;
+    firstName: string;
+    lastName: string;
+    adminRoleId?: string | null;
+}
+export interface UpdateAdminUserInput {
+    firstName?: string;
+    lastName?: string;
+    adminRoleId?: string | null;
+    status?: 'active' | 'inactive';
+    /** Optional password rotation. When supplied the value is hashed
+     *  before being persisted. */
+    password?: string;
+}
+export interface ListAdminUsersOptions {
+    /** Case-insensitive substring on first name, last name, and email. Trimmed. */
+    q?: string;
+    /** Zero-indexed page (matches the catalog admin convention). */
+    page?: number;
+    /** Page size. Default 50, max 200. */
+    pageSize?: number;
+}
+export interface ListAdminUsersResult {
+    items: AdminUser[];
+    page: number;
+    pageSize: number;
+    total: number;
+}
+export declare class AdminUserService {
+    #private;
+    private readonly emFactory;
+    /**
+     * `admin_roles`' published role surface (feature 075, Phase C). The role
+     * a user is assigned to belongs to that module, so "does this role exist?"
+     * is its question and not a second `em.findOne` against its table.
+     */
+    private readonly adminRoles;
+    /**
+     * `auth`'s session surface (feature 075, Phase C). A password write has to
+     * be able to withdraw the sessions the old password minted, and those rows
+     * belong to `auth`.
+     */
+    private readonly sessions;
+    private readonly auditLog?;
+    constructor(emFactory: () => EntityManager, 
+    /**
+     * `admin_roles`' published role surface (feature 075, Phase C). The role
+     * a user is assigned to belongs to that module, so "does this role exist?"
+     * is its question and not a second `em.findOne` against its table.
+     */
+    adminRoles: AdminRolePort, 
+    /**
+     * `auth`'s session surface (feature 075, Phase C). A password write has to
+     * be able to withdraw the sessions the old password minted, and those rows
+     * belong to `auth`.
+     */
+    sessions: AuthSessionPort, auditLog?: AuditPort | undefined);
+    /**
+     * List non-deleted admin users with optional substring search and offset
+     * pagination. When `q` is provided, results are ordered by a relevance
+     * CASE: first-name prefix > first-name contains > last-name prefix >
+     * last-name contains > email prefix > email contains, then by email.
+     * When `q` is empty, results are ordered by email ASC (legacy default).
+     *
+     * Note: search is case-insensitive but NOT diacritic-insensitive on the
+     * server side — Postgres `unaccent` is not enabled in this codebase. The
+     * admin Combobox handles diacritic folding client-side when `manualFilter`
+     * is off; the server falls back to plain `LOWER(...) LIKE`. If a future
+     * picker (customers, products) needs diacritic-insensitive server search,
+     * add `unaccent` via a migration.
+     */
+    list(options?: ListAdminUsersOptions): Promise<ListAdminUsersResult>;
+    getById(id: string): Promise<AdminUser>;
+    /**
+     * Batch lookup for display enrichment (e.g. the audit-log actor column):
+     * returns the found admin users for the given ids, tolerating unknown or
+     * soft-deleted ids (they are simply omitted). Order is not guaranteed.
+     */
+    listByIds(ids: string[]): Promise<AdminUser[]>;
+    create(input: CreateAdminUserInput): Promise<AdminUser>;
+    update(id: string, input: UpdateAdminUserInput): Promise<AdminUser>;
+    /**
+     * Set an admin user's password on someone else's authority — issue #252.
+     *
+     * This is the module's password-write seam, and it is written to be the only
+     * one: the e-mail-keyed self-service reset that follows the packaging
+     * programme differs in **who is authorised** (a token instead of a peer's
+     * `admin_users:manage`), not in what the write does. It calls this.
+     *
+     * Two things happen, in this order:
+     *
+     *  1. every session the target holds is revoked, and
+     *  2. the new hash is persisted with an `admin_user.change_password` audit
+     *     row that records the target and the route taken — never the password
+     *     and never its hash.
+     *
+     * The revocation runs **before** the flush on purpose. It reaches another
+     * module, so it can refuse; refusing first means the reset either takes
+     * effect whole or not at all, where a flush-then-revoke order could leave a
+     * changed password with the old password's sessions still answering. A
+     * revocation that succeeded over a flush that then failed only signs the
+     * target out, which their existing password undoes.
+     *
+     * No `catch` around the port call: an operator told "reset" while the old
+     * sessions kept working would be told something false.
+     */
+    resetPassword(id: string, newPassword: string): Promise<AdminUser>;
+    softDelete(id: string): Promise<void>;
+    /**
+     * Set (or revert) an admin user's preferred Admin UI language —
+     * feature 019 / FR-002, FR-004, FR-006. Validation against the
+     * supported allowlist lives at the route boundary so this method
+     * trusts its input. Passing `null` reverts to the platform default
+     * ("no preference saved" → resolver treats as English).
+     */
+    setPreferredLanguage(id: string, preferredLanguage: string | null): Promise<AdminUser>;
+}
+//# sourceMappingURL=admin-user-service.d.ts.map

package/dist/backend/services/admin-user-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-user-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/admin-user-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,eAAe,EACrB,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAE7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAElE;;;;;;;;;GASG;AAEH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;IAC/B;kCAC8B;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,+EAA+E;IAC/E,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,SAAS,EAAE,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,qBAAa,gBAAgB;;IAEzB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAbT,SAAS,EAAE,MAAM,aAAa;IAC/C;;;;OAIG;IACc,UAAU,EAAE,aAAa;IAC1C;;;;OAIG;IACc,QAAQ,EAAE,eAAe,EACzB,QAAQ,CAAC,EAAE,SAAS,YAAA;IASvC;;;;;;;;;;;;;OAaG;IACG,IAAI,CAAC,OAAO,GAAE,qBAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA6DxE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAO7C;;;;OAIG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAO9C,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC;IA4BvD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC;IAkBzE;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAgBlE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS3C;;;;;;OAMG;IACG,oBAAoB,CACxB,EAAE,EAAE,MAAM,EACV,iBAAiB,EAAE,MAAM,GAAG,IAAI,GAC/B,OAAO,CAAC,SAAS,CAAC;CAwBtB"}

package/dist/backend/services/admin-user-service.js

@@ -0,0 +1,241 @@
+import { UniqueConstraintViolationException } from '@mikro-orm/core';
+import { ERROR_CODES, normalizeEmailAddress, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { hashPassword } from '@endora-commerce/platform/kernel';
+import { AdminUser } from '../entities/admin-user.entity.js';
+import { recordAuditFromContext } from '@endora-commerce/platform/commands';
+export class AdminUserService {
+    emFactory;
+    adminRoles;
+    sessions;
+    auditLog;
+    constructor(emFactory, 
+    /**
+     * `admin_roles`' published role surface (feature 075, Phase C). The role
+     * a user is assigned to belongs to that module, so "does this role exist?"
+     * is its question and not a second `em.findOne` against its table.
+     */
+    adminRoles, 
+    /**
+     * `auth`'s session surface (feature 075, Phase C). A password write has to
+     * be able to withdraw the sessions the old password minted, and those rows
+     * belong to `auth`.
+     */
+    sessions, auditLog) {
+        this.emFactory = emFactory;
+        this.adminRoles = adminRoles;
+        this.sessions = sessions;
+        this.auditLog = auditLog;
+    }
+    #audit(em, action, objectId, stateBefore, stateAfter) {
+        if (this.auditLog) {
+            recordAuditFromContext(this.auditLog, em, { action, objectType: 'admin_user', objectId, stateBefore, stateAfter });
+        }
+    }
+    /**
+     * List non-deleted admin users with optional substring search and offset
+     * pagination. When `q` is provided, results are ordered by a relevance
+     * CASE: first-name prefix > first-name contains > last-name prefix >
+     * last-name contains > email prefix > email contains, then by email.
+     * When `q` is empty, results are ordered by email ASC (legacy default).
+     *
+     * Note: search is case-insensitive but NOT diacritic-insensitive on the
+     * server side — Postgres `unaccent` is not enabled in this codebase. The
+     * admin Combobox handles diacritic folding client-side when `manualFilter`
+     * is off; the server falls back to plain `LOWER(...) LIKE`. If a future
+     * picker (customers, products) needs diacritic-insensitive server search,
+     * add `unaccent` via a migration.
+     */
+    async list(options = {}) {
+        const em = this.emFactory();
+        const page = Math.max(0, options.page ?? 0);
+        const pageSize = Math.min(Math.max(1, options.pageSize ?? 50), 200);
+        const trimmedQ = options.q?.trim() ?? '';
+        if (trimmedQ === '') {
+            const [items, total] = await em.findAndCount(AdminUser, { deletedAt: null }, { orderBy: { email: 'asc' }, offset: page * pageSize, limit: pageSize });
+            return { items, page, pageSize, total };
+        }
+        const knex = em.getKnex();
+        const needle = trimmedQ.toLowerCase();
+        const prefix = `${needle}%`;
+        const contains = `%${needle}%`;
+        const baseQuery = knex('admin_users')
+            .whereNull('deleted_at')
+            .andWhere((qb) => {
+            qb.whereRaw('LOWER("first_name") LIKE ?', [contains])
+                .orWhereRaw('LOWER("last_name") LIKE ?', [contains])
+                .orWhereRaw('LOWER("email") LIKE ?', [contains]);
+        });
+        const totalRow = (await baseQuery
+            .clone()
+            .count('* as count')
+            .first());
+        const total = Number(totalRow?.count ?? 0);
+        const idRows = (await baseQuery
+            .clone()
+            .select('id')
+            .orderByRaw(`CASE
+           WHEN LOWER("first_name") LIKE ? THEN 1
+           WHEN LOWER("first_name") LIKE ? THEN 2
+           WHEN LOWER("last_name")  LIKE ? THEN 3
+           WHEN LOWER("last_name")  LIKE ? THEN 4
+           WHEN LOWER("email")      LIKE ? THEN 5
+           WHEN LOWER("email")      LIKE ? THEN 6
+           ELSE 7
+         END ASC, "email" ASC`, [prefix, contains, prefix, contains, prefix, contains])
+            .offset(page * pageSize)
+            .limit(pageSize));
+        const ids = idRows.map((r) => r.id);
+        if (ids.length === 0)
+            return { items: [], page, pageSize, total };
+        const found = await em.find(AdminUser, { id: { $in: ids } });
+        // Preserve the SQL ordering — `find` with `$in` returns arbitrary order.
+        const byId = new Map(found.map((u) => [u.id, u]));
+        const items = ids.map((id) => byId.get(id)).filter((u) => Boolean(u));
+        return { items, page, pageSize, total };
+    }
+    async getById(id) {
+        const em = this.emFactory();
+        const row = await em.findOne(AdminUser, { id, deletedAt: null });
+        if (!row)
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'Admin user not found.');
+        return row;
+    }
+    /**
+     * Batch lookup for display enrichment (e.g. the audit-log actor column):
+     * returns the found admin users for the given ids, tolerating unknown or
+     * soft-deleted ids (they are simply omitted). Order is not guaranteed.
+     */
+    async listByIds(ids) {
+        const unique = [...new Set(ids.filter(Boolean))];
+        if (unique.length === 0)
+            return [];
+        const em = this.emFactory();
+        return em.find(AdminUser, { id: { $in: unique } });
+    }
+    async create(input) {
+        const em = this.emFactory();
+        if (input.adminRoleId)
+            await this.#assertRoleExists(input.adminRoleId);
+        const passwordHash = await hashPassword(input.password);
+        const user = em.create(AdminUser, {
+            email: normalizeEmailAddress(input.email),
+            passwordHash,
+            firstName: input.firstName,
+            lastName: input.lastName,
+            ...(input.adminRoleId ? { adminRoleId: input.adminRoleId } : {}),
+            status: 'active',
+        });
+        this.#audit(em, 'admin_user.create', user.id, null, { email: user.email });
+        try {
+            await em.persistAndFlush(user);
+        }
+        catch (err) {
+            if (err instanceof UniqueConstraintViolationException) {
+                throw new HttpError(409, ERROR_CODES.EMAIL_ALREADY_REGISTERED, 'An admin user with that email already exists.');
+            }
+            throw err;
+        }
+        return user;
+    }
+    async update(id, input) {
+        const em = this.emFactory();
+        const user = await this.#getByIdOn(em, id);
+        if (input.adminRoleId !== undefined) {
+            if (input.adminRoleId !== null)
+                await this.#assertRoleExists(input.adminRoleId);
+            user.adminRoleId = input.adminRoleId;
+        }
+        if (input.firstName !== undefined)
+            user.firstName = input.firstName;
+        if (input.lastName !== undefined)
+            user.lastName = input.lastName;
+        if (input.status !== undefined)
+            user.status = input.status;
+        if (input.password !== undefined) {
+            user.passwordHash = await hashPassword(input.password);
+        }
+        this.#audit(em, 'admin_user.update', user.id, null, { email: user.email, status: user.status });
+        await em.flush();
+        return user;
+    }
+    /**
+     * Set an admin user's password on someone else's authority — issue #252.
+     *
+     * This is the module's password-write seam, and it is written to be the only
+     * one: the e-mail-keyed self-service reset that follows the packaging
+     * programme differs in **who is authorised** (a token instead of a peer's
+     * `admin_users:manage`), not in what the write does. It calls this.
+     *
+     * Two things happen, in this order:
+     *
+     *  1. every session the target holds is revoked, and
+     *  2. the new hash is persisted with an `admin_user.change_password` audit
+     *     row that records the target and the route taken — never the password
+     *     and never its hash.
+     *
+     * The revocation runs **before** the flush on purpose. It reaches another
+     * module, so it can refuse; refusing first means the reset either takes
+     * effect whole or not at all, where a flush-then-revoke order could leave a
+     * changed password with the old password's sessions still answering. A
+     * revocation that succeeded over a flush that then failed only signs the
+     * target out, which their existing password undoes.
+     *
+     * No `catch` around the port call: an operator told "reset" while the old
+     * sessions kept working would be told something false.
+     */
+    async resetPassword(id, newPassword) {
+        const em = this.emFactory();
+        const user = await this.#getByIdOn(em, id);
+        // Hashed before the revocation so the window between "signed out" and
+        // "new password live" is not an argon2 pass wide.
+        const passwordHash = await hashPassword(newPassword);
+        await this.sessions.destroyAllForAdmin(user.id);
+        user.passwordHash = passwordHash;
+        this.#audit(em, 'admin_user.change_password', user.id, null, {
+            email: user.email,
+            via: 'peer_reset',
+        });
+        await em.flush();
+        return user;
+    }
+    async softDelete(id) {
+        const em = this.emFactory();
+        const user = await this.#getByIdOn(em, id);
+        user.deletedAt = new Date();
+        user.status = 'inactive';
+        this.#audit(em, 'admin_user.delete', user.id, { email: user.email }, null);
+        await em.flush();
+    }
+    /**
+     * Set (or revert) an admin user's preferred Admin UI language —
+     * feature 019 / FR-002, FR-004, FR-006. Validation against the
+     * supported allowlist lives at the route boundary so this method
+     * trusts its input. Passing `null` reverts to the platform default
+     * ("no preference saved" → resolver treats as English).
+     */
+    async setPreferredLanguage(id, preferredLanguage) {
+        // command-coverage-ignore: per-admin Admin-UI language preference — personal
+        // UI setting, not an audited domain-state mutation.
+        const em = this.emFactory();
+        const user = await this.#getByIdOn(em, id);
+        user.preferredLanguage = preferredLanguage;
+        await em.flush();
+        return user;
+    }
+    async #getByIdOn(em, id) {
+        const row = await em.findOne(AdminUser, { id, deletedAt: null });
+        if (!row)
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'Admin user not found.');
+        return row;
+    }
+    /**
+     * `getById` raises the same 404 `Admin role not found.` this method used to
+     * raise itself, so no `catch` is wanted and none is written: an absent
+     * `admin_roles` must refuse the assignment, not let it through unvalidated.
+     */
+    async #assertRoleExists(id) {
+        await this.adminRoles.getById(id);
+    }
+}
+//# sourceMappingURL=admin-user-service.js.map

package/dist/backend/services/admin-user-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-user-service.js","sourceRoot":"","sources":["../../../src/backend/services/admin-user-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kCAAkC,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,EACL,WAAW,EACX,qBAAqB,GAGtB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAgD5E,MAAM,OAAO,gBAAgB;IAER;IAMA;IAMA;IACA;IAdnB,YACmB,SAA8B;IAC/C;;;;OAIG;IACc,UAAyB;IAC1C;;;;OAIG;IACc,QAAyB,EACzB,QAAoB;QAbpB,cAAS,GAAT,SAAS,CAAqB;QAM9B,eAAU,GAAV,UAAU,CAAe;QAMzB,aAAQ,GAAR,QAAQ,CAAiB;QACzB,aAAQ,GAAR,QAAQ,CAAY;IACpC,CAAC;IAEJ,MAAM,CAAC,EAAiB,EAAE,MAAc,EAAE,QAAgB,EAAE,WAA2C,EAAE,UAA0C;QACjJ,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,sBAAsB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC;QACrH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,IAAI,CAAC,UAAiC,EAAE;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAEzC,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YACpB,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,YAAY,CAC1C,SAAS,EACT,EAAE,SAAS,EAAE,IAAI,EAAE,EACnB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,GAAG,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,CACxE,CAAC;YACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,MAAM,GAAG,CAAC;QAE/B,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC;aAClC,SAAS,CAAC,YAAY,CAAC;aACvB,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE;YACf,EAAE,CAAC,QAAQ,CAAC,4BAA4B,EAAE,CAAC,QAAQ,CAAC,CAAC;iBAClD,UAAU,CAAC,2BAA2B,EAAE,CAAC,QAAQ,CAAC,CAAC;iBACnD,UAAU,CAAC,uBAAuB,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEL,MAAM,QAAQ,GAAG,CAAC,MAAM,SAAS;aAC9B,KAAK,EAAE;aACP,KAAK,CAA6B,YAAY,CAAC;aAC/C,KAAK,EAAE,CAA2C,CAAC;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS;aAC5B,KAAK,EAAE;aACP,MAAM,CAAC,IAAI,CAAC;aACZ,UAAU,CACT;;;;;;;;8BAQsB,EACtB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CACvD;aACA,MAAM,CAAC,IAAI,GAAG,QAAQ,CAAC;aACvB,KAAK,CAAC,QAAQ,CAAC,CAA0B,CAAC;QAE7C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAClE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,yEAAyE;QACzE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAkB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QACnF,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,GAAa;QAC3B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA2B;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,WAAW;YAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACvE,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE;YAChC,KAAK,EAAE,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC;YACzC,YAAY;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,kCAAkC,EAAE,CAAC;gBACtD,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,wBAAwB,EACpC,+CAA+C,CAChD,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAA2B;QAClD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI;gBAAE,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAChF,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;QACvC,CAAC;QACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QACpE,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QACjE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3D,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,YAAY,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAChG,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,WAAmB;QACjD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,sEAAsE;QACtE,kDAAkD;QAClD,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,4BAA4B,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE;YAC3D,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,YAAY;SAClB,CAAC,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;QACzB,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3E,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CACxB,EAAU,EACV,iBAAgC;QAEhC,6EAA6E;QAC7E,oDAAoD;QACpD,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,iBAAiB,GAAG,iBAAiB,CAAC;QAC3C,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAiB,EAAE,EAAU;QAC5C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QACnF,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CAAC,EAAU;QAChC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;CACF"}

package/dist/backend/services/impersonation-service.d.ts

@@ -0,0 +1,65 @@
+import type { EntityManager } from '@mikro-orm/postgresql';
+import { type AuthSessionPort, type CustomerAccountReadPort, type CustomerAccountRecord } from '@endora-commerce/contracts';
+import type { AuditPort } from '@endora-commerce/platform/kernel';
+/**
+ * ImpersonationService (T189). Implements the switch-user pattern:
+ *   - start(adminSessionId, customerAccountId, reason?) — destroys (no:
+ *     DOES NOT destroy) the admin session, mints a new "impersonation"
+ *     session whose customer scope is the target customer AND whose
+ *     impersonatorAdminUserId is the original admin. The original admin
+ *     session id is returned as a "shadow" cookie so end can restore it.
+ *   - end(impersonationSessionId, adminShadowSessionId) — destroys the
+ *     impersonation session, returns the (still alive) admin session id.
+ *
+ * AuditPort.record is called BEFORE the cookie is minted (T179
+ * "audit-before-cookie") so a partial failure can never leave an
+ * impersonation cookie without an audit row.
+ */
+export interface ImpersonationStartResult {
+    impersonationSessionId: string;
+    impersonationCookieValue: string;
+    impersonationExpiresAt: Date;
+    adminShadowSessionCookieValue: string;
+    impersonatedCustomerAccount: CustomerAccountRecord;
+}
+export interface ImpersonationEndResult {
+    adminSessionCookieValue: string;
+    adminSessionExpiresAt: Date;
+}
+export declare class ImpersonationService {
+    private readonly emFactory;
+    /** `auth`'s published session surface (feature 075, Phase C). */
+    private readonly sessionPort;
+    /** `customer_accounts`' published read model — the impersonation target. */
+    private readonly customerAccounts;
+    private readonly auditLog;
+    constructor(emFactory: () => EntityManager, 
+    /** `auth`'s published session surface (feature 075, Phase C). */
+    sessionPort: AuthSessionPort, 
+    /** `customer_accounts`' published read model — the impersonation target. */
+    customerAccounts: CustomerAccountReadPort, auditLog: AuditPort);
+    start(input: {
+        adminUserId: string;
+        /** Raw admin session cookie value — must be preserved as the shadow. */
+        adminSessionCookieValue: string;
+        customerAccountId: string;
+        /**
+         * Feature 040 — optional: standalone (org-less) customers have no
+         * Organization. When provided it scopes the target lookup; when omitted
+         * the target is found by id alone.
+         */
+        organizationId?: string | null;
+        reason?: string;
+        ip?: string;
+        userAgent?: string;
+        requestId?: string;
+    }): Promise<ImpersonationStartResult>;
+    end(input: {
+        impersonationSessionCookieValue: string;
+        adminShadowCookieValue: string;
+        ip?: string;
+        userAgent?: string;
+        requestId?: string;
+    }): Promise<ImpersonationEndResult>;
+}
+//# sourceMappingURL=impersonation-service.d.ts.map

package/dist/backend/services/impersonation-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"impersonation-service.d.ts","sourceRoot":"","sources":["../../../src/backend/services/impersonation-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC3B,MAAM,4BAA4B,CAAC;AAGpC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAElE;;;;;;;;;;;;;GAaG;AAEH,MAAM,WAAW,wBAAwB;IACvC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,MAAM,CAAC;IACjC,sBAAsB,EAAE,IAAI,CAAC;IAC7B,6BAA6B,EAAE,MAAM,CAAC;IACtC,2BAA2B,EAAE,qBAAqB,CAAC;CACpD;AAED,MAAM,WAAW,sBAAsB;IACrC,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB,EAAE,IAAI,CAAC;CAC7B;AAED,qBAAa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,iEAAiE;IACjE,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,4EAA4E;IAC5E,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBALR,SAAS,EAAE,MAAM,aAAa;IAC/C,iEAAiE;IAChD,WAAW,EAAE,eAAe;IAC7C,4EAA4E;IAC3D,gBAAgB,EAAE,uBAAuB,EACzC,QAAQ,EAAE,SAAS;IAGhC,KAAK,CAAC,KAAK,EAAE;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,wEAAwE;QACxE,uBAAuB,EAAE,MAAM,CAAC;QAChC,iBAAiB,EAAE,MAAM,CAAC;QAC1B;;;;WAIG;QACH,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,wBAAwB,CAAC;IAsD/B,GAAG,CAAC,KAAK,EAAE;QACf,+BAA+B,EAAE,MAAM,CAAC;QACxC,sBAAsB,EAAE,MAAM,CAAC;QAC/B,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,sBAAsB,CAAC;CAmDpC"}

package/dist/backend/services/impersonation-service.js

@@ -0,0 +1,103 @@
+import { ERROR_CODES, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+import { AdminUser } from '../entities/admin-user.entity.js';
+export class ImpersonationService {
+    emFactory;
+    sessionPort;
+    customerAccounts;
+    auditLog;
+    constructor(emFactory, 
+    /** `auth`'s published session surface (feature 075, Phase C). */
+    sessionPort, 
+    /** `customer_accounts`' published read model — the impersonation target. */
+    customerAccounts, auditLog) {
+        this.emFactory = emFactory;
+        this.sessionPort = sessionPort;
+        this.customerAccounts = customerAccounts;
+        this.auditLog = auditLog;
+    }
+    async start(input) {
+        const em = this.emFactory();
+        const admin = await em.findOne(AdminUser, { id: input.adminUserId, deletedAt: null });
+        if (!admin) {
+            throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'Admin session required.');
+        }
+        // `findInOrganization` is the two-argument form of the same lookup: the
+        // membership check and the identity read in one query, which is what stops
+        // the check being forgotten. `activeOnly` carries the `deletedAt: null`
+        // half of the read this replaced.
+        const target = input.organizationId != null
+            ? await this.customerAccounts.findInOrganization(input.customerAccountId, input.organizationId, { activeOnly: true })
+            : await this.customerAccounts.findById(input.customerAccountId, { activeOnly: true });
+        if (!target) {
+            throw new HttpError(404, ERROR_CODES.NOT_FOUND, 'Target customer not found.');
+        }
+        // Audit FIRST — partial failure leaves no dangling cookie.
+        await this.auditLog.record({
+            actorAdminUserId: admin.id,
+            impersonatedCustomerAccountId: target.id,
+            action: 'impersonation.start',
+            objectType: 'customer_account',
+            objectId: target.id,
+            stateBefore: null,
+            stateAfter: { reason: input.reason ?? null, organizationId: input.organizationId ?? null },
+            ...(input.ip !== undefined ? { ipAddress: input.ip } : {}),
+            ...(input.userAgent !== undefined ? { userAgent: input.userAgent } : {}),
+            ...(input.requestId !== undefined ? { requestId: input.requestId } : {}),
+        });
+        const session = await this.sessionPort.createSession({
+            kind: 'impersonation',
+            customerAccountId: target.id,
+            impersonatorAdminUserId: admin.id,
+            ...(input.ip !== undefined ? { ipAddress: input.ip } : {}),
+            ...(input.userAgent !== undefined ? { userAgent: input.userAgent } : {}),
+        });
+        return {
+            impersonationSessionId: session.session.id,
+            impersonationCookieValue: session.cookieValue,
+            impersonationExpiresAt: session.expiresAt,
+            adminShadowSessionCookieValue: input.adminSessionCookieValue,
+            impersonatedCustomerAccount: target,
+        };
+    }
+    async end(input) {
+        // Resolve current impersonation session to get the admin id for the audit
+        // entry; then destroy it, then audit, then return the shadow as the new
+        // session cookie.
+        const resolved = await this.sessionPort.loadSession(input.impersonationSessionCookieValue);
+        if (!resolved ||
+            resolved.kind !== 'impersonation' ||
+            !resolved.session.impersonatorAdminUserId ||
+            !resolved.session.customerAccountId) {
+            throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'No active impersonation session.');
+        }
+        const adminId = resolved.session.impersonatorAdminUserId;
+        const customerId = resolved.session.customerAccountId;
+        // Destroy impersonation session — single use.
+        await this.sessionPort.destroySession(resolved.session.id);
+        await this.auditLog.record({
+            actorAdminUserId: adminId,
+            impersonatedCustomerAccountId: customerId,
+            action: 'impersonation.end',
+            objectType: 'customer_account',
+            objectId: customerId,
+            stateBefore: null,
+            stateAfter: null,
+            ...(input.ip !== undefined ? { ipAddress: input.ip } : {}),
+            ...(input.userAgent !== undefined ? { userAgent: input.userAgent } : {}),
+            ...(input.requestId !== undefined ? { requestId: input.requestId } : {}),
+        });
+        // The shadow cookie is the unchanged original admin session — verify it
+        // still resolves before handing it back. If somehow the admin session
+        // expired during impersonation, return 401 so the client must re-login.
+        const shadow = await this.sessionPort.loadSession(input.adminShadowCookieValue);
+        if (!shadow || shadow.kind !== 'admin') {
+            throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'Original admin session is no longer valid; please log in again.');
+        }
+        return {
+            adminSessionCookieValue: input.adminShadowCookieValue,
+            adminSessionExpiresAt: shadow.session.expiresAt,
+        };
+    }
+}
+//# sourceMappingURL=impersonation-service.js.map

package/dist/backend/services/impersonation-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"impersonation-service.js","sourceRoot":"","sources":["../../../src/backend/services/impersonation-service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,WAAW,GAIZ,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAC;AA+B7D,MAAM,OAAO,oBAAoB;IAEZ;IAEA;IAEA;IACA;IANnB,YACmB,SAA8B;IAC/C,iEAAiE;IAChD,WAA4B;IAC7C,4EAA4E;IAC3D,gBAAyC,EACzC,QAAmB;QALnB,cAAS,GAAT,SAAS,CAAqB;QAE9B,gBAAW,GAAX,WAAW,CAAiB;QAE5B,qBAAgB,GAAhB,gBAAgB,CAAyB;QACzC,aAAQ,GAAR,QAAQ,CAAW;IACnC,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,KAeX;QACC,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAE5B,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;QAChF,CAAC;QACD,wEAAwE;QACxE,2EAA2E;QAC3E,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,MAAM,GACV,KAAK,CAAC,cAAc,IAAI,IAAI;YAC1B,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAC5C,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,cAAc,EACpB,EAAE,UAAU,EAAE,IAAI,EAAE,CACrB;YACH,CAAC,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,iBAAiB,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;QAChF,CAAC;QAED,2DAA2D;QAC3D,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACzB,gBAAgB,EAAE,KAAK,CAAC,EAAE;YAC1B,6BAA6B,EAAE,MAAM,CAAC,EAAE;YACxC,MAAM,EAAE,qBAAqB;YAC7B,UAAU,EAAE,kBAAkB;YAC9B,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI,EAAE;YAC1F,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC;YACnD,IAAI,EAAE,eAAe;YACrB,iBAAiB,EAAE,MAAM,CAAC,EAAE;YAC5B,uBAAuB,EAAE,KAAK,CAAC,EAAE;YACjC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;QAEH,OAAO;YACL,sBAAsB,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;YAC1C,wBAAwB,EAAE,OAAO,CAAC,WAAW;YAC7C,sBAAsB,EAAE,OAAO,CAAC,SAAS;YACzC,6BAA6B,EAAE,KAAK,CAAC,uBAAuB;YAC5D,2BAA2B,EAAE,MAAM;SACpC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAMT;QACC,0EAA0E;QAC1E,wEAAwE;QACxE,kBAAkB;QAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CACjD,KAAK,CAAC,+BAA+B,CACtC,CAAC;QACF,IACE,CAAC,QAAQ;YACT,QAAQ,CAAC,IAAI,KAAK,eAAe;YACjC,CAAC,QAAQ,CAAC,OAAO,CAAC,uBAAuB;YACzC,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EACnC,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,uBAAuB,CAAC;QACzD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAEtD,8CAA8C;QAC9C,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE3D,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;YACzB,gBAAgB,EAAE,OAAO;YACzB,6BAA6B,EAAE,UAAU;YACzC,MAAM,EAAE,mBAAmB;YAC3B,UAAU,EAAE,kBAAkB;YAC9B,QAAQ,EAAE,UAAU;YACpB,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxE,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAC,CAAC;QAEH,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAChF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACvC,MAAM,IAAI,SAAS,CACjB,GAAG,EACH,WAAW,CAAC,YAAY,EACxB,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,OAAO;YACL,uBAAuB,EAAE,KAAK,CAAC,sBAAsB;YACrD,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;SAChD,CAAC;IACJ,CAAC;CACF"}

package/dist/backend/services/two-factor-enrolments.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Which admin users hold a second factor — the module's own view of a fact
+ * `mfa` owns.
+ *
+ * A function type rather than an interface, and declared here rather than
+ * shared with `customer_accounts`, because there is nothing to share: the
+ * published shape is `MfaEnrolmentStatePort` in `@endora-commerce/contracts`,
+ * and this is only the shape in which *this* module's serializers want the
+ * answer — the `subjectType` argument is already decided, and a `Set` is what a
+ * list surface asks per row.
+ *
+ * `backend.ts` builds the one implementation: it decides `mfa`'s presence and
+ * then resolves the port, so an absent owner produces an empty set rather than
+ * a `ModuleDisabledError` nobody could answer on an admin list. That is a
+ * declared degrade — see the `degrades-without` entry for `mfaEnrolmentStatePort`
+ * in this module's manifest — and not a caught gate.
+ */
+export type TwoFactorEnrolmentReader = (adminUserIds: readonly string[]) => Promise<ReadonlySet<string>>;
+//# sourceMappingURL=two-factor-enrolments.d.ts.map

package/dist/backend/services/two-factor-enrolments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-enrolments.d.ts","sourceRoot":"","sources":["../../../src/backend/services/two-factor-enrolments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,YAAY,EAAE,SAAS,MAAM,EAAE,KAC5B,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC"}

package/dist/backend/services/two-factor-enrolments.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=two-factor-enrolments.js.map

package/dist/backend/services/two-factor-enrolments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"two-factor-enrolments.js","sourceRoot":"","sources":["../../../src/backend/services/two-factor-enrolments.ts"],"names":[],"mappings":""}