@esb-market-contracts/admin-backend 1.8.3 → 1.8.4

package/api.d.ts

@@ -1,7 +1,5 @@
 // Generated by dts-bundle-generator v9.5.1
 
-import { z } from 'zod';
-
 declare const authRouter: import("hono/hono-base").HonoBase<{}, {
 	"/iam/authentication/signin": {
 		$post: {
@@ -18,17 +16,6 @@ declare const authRouter: import("hono/hono-base").HonoBase<{}, {
 			status: 200;
 		};
 	};
-} & {
-	"/iam/authentication/logout": {
-		$post: {
-			input: {};
-			output: import("@kalutskii/foundation").APIError | import("@kalutskii/foundation").APISuccess<{
-				[x: string]: never;
-			}>;
-			outputFormat: "json";
-			status: 200;
-		};
-	};
 } & {
 	"/iam/authentication/refresh": {
 		$post: {
@@ -40,166 +27,10 @@ declare const authRouter: import("hono/hono-base").HonoBase<{}, {
 			status: 200;
 		};
 	};
-}, "/iam/authentication", "/iam/authentication/refresh">;
-export type AuthRouter = typeof authRouter;
-declare const sessionPayloadSchema: z.ZodObject<{
-	employee: z.ZodObject<{
-		id: z.ZodInt;
-		email: z.ZodString;
-		fullName: z.ZodString;
-		status: z.ZodEnum<{
-			active: "active";
-			suspended: "suspended";
-		}>;
-		updatedAt: z.ZodNullable<z.ZodDate>;
-		createdAt: z.ZodDate;
-	}, {
-		out: {};
-		in: {};
-	}>;
-	permissions: z.ZodArray<z.ZodEnum<{
-		"employee.create": "employee.create";
-		"employee.read": "employee.read";
-		"employee.update": "employee.update";
-	}>>;
-}, z.core.$strip>;
-export type SessionPayload = z.infer<typeof sessionPayloadSchema>;
-export type VariablesWithActor = {
-	actorSession: SessionPayload;
-};
-declare const managementRouter: import("hono/hono-base").HonoBase<{
-	Variables: VariablesWithActor;
-}, {
-	"/iam/management/permissions": {
-		$get: {
-			input: {};
-			output: import("@kalutskii/foundation").APIError | import("@kalutskii/foundation").APISuccess<{
-				permissions: readonly ("employee.create" | "employee.read" | "employee.update")[];
-			}>;
-			outputFormat: "json";
-			status: 200;
-		};
-	};
-} & {
-	"/iam/management/employees/get": {
-		$get: {
-			input: {
-				query: {
-					id: string | string[];
-				} | {
-					email: string | string[];
-				};
-			};
-			output: import("@kalutskii/foundation").APIError | import("@kalutskii/foundation").APISuccess<{
-				employee: {
-					id: number;
-					email: string;
-					fullName: string;
-					status: "active" | "suspended";
-					updatedAt: string | null;
-					createdAt: string;
-					permissions: ("employee.create" | "employee.read" | "employee.update")[];
-				};
-			}>;
-			outputFormat: "json";
-			status: 200;
-		};
-	};
-} & {
-	"/iam/management/employees/list": {
-		$get: {
-			input: {};
-			output: import("@kalutskii/foundation").APIError | import("@kalutskii/foundation").APISuccess<{
-				employees: {
-					id: number;
-					email: string;
-					fullName: string;
-					status: "active" | "suspended";
-					updatedAt: string | null;
-					createdAt: string;
-				}[];
-			}>;
-			outputFormat: "json";
-			status: 200;
-		};
-	};
 } & {
-	"/iam/management/employees/insert": {
-		$post: {
-			input: {
-				json: {
-					email: string;
-					fullName: string;
-					password: string;
-					permissions?: ("employee.create" | "employee.read" | "employee.update")[] | undefined;
-				};
-			};
-			output: import("@kalutskii/foundation").APIError | import("@kalutskii/foundation").APISuccess<{
-				id: number;
-			}>;
-			outputFormat: "json";
-			status: 201;
-		};
-	};
-} & {
-	"/iam/management/employees/suspend": {
-		$post: {
-			input: {
-				json: {
-					id: unknown;
-				} | {
-					email: string;
-				};
-			};
-			output: import("@kalutskii/foundation").APIError | import("@kalutskii/foundation").APISuccess<{
-				[x: string]: never;
-			}>;
-			outputFormat: "json";
-			status: 200;
-		};
-	};
-} & {
-	"/iam/management/employees/activate": {
-		$post: {
-			input: {
-				json: {
-					id: unknown;
-				} | {
-					email: string;
-				};
-			};
-			output: import("@kalutskii/foundation").APIError | import("@kalutskii/foundation").APISuccess<{
-				[x: string]: never;
-			}>;
-			outputFormat: "json";
-			status: 200;
-		};
-	};
-} & {
-	"/iam/management/employees/update-password": {
-		$post: {
-			input: {
-				json: {
-					employeeId: unknown;
-					password: string;
-				};
-			};
-			output: import("@kalutskii/foundation").APIError | import("@kalutskii/foundation").APISuccess<{
-				[x: string]: never;
-			}>;
-			outputFormat: "json";
-			status: 200;
-		};
-	};
-} & {
-	"/iam/management/employees/update-permissions": {
+	"/iam/authentication/logout": {
 		$post: {
-			input: {
-				json: {
-					employeeId: unknown;
-					permissions: ("employee.create" | "employee.read" | "employee.update")[];
-				};
-			};
+			input: {};
 			output: import("@kalutskii/foundation").APIError | import("@kalutskii/foundation").APISuccess<{
 				[x: string]: never;
 			}>;
@@ -207,7 +38,7 @@ declare const managementRouter: import("hono/hono-base").HonoBase<{
 			status: 200;
 		};
 	};
-}, "/iam/management", "/iam/management/employees/update-permissions">;
-export type ManagementRouter = typeof managementRouter;
+}, "/iam/authentication", "/iam/authentication/logout">;
+export type AuthRouter = typeof authRouter;
 
 export {};

package/constants.js

@@ -1,6 +1,6 @@
 // src/app/flows/authentication/authentication.constants.ts
-var SESSION_TOKEN_TTL_SECONDS = 60 * 15;
-var REFRESH_TOKEN_TTL_SECONDS = 60 * 60 * 24 * 7;
+var SESSION_TOKEN_TTL_MS = 60 * 15 * 1e3;
+var REFRESH_TOKEN_TTL_MS = 60 * 60 * 24 * 7 * 1e3;
 var AUTH_TIMEOUT_STATUS_CODE = 440;
 var INVALID_SESSION_STATUS_CODE = 498;
 export {

package/enums.d.ts

@@ -1,20 +1,15 @@
 // Generated by dts-bundle-generator v9.5.1
 
-declare const employeesPermissionsArray: readonly [
+declare const grantsArray: readonly [
 	"employee.create",
 	"employee.read",
 	"employee.update"
 ];
-declare const employeesPermissionsRecord: {
-	"EMPLOYEE.CREATE": "employee.create";
-	"EMPLOYEE.READ": "employee.read";
-	"EMPLOYEE.UPDATE": "employee.update";
-};
-type EmployeesPermission = (typeof employeesPermissionsArray)[number];
+declare const grantsRecord: Record<"EMPLOYEE_CREATE" | "EMPLOYEE_READ" | "EMPLOYEE_UPDATE", "employee.create" | "employee.read" | "employee.update">;
+export type Grant = (typeof grantsArray)[number];
 
 export {
-	EmployeesPermission as Permission,
-	employeesPermissionsRecord as permissions,
+	grantsRecord as grants,
 };
 
 export {};

package/enums.js

@@ -1,15 +1,209 @@
-// src/app/domain/(iam)/employees-permissions/employees-permissions.enums.ts
-import z from "zod";
+// src/app/domain/(iam)/permissions/permissions.audit.ts
+import { z } from "zod";
+var permissionsAuditEvents = {
+  "permissions.updated": z.object({
+    targetEmployeeId: z.number(),
+    updatedGrants: grantsZodArray
+  })
+};
+
+// src/app/domain/(iam)/permissions/permissions.repository.ts
+import { sqlWhere } from "@kalutskii/foundation";
+
+// src/drizzle/drizzle.database.ts
+import { drizzle } from "drizzle-orm/postgres-js";
+import postgres from "postgres";
+
+// src/app/domain/(iam)/audit-logs/audit-logs.relations.ts
+import { defineRelationsPart } from "drizzle-orm";
+
+// src/app/domain/(iam)/employees/employees.drizzle.ts
+import { sql } from "drizzle-orm";
+import { check, index, pgTable, serial, text, timestamp } from "drizzle-orm/pg-core";
+
+// src/app/domain/(iam)/employees/employees.enums.ts
+import { pgEnum } from "drizzle-orm/pg-core";
 
 // src/utilities/enums.utilities.ts
 function createStringEnumRecord(values) {
-  return Object.fromEntries(values.map((value) => [value.toUpperCase(), value]));
+  return Object.fromEntries(values.map((v) => [v.replace(/\./g, "_").toUpperCase(), v]));
 }
 
-// src/app/domain/(iam)/employees-permissions/employees-permissions.enums.ts
-var employeesPermissionsArray = ["employee.create", "employee.read", "employee.update"];
-var employeesPermissionsZodArray = z.array(z.enum(employeesPermissionsArray));
-var employeesPermissionsRecord = createStringEnumRecord(employeesPermissionsArray);
+// src/app/domain/(iam)/employees/employees.enums.ts
+var employeeStatusesArray = ["active", "suspended"];
+var employeeStatusPGEnum = pgEnum("employee_status", employeeStatusesArray);
+var employeeStatusesRecord = createStringEnumRecord(employeeStatusesArray);
+
+// src/app/domain/(iam)/employees/employees.drizzle.ts
+var employeesTable = pgTable("employees", {
+  id: serial("id").primaryKey(),
+  email: text("email").notNull().unique(),
+  fullName: text("full_name").notNull(),
+  passwordDigest: text("password_digest").notNull(),
+  status: employeeStatusPGEnum("status").notNull().default("active"),
+  updatedAt: timestamp("updated_at").$onUpdateFn(() => /* @__PURE__ */ new Date()),
+  createdAt: timestamp("created_at").notNull().defaultNow()
+}, (table) => [
+  // Ensure `email` is not empty and matches a basic email regex pattern.
+  check("employees_email_check", sql`${table.email} ~* '^[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}$'`),
+  // Indexes for efficient querying by `passwordDigest`, and `status` columns.
+  index("employees_password_digest_idx").on(table.passwordDigest),
+  index("employees_status_idx").on(table.status)
+]);
+
+// src/app/domain/(iam)/audit-logs/audit-logs.drizzle.ts
+import { sql as sql2 } from "drizzle-orm";
+import { check as check2, index as index2, integer, jsonb, pgTable as pgTable2, serial as serial2, text as text2, timestamp as timestamp2 } from "drizzle-orm/pg-core";
+var auditLogsTable = pgTable2("audit_logs", {
+  id: serial2("id").primaryKey(),
+  event: text2("event").notNull().$type(),
+  actorEmployeeId: integer("actor_employee_id").references(() => employeesTable.id, {
+    onDelete: "set null"
+  }),
+  payload: jsonb("payload").notNull(),
+  createdAt: timestamp2("created_at").notNull().defaultNow()
+}, (table) => [
+  // Ensure `event` and `payload` are not empty.
+  check2("audit_event_check", sql2`${table.event} != ''`),
+  check2("audit_payload_check", sql2`jsonb_typeof(${table.payload}) = 'object'`),
+  // Indexes for efficient querying by `actorEmployeeId`, `event`, and `createdAt` columns.
+  index2("audit_logs_actor_employee_id_idx").on(table.actorEmployeeId),
+  index2("audit_logs_event_idx").on(table.event),
+  index2("audit_logs_created_at_idx").on(table.createdAt)
+]);
+
+// src/app/domain/(iam)/audit-logs/audit-logs.relations.ts
+var auditLogsRelationsPart = defineRelationsPart({ auditLogsTable, employeesTable }, (r) => ({
+  auditLogsTable: {
+    employee: r.one.employeesTable({
+      from: r.auditLogsTable.actorEmployeeId,
+      to: r.employeesTable.id
+    })
+  }
+}));
+
+// src/app/domain/(iam)/employees/employees.relations.ts
+import { defineRelationsPart as defineRelationsPart2 } from "drizzle-orm";
+
+// src/app/domain/(iam)/permissions/permissions.drizzle.ts
+import { integer as integer2, pgTable as pgTable3, serial as serial3, text as text3, timestamp as timestamp3, unique } from "drizzle-orm/pg-core";
+var permissionsTable = pgTable3("permissions", {
+  id: serial3("id").primaryKey(),
+  grant: text3("grant").notNull().$type(),
+  employeeId: integer2("employee_id").notNull().references(() => employeesTable.id, { onDelete: "cascade" }),
+  createdAt: timestamp3("created_at").notNull().defaultNow()
+}, (table) => [
+  // Unique constraint on (`employeeId`, `grant`) to prevent duplicate records for the same employee.
+  unique("permissions_employee_id_grant_unique").on(table.employeeId, table.grant)
+]);
+
+// src/app/domain/(iam)/sessions/sessions.drizzle.ts
+import { sql as sql3 } from "drizzle-orm";
+import { check as check3, index as index3, integer as integer3, pgTable as pgTable4, serial as serial4, text as text4, timestamp as timestamp4 } from "drizzle-orm/pg-core";
+var sessionsTable = pgTable4("sessions", {
+  id: serial4("id").primaryKey(),
+  employeeId: integer3("employee_id").notNull().references(() => employeesTable.id, { onDelete: "cascade" }),
+  refreshTokenDigest: text4("refresh_token_digest").notNull().unique(),
+  createdAt: timestamp4("created_at").notNull().defaultNow(),
+  expiresAt: timestamp4("expires_at").notNull(),
+  revokedAt: timestamp4("revoked_at")
+}, (table) => [
+  // Ensure `expiresAt` is always greater than `createdAt`.
+  check3("sessions_expires_at_check", sql3`${table.expiresAt} > ${table.createdAt}`),
+  // Indexes for efficient querying by `employeeId` and `expiresAt` columns.
+  index3("sessions_employee_id_idx").on(table.employeeId),
+  index3("sessions_expires_at_idx").on(table.expiresAt)
+]);
+
+// src/app/domain/(iam)/employees/employees.relations.ts
+var employeesRelationsPart = defineRelationsPart2({ auditLogsTable, employeesTable, permissionsTable, sessionsTable }, (r) => ({
+  employeesTable: {
+    auditLogs: r.many.auditLogsTable({
+      from: r.employeesTable.id,
+      to: r.auditLogsTable.actorEmployeeId
+    }),
+    permissions: r.many.permissionsTable({
+      from: r.employeesTable.id,
+      to: r.permissionsTable.employeeId
+    }),
+    sessions: r.many.sessionsTable({
+      from: r.employeesTable.id,
+      to: r.sessionsTable.employeeId
+    })
+  }
+}));
+
+// src/app/domain/(iam)/permissions/permissions.relations.ts
+import { defineRelationsPart as defineRelationsPart3 } from "drizzle-orm";
+var permissionsRelationsPart = defineRelationsPart3({ permissionsTable, employeesTable }, (r) => ({
+  permissionsTable: {
+    employee: r.one.employeesTable({
+      from: r.permissionsTable.employeeId,
+      to: r.employeesTable.id
+    })
+  }
+}));
+
+// src/app/domain/(iam)/sessions/sessions.relations.ts
+import { defineRelationsPart as defineRelationsPart4 } from "drizzle-orm";
+var sessionsRelationsPart = defineRelationsPart4({ sessionsTable, employeesTable }, (r) => ({
+  sessionsTable: {
+    employee: r.one.employeesTable({
+      from: r.sessionsTable.employeeId,
+      to: r.employeesTable.id
+    })
+  }
+}));
+
+// src/app/domain/domain.registry.ts
+var domainRelationsRegistry = {
+  ...auditLogsRelationsPart,
+  ...employeesRelationsPart,
+  ...permissionsRelationsPart,
+  ...sessionsRelationsPart
+};
+
+// src/internal/env.config.ts
+import { createEnv } from "@t3-oss/env-core";
+import { z as z2 } from "zod";
+var env = createEnv({
+  server: {
+    // Database settings for Drizzle ORM
+    DRIZZLE_DB_URL: z2.url().min(8).max(256),
+    DRIZZLE_MIGRATIONS_FOLDER: z2.string().min(1).max(256),
+    // Bun server settings
+    BUN_SERVER_PORT: z2.coerce.number().int().positive().min(1).max(65535),
+    BUN_SERVER_HOST: z2.string().min(1).max(64).optional().default("0.0.0.0"),
+    // Ecosystem variables
+    ESB_MARKET_SPACE_JWT_SECRET: z2.string().min(32).max(256),
+    // Peripheral settings, usually not required in the environment
+    PRODUCTION: z2.boolean().default(process.env.NODE_ENV === "production"),
+    DEVELOPMENT: z2.boolean().default(process.env.NODE_ENV === "development"),
+    DEFAULT_TIMEZONE: z2.string().min(4).max(256).optional().default("Asia/Tbilisi")
+  },
+  runtimeEnv: process.env,
+  emptyStringAsUndefined: true
+});
+
+// src/drizzle/drizzle.database.ts
+var sql4 = postgres(env.DRIZZLE_DB_URL, { max: 10, idle_timeout: 20, connect_timeout: 10, prepare: false });
+var db = drizzle({ client: sql4, relations: domainRelationsRegistry });
+
+// src/app/domain/(iam)/permissions/permissions.schemas.ts
+import { zodAtLeastOne } from "@kalutskii/foundation";
+import { createSelectSchema } from "drizzle-orm/zod";
+import { z as z3 } from "zod";
+var permissionEntitySchema = createSelectSchema(permissionsTable);
+var permissionSchema = permissionEntitySchema.omit({ grant: true }).extend({ grant: z3.enum(grantsArray) });
+var permissionInsertSchema = permissionSchema.omit({ id: true, createdAt: true }).strict();
+var permissionSelectSchema = permissionSchema.pick({ employeeId: true });
+var permissionSelectManySchema = zodAtLeastOne(permissionSchema.pick({ employeeId: true, grant: true }).partial());
+
+// src/app/domain/(iam)/permissions/permissions.enums.ts
+import z4 from "zod";
+var grantsArray = ["employee.create", "employee.read", "employee.update"];
+var grantsZodArray = z4.array(z4.enum(grantsArray));
+var grantsRecord = createStringEnumRecord(grantsArray);
 export {
-  employeesPermissionsRecord as permissions
+  grantsRecord as grants
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@esb-market-contracts/admin-backend",
   "description": "Shared TypeScript contract definitions for admin-backend.",
-  "version": "1.8.3",
+  "version": "1.8.4",
   "private": false,
   "type": "module",
   "sideEffects": false,

package/types.d.ts

@@ -1,13 +1,11 @@
 // Generated by dts-bundle-generator v9.5.1
 
-import { AsQuery, SerializeDates } from '@kalutskii/foundation';
-import z from 'zod';
 import { z } from 'zod';
 
-declare const signinRequestSchema: z.ZodObject<{
+declare const signinPayloadSchema: z.ZodObject<{
 	email: z.ZodEmail;
 	password: z.ZodString;
-}, z.core.$strip>;
+}, z.core.$strict>;
 declare const sessionPayloadSchema: z.ZodObject<{
 	employee: z.ZodObject<{
 		id: z.ZodInt;
@@ -19,74 +17,17 @@ declare const sessionPayloadSchema: z.ZodObject<{
 		}>;
 		updatedAt: z.ZodNullable<z.ZodDate>;
 		createdAt: z.ZodDate;
+		grants: z.ZodArray<z.ZodEnum<{
+			"employee.create": "employee.create";
+			"employee.read": "employee.read";
+			"employee.update": "employee.update";
+		}>>;
 	}, {
 		out: {};
 		in: {};
 	}>;
-	permissions: z.ZodArray<z.ZodEnum<{
-		"employee.create": "employee.create";
-		"employee.read": "employee.read";
-		"employee.update": "employee.update";
-	}>>;
 }, z.core.$strip>;
-export type SigninRequest = z.infer<typeof signinRequestSchema>;
+export type SigninPayload = z.infer<typeof signinPayloadSchema>;
 export type SessionPayload = z.infer<typeof sessionPayloadSchema>;
-declare const employeeSelectRequestSchema: z.ZodUnion<readonly [
-	z.ZodObject<{
-		id: z.ZodCoercedNumber<unknown>;
-	}, z.core.$strip>,
-	z.ZodObject<{
-		email: z.ZodString;
-	}, z.core.$strip>
-]>;
-declare const employeeRecordSchema: z.ZodObject<{
-	id: z.ZodInt;
-	email: z.ZodString;
-	fullName: z.ZodString;
-	status: z.ZodEnum<{
-		active: "active";
-		suspended: "suspended";
-	}>;
-	updatedAt: z.ZodNullable<z.ZodDate>;
-	createdAt: z.ZodDate;
-	permissions: z.ZodArray<z.ZodEnum<{
-		"employee.create": "employee.create";
-		"employee.read": "employee.read";
-		"employee.update": "employee.update";
-	}>>;
-}, {
-	out: {};
-	in: {};
-}>;
-declare const employeeInsertRequestSchema: z.ZodObject<{
-	email: z.ZodString;
-	fullName: z.ZodString;
-	password: z.ZodString;
-	permissions: z.ZodOptional<z.ZodArray<z.ZodEnum<{
-		"employee.create": "employee.create";
-		"employee.read": "employee.read";
-		"employee.update": "employee.update";
-	}>>>;
-}, {
-	out: {};
-	in: {};
-}>;
-declare const employeePasswordUpdateRequestSchema: z.ZodObject<{
-	employeeId: z.ZodCoercedNumber<unknown>;
-	password: z.ZodString;
-}, z.core.$strip>;
-declare const employeePermissionsUpdateRequestSchema: z.ZodObject<{
-	employeeId: z.ZodCoercedNumber<unknown>;
-	permissions: z.ZodArray<z.ZodEnum<{
-		"employee.create": "employee.create";
-		"employee.read": "employee.read";
-		"employee.update": "employee.update";
-	}>>;
-}, z.core.$strip>;
-export type EmployeeSelectRequest = AsQuery<z.infer<typeof employeeSelectRequestSchema>>;
-export type EmployeeRecord = SerializeDates<z.infer<typeof employeeRecordSchema>>;
-export type EmployeeInsertRequest = z.infer<typeof employeeInsertRequestSchema>;
-export type EmployeePasswordUpdateRequest = z.infer<typeof employeePasswordUpdateRequestSchema>;
-export type EmployeePermissionsUpdateRequest = z.infer<typeof employeePermissionsUpdateRequestSchema>;
 
 export {};