@esb-market-contracts/admin-backend 1.8.44 → 1.8.45

package/index.d.ts

@@ -2,5 +2,7 @@ export type * from './api';
 export type * from './enums';
 export type * from './types';
 export type * from './constants';
+export type * from './schemas';
 export * from './enums';
-export * from './constants';
+export * from './constants';
+export * from './schemas';

package/index.js

@@ -1,2 +1,3 @@
 export * from './enums.js';
-export * from './constants.js';
+export * from './constants.js';
+export * from './schemas.js';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@esb-market-contracts/admin-backend",
   "description": "Shared TypeScript contract definitions for admin-backend.",
-  "version": "1.8.44",
+  "version": "1.8.45",
   "private": false,
   "type": "module",
   "sideEffects": false,
@@ -15,7 +15,9 @@
     "types.d.ts",
     "types.js",
     "constants.d.ts",
-    "constants.js"
+    "constants.js",
+    "schemas.d.ts",
+    "schemas.js"
   ],
   "exports": {
     ".": {
@@ -37,6 +39,10 @@
     "./constants": {
       "types": "./constants.d.ts",
       "default": "./constants.js"
+    },
+    "./schemas": {
+      "types": "./schemas.d.ts",
+      "default": "./schemas.js"
     }
   },
   "types": "./index.d.ts"

package/schemas.d.ts

@@ -0,0 +1,34 @@
+// Generated by dts-bundle-generator v9.5.1
+
+import { z } from 'zod';
+
+export declare const sessionPayloadSchema: z.ZodObject<{
+	employee: z.ZodObject<{
+		id: z.ZodInt;
+		status: z.ZodEnum<{
+			active: "active";
+			suspended: "suspended";
+		}>;
+		updatedAt: z.ZodNullable<z.ZodDate>;
+		createdAt: z.ZodDate;
+		email: z.ZodString;
+		fullName: z.ZodString;
+		grants: z.ZodArray<z.ZodEnum<{
+			"employee.create": "employee.create";
+			"employee.read": "employee.read";
+			"employee.update": "employee.update";
+			"inventory.create": "inventory.create";
+			"inventory.read": "inventory.read";
+			"inventory.update": "inventory.update";
+			"inventory.write_off": "inventory.write_off";
+			"category.create": "category.create";
+			"category.read": "category.read";
+			"category.update": "category.update";
+		}>>;
+	}, {
+		out: {};
+		in: {};
+	}>;
+}, z.core.$strip>;
+
+export {};

package/schemas.js

@@ -0,0 +1,314 @@
+// src/app/flows/authentication/authentication.schemas.ts
+import { z as z7 } from "zod";
+
+// src/app/domain/(iam)/employees/employees.audit.ts
+import { z } from "zod";
+var employeesAuditEvents = {
+  "employee.created": z.object({ targetEmployeeId: z.number() }),
+  "employee.suspended": z.object({ targetEmployeeId: z.number() }),
+  "employee.activated": z.object({ targetEmployeeId: z.number() }),
+  "employee.passwordReset": z.object({ targetEmployeeId: z.number() })
+};
+
+// src/app/domain/(iam)/employees/employees.enums.ts
+import { createStringEnumRecord } from "@kalutskii/foundation";
+import { pgEnum } from "drizzle-orm/pg-core";
+var employeeStatusesArray = ["active", "suspended"];
+var employeeStatusPGEnum = pgEnum("employee_status", employeeStatusesArray);
+var employeeStatusesRecord = createStringEnumRecord(employeeStatusesArray);
+
+// src/app/domain/(iam)/employees/employees.errors.ts
+import { HTTPException } from "hono/http-exception";
+
+// src/app/domain/(iam)/employees/employees.repository.ts
+import { sqlWhere as sqlWhere2 } from "@kalutskii/foundation";
+
+// src/drizzle/drizzle.database.ts
+import { drizzle } from "drizzle-orm/postgres-js";
+import postgres from "postgres";
+
+// src/app/domain/(backoffice)/assets/assets.relations.ts
+import { defineRelationsPart } from "drizzle-orm";
+
+// src/app/domain/(backoffice)/assets/assets.drizzle.ts
+import { sql } from "drizzle-orm";
+import { check, index, pgTable, serial, text, timestamp } from "drizzle-orm/pg-core";
+
+// src/app/domain/(backoffice)/assets/assets.enums.ts
+import { createStringEnumRecord as createStringEnumRecord2 } from "@kalutskii/foundation";
+import { pgEnum as pgEnum2 } from "drizzle-orm/pg-core";
+var assetStatusesArray = ["active", "written_off"];
+var assetStatusPGEnum = pgEnum2("asset_status", assetStatusesArray);
+var assetStatusesRecord = createStringEnumRecord2(assetStatusesArray);
+
+// src/app/domain/(backoffice)/assets/assets.drizzle.ts
+var assetsTable = pgTable("assets", {
+  id: serial("id").primaryKey(),
+  name: text("name").notNull(),
+  assetCode: text("asset_code").notNull().unique(),
+  // AST-00001
+  serialNumber: text("serial_number"),
+  // Any unique serial number
+  notes: text("notes"),
+  // Optional notes or description for the asset item.
+  status: assetStatusPGEnum("status").notNull().default("active"),
+  imageSource: text("image_source"),
+  // Optional image source or URL for the asset item.
+  writtenOffAt: timestamp("written_off_at"),
+  updatedAt: timestamp("updated_at").$onUpdateFn(() => /* @__PURE__ */ new Date()),
+  createdAt: timestamp("created_at").notNull().defaultNow()
+}, (table) => [
+  // Ensure `name` and `assetCode` are not empty.
+  check("assets_name_check", sql`length(trim(${table.name})) > 0`),
+  check("assets_code_check", sql`length(trim(${table.assetCode})) > 0`),
+  // Ensure written-off asset items have a write-off timestamp.
+  check("assets_write_off_check", sql`${table.status} != 'written_off' OR (${table.writtenOffAt} IS NOT NULL)`),
+  // Indexes for efficient filtering by `status` and `serialNumber`.
+  index("assets_status_idx").on(table.status),
+  index("assets_serial_number_idx").on(table.serialNumber)
+]);
+
+// src/app/domain/(backoffice)/assets/assets.relations.ts
+var assetsRelationsPart = defineRelationsPart({ assetsTable }, () => ({
+  assetsTable: {}
+}));
+
+// src/app/domain/(iam)/audit-logs/audit-logs.relations.ts
+import { defineRelationsPart as defineRelationsPart2 } from "drizzle-orm";
+
+// src/app/domain/(iam)/employees/employees.drizzle.ts
+import { sql as sql2 } from "drizzle-orm";
+import { check as check2, index as index2, pgTable as pgTable2, serial as serial2, text as text2, timestamp as timestamp2 } from "drizzle-orm/pg-core";
+var employeesTable = pgTable2("employees", {
+  id: serial2("id").primaryKey(),
+  email: text2("email").notNull().unique(),
+  fullName: text2("full_name").notNull(),
+  passwordDigest: text2("password_digest").notNull(),
+  status: employeeStatusPGEnum("status").notNull().default("active"),
+  updatedAt: timestamp2("updated_at").$onUpdateFn(() => /* @__PURE__ */ new Date()),
+  createdAt: timestamp2("created_at").notNull().defaultNow()
+}, (table) => [
+  // Ensure `email` is not empty and matches a basic email regex pattern.
+  check2("employees_email_check", sql2`${table.email} ~* '^[A-Z0-9._%+-]+@[A-Z0-9.-]+\\.[A-Z]{2,}$'`),
+  // Indexes for efficient querying by `passwordDigest`, and `status` columns.
+  index2("employees_password_digest_idx").on(table.passwordDigest),
+  index2("employees_status_idx").on(table.status)
+]);
+
+// src/app/domain/(iam)/audit-logs/audit-logs.drizzle.ts
+import { sql as sql3 } from "drizzle-orm";
+import { check as check3, index as index3, integer, jsonb, pgTable as pgTable3, serial as serial3, text as text3, timestamp as timestamp3 } from "drizzle-orm/pg-core";
+var auditLogsTable = pgTable3("audit_logs", {
+  id: serial3("id").primaryKey(),
+  event: text3("event").notNull().$type(),
+  actorEmployeeId: integer("actor_employee_id").references(() => employeesTable.id, {
+    onDelete: "set null"
+  }),
+  payload: jsonb("payload").notNull(),
+  createdAt: timestamp3("created_at").notNull().defaultNow()
+}, (table) => [
+  // Ensure `event` and `payload` are not empty.
+  check3("audit_event_check", sql3`${table.event} != ''`),
+  check3("audit_payload_check", sql3`jsonb_typeof(${table.payload}) = 'object'`),
+  // Indexes for efficient querying by `actorEmployeeId`, `event`, and `createdAt` columns.
+  index3("audit_logs_actor_employee_id_idx").on(table.actorEmployeeId),
+  index3("audit_logs_event_idx").on(table.event),
+  index3("audit_logs_created_at_idx").on(table.createdAt)
+]);
+
+// src/app/domain/(iam)/audit-logs/audit-logs.relations.ts
+var auditLogsRelationsPart = defineRelationsPart2({ auditLogsTable, employeesTable }, (r) => ({
+  auditLogsTable: {
+    employee: r.one.employeesTable({
+      from: r.auditLogsTable.actorEmployeeId,
+      to: r.employeesTable.id
+    })
+  }
+}));
+
+// src/app/domain/(iam)/employees/employees.relations.ts
+import { defineRelationsPart as defineRelationsPart3 } from "drizzle-orm";
+
+// src/app/domain/(iam)/permissions/permissions.drizzle.ts
+import { integer as integer2, pgTable as pgTable4, serial as serial4, text as text4, timestamp as timestamp4, unique } from "drizzle-orm/pg-core";
+var permissionsTable = pgTable4("permissions", {
+  id: serial4("id").primaryKey(),
+  grant: text4("grant").notNull().$type(),
+  employeeId: integer2("employee_id").notNull().references(() => employeesTable.id, { onDelete: "cascade" }),
+  createdAt: timestamp4("created_at").notNull().defaultNow()
+}, (table) => [
+  // Unique constraint on (`employeeId`, `grant`) to prevent duplicate records for the same employee.
+  unique("permissions_employee_id_grant_unique").on(table.employeeId, table.grant)
+]);
+
+// src/app/domain/(iam)/sessions/sessions.drizzle.ts
+import { sql as sql4 } from "drizzle-orm";
+import { check as check4, index as index4, integer as integer3, pgTable as pgTable5, serial as serial5, text as text5, timestamp as timestamp5 } from "drizzle-orm/pg-core";
+var sessionsTable = pgTable5("sessions", {
+  id: serial5("id").primaryKey(),
+  employeeId: integer3("employee_id").notNull().references(() => employeesTable.id, { onDelete: "cascade" }),
+  refreshTokenDigest: text5("refresh_token_digest").notNull().unique(),
+  createdAt: timestamp5("created_at").notNull().defaultNow(),
+  expiresAt: timestamp5("expires_at").notNull(),
+  revokedAt: timestamp5("revoked_at")
+}, (table) => [
+  // Ensure `expiresAt` is always greater than `createdAt`.
+  check4("sessions_expires_at_check", sql4`${table.expiresAt} > ${table.createdAt}`),
+  // Indexes for efficient querying by `employeeId` and `expiresAt` columns.
+  index4("sessions_employee_id_idx").on(table.employeeId),
+  index4("sessions_expires_at_idx").on(table.expiresAt)
+]);
+
+// src/app/domain/(iam)/employees/employees.relations.ts
+var employeesRelationsPart = defineRelationsPart3({ auditLogsTable, employeesTable, permissionsTable, sessionsTable }, (r) => ({
+  employeesTable: {
+    auditLogs: r.many.auditLogsTable({
+      from: r.employeesTable.id,
+      to: r.auditLogsTable.actorEmployeeId
+    }),
+    permissions: r.many.permissionsTable({
+      from: r.employeesTable.id,
+      to: r.permissionsTable.employeeId
+    }),
+    sessions: r.many.sessionsTable({
+      from: r.employeesTable.id,
+      to: r.sessionsTable.employeeId
+    })
+  }
+}));
+
+// src/app/domain/(iam)/permissions/permissions.relations.ts
+import { defineRelationsPart as defineRelationsPart4 } from "drizzle-orm";
+var permissionsRelationsPart = defineRelationsPart4({ permissionsTable, employeesTable }, (r) => ({
+  permissionsTable: {
+    employee: r.one.employeesTable({
+      from: r.permissionsTable.employeeId,
+      to: r.employeesTable.id
+    })
+  }
+}));
+
+// src/app/domain/(iam)/sessions/sessions.relations.ts
+import { defineRelationsPart as defineRelationsPart5 } from "drizzle-orm";
+var sessionsRelationsPart = defineRelationsPart5({ sessionsTable, employeesTable }, (r) => ({
+  sessionsTable: {
+    employee: r.one.employeesTable({
+      from: r.sessionsTable.employeeId,
+      to: r.employeesTable.id
+    })
+  }
+}));
+
+// src/app/domain/domain.registry.ts
+var domainRelationsRegistry = {
+  ...assetsRelationsPart,
+  ...auditLogsRelationsPart,
+  ...employeesRelationsPart,
+  ...permissionsRelationsPart,
+  ...sessionsRelationsPart
+};
+
+// src/internal/env.config.ts
+import { createEnv } from "@t3-oss/env-core";
+import { z as z2 } from "zod";
+var env = createEnv({
+  server: {
+    // Database settings for Drizzle ORM
+    DRIZZLE_DB_URL: z2.url().min(8).max(256),
+    DRIZZLE_MIGRATIONS_FOLDER: z2.string().min(1).max(256),
+    // Bun server settings
+    BUN_SERVER_PORT: z2.coerce.number().int().positive().min(1).max(65535),
+    BUN_SERVER_HOST: z2.string().min(1).max(64).optional().default("0.0.0.0"),
+    // Ecosystem variables
+    ESB_MARKET_SPACE_JWT_SECRET: z2.string().min(32).max(256),
+    ESB_MARKET_SPACE_RENDER_BACKEND_HOST: z2.url().min(4).max(256),
+    // Google Cloud Storage project and destination bucket
+    GOOGLE_CLOUD_PROJECT_ID: z2.string().min(1).max(256),
+    GOOGLE_CLOUD_STORAGE_BUCKET: z2.string().min(1).max(256),
+    // Peripheral settings, usually not required in the environment
+    PRODUCTION: z2.boolean().default(process.env.NODE_ENV === "production"),
+    DEVELOPMENT: z2.boolean().default(process.env.NODE_ENV === "development"),
+    DEFAULT_TIMEZONE: z2.string().min(4).max(256).optional().default("Asia/Tbilisi")
+  },
+  runtimeEnv: process.env,
+  emptyStringAsUndefined: true
+});
+
+// src/drizzle/drizzle.database.ts
+var sql5 = postgres(env.DRIZZLE_DB_URL, { max: 10, idle_timeout: 20, connect_timeout: 10, prepare: false });
+var db = drizzle({ client: sql5, relations: domainRelationsRegistry });
+
+// src/app/domain/(iam)/permissions/permissions.audit.ts
+import { z as z4 } from "zod";
+
+// src/app/domain/(iam)/permissions/permissions.enums.ts
+import { createStringEnumRecord as createStringEnumRecord3 } from "@kalutskii/foundation";
+import { z as z3 } from "zod";
+var grantsArray = [
+  "employee.create",
+  "employee.read",
+  "employee.update",
+  "inventory.create",
+  "inventory.read",
+  "inventory.update",
+  "inventory.write_off",
+  "category.create",
+  "category.read",
+  "category.update"
+];
+var grantsZodArray = z3.array(z3.enum(grantsArray));
+var grantsRecord = createStringEnumRecord3(grantsArray);
+
+// src/app/domain/(iam)/permissions/permissions.audit.ts
+var permissionsAuditEvents = {
+  "permissions.updated": z4.object({ targetEmployeeId: z4.number(), updatedGrants: grantsZodArray })
+};
+
+// src/app/domain/(iam)/permissions/permissions.repository.ts
+import { sqlWhere } from "@kalutskii/foundation";
+
+// src/app/domain/(iam)/permissions/permissions.schemas.ts
+import { zodAtLeastOne } from "@kalutskii/foundation";
+import { createSelectSchema } from "drizzle-orm/zod";
+import { z as z5 } from "zod";
+var permissionEntitySchema = createSelectSchema(permissionsTable);
+var permissionSchema = permissionEntitySchema.omit({ grant: true }).extend({ grant: z5.enum(grantsArray) });
+var permissionInsertSchema = permissionSchema.omit({ id: true, createdAt: true }).strict();
+var permissionSelectSchema = permissionSchema.pick({ employeeId: true });
+var permissionBulkSelectSchema = z5.object({
+  // Pagination not included, as there are no endpoints of `Permission` search.
+  where: zodAtLeastOne(permissionSchema.pick({ employeeId: true, grant: true }).partial())
+});
+
+// src/app/domain/(iam)/employees/employees.schemas.ts
+import { zodAtLeastOne as zodAtLeastOne2 } from "@kalutskii/foundation";
+import { createSelectSchema as createSelectSchema2 } from "drizzle-orm/zod";
+import { z as z6 } from "zod";
+var employeeEntitySchema = createSelectSchema2(employeesTable);
+var employeeSchema = employeeEntitySchema.extend({ grants: grantsZodArray });
+var employeeInsertSchema = employeeSchema.pick({ email: true, fullName: true, passwordDigest: true }).strict();
+var employeeSelectSchema = zodAtLeastOne2(employeeSchema.pick({ id: true, email: true }).partial());
+var employeeSearchSchema = z6.object({ where: employeeSchema.pick({ status: true }).partial().optional() });
+var employeeUpdateSchema = zodAtLeastOne2(
+  // We allow updating only the `passwordDigest` and `status` fields.
+  employeeSchema.pick({ passwordDigest: true, status: true }).partial()
+);
+var employeeEmailShape = z6.email().max(255);
+var employeePasswordShape = z6.string().min(8).max(128);
+var employeeIdentifierShape = employeeSchema.shape.id;
+
+// src/app/flows/authentication/authentication.schemas.ts
+var signinPayloadSchema = z7.object({
+  email: employeeEmailShape,
+  // We do not store the password in the database, but we validate
+  // it here to ensure that the employee provides a valid password.
+  password: z7.string().min(8).max(128)
+}).strict();
+var sessionPayloadSchema = z7.object({
+  // Password digest is omitted from the `Employee` intentionally
+  // to avoid leaking sensitive information in the API response.
+  employee: employeeSchema.omit({ passwordDigest: true })
+});
+export {
+  sessionPayloadSchema
+};