@getstrata/bootstrap 0.2.61 → 0.2.63

package/dist/entries/dependencies.js

@@ -475,15 +475,160 @@ var storageProvider = {
 var storage_default = storageProvider;
 
 // ../../src/bootstrap/providers/view.ts
+import { resolveMembershipLookup } from "@getstrata/core/auth/membershipContext";
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";
 import { isViewsEnabled } from "@getstrata/core/runtime/frontendMode";
 import {
   configureWebErrorView,
+  configureWebLayoutData,
   DEFAULT_VIEWS_DIRECTORY,
   EtaViewEngine,
   errorTemplateName,
   resolveWebLayoutData
 } from "@getstrata/core/view";
+
+// ../../src/modules/organization/repository.ts
+import { BaseRepository } from "@getstrata/core/database/baseRepository";
+import { NotFoundError } from "@getstrata/core/errors/http";
+import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/organization/table.ts
+import { defineTable } from "@getstrata/core/database/table";
+
+// ../../src/domain/workhub.ts
+var ORGANIZATION_TABLE = "organization";
+
+// ../../src/modules/organization/table.ts
+var organizationTable = defineTable({
+  name: ORGANIZATION_TABLE,
+  primaryKey: "id",
+  columns: ["id", "tenant_id", "name", "slug", "created_at", "updated_at", "deleted_at"],
+  softDeletes: true,
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/organization/repository.ts
+class OrganizationRepository extends BaseRepository {
+  constructor() {
+    super(organizationTable);
+  }
+  async findBySlug(slug) {
+    return await this.firstOrNull({ slug });
+  }
+  async listForTenant(options) {
+    return await this.findAll({
+      limit: options.limit,
+      offset: options.offset,
+      where: { tenant_id: options.tenantId ?? currentTenantId() }
+    });
+  }
+  async countForTenant(tenantId = currentTenantId()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+  async findForTenantOrThrow(id, tenantId = currentTenantId()) {
+    const organization = await this.findById(id);
+    if (!organization || organization.tenant_id !== tenantId) {
+      throw new NotFoundError(`SCIM group ${id} not found.`);
+    }
+    return organization;
+  }
+}
+var repository_default = OrganizationRepository;
+
+// ../../src/modules/user/repository.ts
+import {
+  emailLookupForQuery,
+  protectEmail,
+  revealEmail
+} from "@getstrata/core/crypto/fieldEncryption";
+import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
+import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
+import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/user/table.ts
+import { defineTable as defineTable2 } from "@getstrata/core/database/table";
+var userTable = defineTable2({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "mfa_recovery_codes",
+    "profile_photo_path",
+    "session_valid_after",
+    "current_organization_id",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/repository.ts
+class UserRepository extends BaseRepository2 {
+  constructor() {
+    super(userTable);
+  }
+  decode(record) {
+    return {
+      ...record,
+      email: revealEmail(record.email),
+      mfa_secret: revealMfaSecret(record.mfa_secret)
+    };
+  }
+  async findById(id) {
+    const record = await super.findById(id);
+    return record ? this.decode(record) : null;
+  }
+  async findAll(options = {}) {
+    const records = await super.findAll(options);
+    return records.map((record) => this.decode(record));
+  }
+  async create(values) {
+    const email = values.email;
+    if (!email) {
+      throw new Error("Email is required.");
+    }
+    const protectedEmail = protectEmail(email);
+    const record = await super.create({
+      ...values,
+      tenant_id: values.tenant_id ?? currentTenantId2(),
+      email: protectedEmail.storedEmail,
+      email_lookup: protectedEmail.emailLookup,
+      password_hash: values.password_hash ?? ""
+    });
+    return this.decode(record);
+  }
+  async updateByIdOrThrow(id, values, errorFactory) {
+    const changes = { ...values };
+    if (values.email !== undefined) {
+      const protectedEmail = protectEmail(values.email);
+      changes.email = protectedEmail.storedEmail;
+      changes.email_lookup = protectedEmail.emailLookup;
+    }
+    const record = await super.updateByIdOrThrow(id, changes, errorFactory);
+    return this.decode(record);
+  }
+  async findByEmail(email) {
+    const records = await this.findWhere({ email_lookup: emailLookupForQuery(email) }, { limit: 1 });
+    const record = records[0];
+    return record ? this.decode(record) : null;
+  }
+  async countForTenant(tenantId = currentTenantId2()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+}
+var repository_default2 = UserRepository;
+
+// ../../src/bootstrap/providers/view.ts
 var CORE_VIEW_TOKEN = "core.view";
 var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
 var viewProvider = {
@@ -496,6 +641,25 @@ var viewProvider = {
     config.set(VIEW_DIRECTORY_CONFIG_KEY, viewsDirectory);
     const engine = new EtaViewEngine(viewsDirectory, (request) => resolveWebLayoutData(container, request ?? currentRequestMeta().request));
     container.set(CORE_VIEW_TOKEN, engine);
+    configureWebLayoutData({
+      extra: async (user) => {
+        const appName = appDisplayName();
+        if (!user || typeof user.id !== "number") {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+        try {
+          const record = await new repository_default2().findByIdOrThrow(user.id);
+          const memberships = await resolveMembershipLookup().listForUser(record.id);
+          const organizationsRepo = new repository_default;
+          const organizations = (await Promise.all(memberships.map((membership) => organizationsRepo.findById(membership.organization_id)))).filter((organization) => Boolean(organization && !organization.deleted_at));
+          const currentId = record.current_organization_id ?? null;
+          const currentOrganization = organizations.find((organization) => organization.id === currentId) ?? organizations[0] ?? null;
+          return { appName, currentOrganization, organizations };
+        } catch {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+      }
+    });
     configureWebErrorView({
       render: async (input) => engine.render(errorTemplateName(input.status), {
         title: input.title,

package/dist/entries/httpKernel.js

@@ -21,6 +21,7 @@ import { requestIdMiddleware } from "@getstrata/core/http/middleware";
 import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbilityMiddleware";
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
+import { createRequirePasswordConfirmMiddleware } from "@getstrata/core/http/requirePasswordConfirmMiddleware";
 import { createRequireVerifiedMiddleware } from "@getstrata/core/http/requireVerifiedMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
 import { withErrorHandling } from "@getstrata/core/http/response";
@@ -184,7 +185,8 @@ class HttpKernel {
         if (isEmailVerificationRequired() && !hasVerifiedEmail(user)) {
           return Response.redirect("/email/verify", 302);
         }
-        return Response.redirect(home, 302);
+        const location = typeof home === "function" ? await home(user) : home;
+        return Response.redirect(location, 302);
       }
       return handler(request);
     });
@@ -204,6 +206,11 @@ class HttpKernel {
   wrapWebVerified(handler) {
     return this.wrapWebAuth(handler, { verified: true });
   }
+  wrapWebPasswordConfirm(handler) {
+    return this.wrapWebAuth(withMiddleware(createRequirePasswordConfirmMiddleware())(handler), {
+      verified: true
+    });
+  }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = resolveAbilityChecker(this.dependencies.container);

package/dist/entries/providers/view.js

@@ -2,15 +2,160 @@
 var __jsonParse = (a) => JSON.parse(a);
 
 // ../../src/bootstrap/providers/view.ts
+import { resolveMembershipLookup } from "@getstrata/core/auth/membershipContext";
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";
 import { isViewsEnabled } from "@getstrata/core/runtime/frontendMode";
 import {
   configureWebErrorView,
+  configureWebLayoutData,
   DEFAULT_VIEWS_DIRECTORY,
   EtaViewEngine,
   errorTemplateName,
   resolveWebLayoutData
 } from "@getstrata/core/view";
+
+// ../../src/modules/organization/repository.ts
+import { BaseRepository } from "@getstrata/core/database/baseRepository";
+import { NotFoundError } from "@getstrata/core/errors/http";
+import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/organization/table.ts
+import { defineTable } from "@getstrata/core/database/table";
+
+// ../../src/domain/workhub.ts
+var ORGANIZATION_TABLE = "organization";
+
+// ../../src/modules/organization/table.ts
+var organizationTable = defineTable({
+  name: ORGANIZATION_TABLE,
+  primaryKey: "id",
+  columns: ["id", "tenant_id", "name", "slug", "created_at", "updated_at", "deleted_at"],
+  softDeletes: true,
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/organization/repository.ts
+class OrganizationRepository extends BaseRepository {
+  constructor() {
+    super(organizationTable);
+  }
+  async findBySlug(slug) {
+    return await this.firstOrNull({ slug });
+  }
+  async listForTenant(options) {
+    return await this.findAll({
+      limit: options.limit,
+      offset: options.offset,
+      where: { tenant_id: options.tenantId ?? currentTenantId() }
+    });
+  }
+  async countForTenant(tenantId = currentTenantId()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+  async findForTenantOrThrow(id, tenantId = currentTenantId()) {
+    const organization = await this.findById(id);
+    if (!organization || organization.tenant_id !== tenantId) {
+      throw new NotFoundError(`SCIM group ${id} not found.`);
+    }
+    return organization;
+  }
+}
+var repository_default = OrganizationRepository;
+
+// ../../src/modules/user/repository.ts
+import {
+  emailLookupForQuery,
+  protectEmail,
+  revealEmail
+} from "@getstrata/core/crypto/fieldEncryption";
+import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
+import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
+import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/user/table.ts
+import { defineTable as defineTable2 } from "@getstrata/core/database/table";
+var userTable = defineTable2({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "mfa_recovery_codes",
+    "profile_photo_path",
+    "session_valid_after",
+    "current_organization_id",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/repository.ts
+class UserRepository extends BaseRepository2 {
+  constructor() {
+    super(userTable);
+  }
+  decode(record) {
+    return {
+      ...record,
+      email: revealEmail(record.email),
+      mfa_secret: revealMfaSecret(record.mfa_secret)
+    };
+  }
+  async findById(id) {
+    const record = await super.findById(id);
+    return record ? this.decode(record) : null;
+  }
+  async findAll(options = {}) {
+    const records = await super.findAll(options);
+    return records.map((record) => this.decode(record));
+  }
+  async create(values) {
+    const email = values.email;
+    if (!email) {
+      throw new Error("Email is required.");
+    }
+    const protectedEmail = protectEmail(email);
+    const record = await super.create({
+      ...values,
+      tenant_id: values.tenant_id ?? currentTenantId2(),
+      email: protectedEmail.storedEmail,
+      email_lookup: protectedEmail.emailLookup,
+      password_hash: values.password_hash ?? ""
+    });
+    return this.decode(record);
+  }
+  async updateByIdOrThrow(id, values, errorFactory) {
+    const changes = { ...values };
+    if (values.email !== undefined) {
+      const protectedEmail = protectEmail(values.email);
+      changes.email = protectedEmail.storedEmail;
+      changes.email_lookup = protectedEmail.emailLookup;
+    }
+    const record = await super.updateByIdOrThrow(id, changes, errorFactory);
+    return this.decode(record);
+  }
+  async findByEmail(email) {
+    const records = await this.findWhere({ email_lookup: emailLookupForQuery(email) }, { limit: 1 });
+    const record = records[0];
+    return record ? this.decode(record) : null;
+  }
+  async countForTenant(tenantId = currentTenantId2()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+}
+var repository_default2 = UserRepository;
+
+// ../../src/bootstrap/providers/view.ts
 var CORE_VIEW_TOKEN = "core.view";
 var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
 var viewProvider = {
@@ -23,6 +168,25 @@ var viewProvider = {
     config.set(VIEW_DIRECTORY_CONFIG_KEY, viewsDirectory);
     const engine = new EtaViewEngine(viewsDirectory, (request) => resolveWebLayoutData(container, request ?? currentRequestMeta().request));
     container.set(CORE_VIEW_TOKEN, engine);
+    configureWebLayoutData({
+      extra: async (user) => {
+        const appName = appDisplayName();
+        if (!user || typeof user.id !== "number") {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+        try {
+          const record = await new repository_default2().findByIdOrThrow(user.id);
+          const memberships = await resolveMembershipLookup().listForUser(record.id);
+          const organizationsRepo = new repository_default;
+          const organizations = (await Promise.all(memberships.map((membership) => organizationsRepo.findById(membership.organization_id)))).filter((organization) => Boolean(organization && !organization.deleted_at));
+          const currentId = record.current_organization_id ?? null;
+          const currentOrganization = organizations.find((organization) => organization.id === currentId) ?? organizations[0] ?? null;
+          return { appName, currentOrganization, organizations };
+        } catch {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+      }
+    });
     configureWebErrorView({
       render: async (input) => engine.render(errorTemplateName(input.status), {
         title: input.title,

package/dist/entries/providers.js

@@ -465,15 +465,160 @@ var storageProvider = {
 var storage_default = storageProvider;
 
 // ../../src/bootstrap/providers/view.ts
+import { resolveMembershipLookup } from "@getstrata/core/auth/membershipContext";
 import { currentRequestMeta } from "@getstrata/core/http/requestMetaContext";
+import { appDisplayName } from "@getstrata/core/runtime/appKeyPrefix";
 import { isViewsEnabled } from "@getstrata/core/runtime/frontendMode";
 import {
   configureWebErrorView,
+  configureWebLayoutData,
   DEFAULT_VIEWS_DIRECTORY,
   EtaViewEngine,
   errorTemplateName,
   resolveWebLayoutData
 } from "@getstrata/core/view";
+
+// ../../src/modules/organization/repository.ts
+import { BaseRepository } from "@getstrata/core/database/baseRepository";
+import { NotFoundError } from "@getstrata/core/errors/http";
+import { currentTenantId } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/organization/table.ts
+import { defineTable } from "@getstrata/core/database/table";
+
+// ../../src/domain/workhub.ts
+var ORGANIZATION_TABLE = "organization";
+
+// ../../src/modules/organization/table.ts
+var organizationTable = defineTable({
+  name: ORGANIZATION_TABLE,
+  primaryKey: "id",
+  columns: ["id", "tenant_id", "name", "slug", "created_at", "updated_at", "deleted_at"],
+  softDeletes: true,
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/organization/repository.ts
+class OrganizationRepository extends BaseRepository {
+  constructor() {
+    super(organizationTable);
+  }
+  async findBySlug(slug) {
+    return await this.firstOrNull({ slug });
+  }
+  async listForTenant(options) {
+    return await this.findAll({
+      limit: options.limit,
+      offset: options.offset,
+      where: { tenant_id: options.tenantId ?? currentTenantId() }
+    });
+  }
+  async countForTenant(tenantId = currentTenantId()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+  async findForTenantOrThrow(id, tenantId = currentTenantId()) {
+    const organization = await this.findById(id);
+    if (!organization || organization.tenant_id !== tenantId) {
+      throw new NotFoundError(`SCIM group ${id} not found.`);
+    }
+    return organization;
+  }
+}
+var repository_default = OrganizationRepository;
+
+// ../../src/modules/user/repository.ts
+import {
+  emailLookupForQuery,
+  protectEmail,
+  revealEmail
+} from "@getstrata/core/crypto/fieldEncryption";
+import { revealMfaSecret } from "@getstrata/core/crypto/mfaSecret";
+import { BaseRepository as BaseRepository2 } from "@getstrata/core/database/baseRepository";
+import { currentTenantId as currentTenantId2 } from "@getstrata/core/tenant/tenantContext";
+
+// ../../src/modules/user/table.ts
+import { defineTable as defineTable2 } from "@getstrata/core/database/table";
+var userTable = defineTable2({
+  name: "users",
+  primaryKey: "id",
+  columns: [
+    "id",
+    "name",
+    "email",
+    "email_lookup",
+    "role",
+    "tenant_id",
+    "password_hash",
+    "email_verified_at",
+    "mfa_secret",
+    "mfa_enabled",
+    "mfa_recovery_codes",
+    "profile_photo_path",
+    "session_valid_after",
+    "current_organization_id",
+    "created_at",
+    "updated_at"
+  ],
+  defaultOrderBy: { column: "id", direction: "ASC" }
+});
+
+// ../../src/modules/user/repository.ts
+class UserRepository extends BaseRepository2 {
+  constructor() {
+    super(userTable);
+  }
+  decode(record) {
+    return {
+      ...record,
+      email: revealEmail(record.email),
+      mfa_secret: revealMfaSecret(record.mfa_secret)
+    };
+  }
+  async findById(id) {
+    const record = await super.findById(id);
+    return record ? this.decode(record) : null;
+  }
+  async findAll(options = {}) {
+    const records = await super.findAll(options);
+    return records.map((record) => this.decode(record));
+  }
+  async create(values) {
+    const email = values.email;
+    if (!email) {
+      throw new Error("Email is required.");
+    }
+    const protectedEmail = protectEmail(email);
+    const record = await super.create({
+      ...values,
+      tenant_id: values.tenant_id ?? currentTenantId2(),
+      email: protectedEmail.storedEmail,
+      email_lookup: protectedEmail.emailLookup,
+      password_hash: values.password_hash ?? ""
+    });
+    return this.decode(record);
+  }
+  async updateByIdOrThrow(id, values, errorFactory) {
+    const changes = { ...values };
+    if (values.email !== undefined) {
+      const protectedEmail = protectEmail(values.email);
+      changes.email = protectedEmail.storedEmail;
+      changes.email_lookup = protectedEmail.emailLookup;
+    }
+    const record = await super.updateByIdOrThrow(id, changes, errorFactory);
+    return this.decode(record);
+  }
+  async findByEmail(email) {
+    const records = await this.findWhere({ email_lookup: emailLookupForQuery(email) }, { limit: 1 });
+    const record = records[0];
+    return record ? this.decode(record) : null;
+  }
+  async countForTenant(tenantId = currentTenantId2()) {
+    return await this.countWhere({ tenant_id: tenantId });
+  }
+}
+var repository_default2 = UserRepository;
+
+// ../../src/bootstrap/providers/view.ts
 var CORE_VIEW_TOKEN = "core.view";
 var VIEW_DIRECTORY_CONFIG_KEY = "view.directory";
 var viewProvider = {
@@ -486,6 +631,25 @@ var viewProvider = {
     config.set(VIEW_DIRECTORY_CONFIG_KEY, viewsDirectory);
     const engine = new EtaViewEngine(viewsDirectory, (request) => resolveWebLayoutData(container, request ?? currentRequestMeta().request));
     container.set(CORE_VIEW_TOKEN, engine);
+    configureWebLayoutData({
+      extra: async (user) => {
+        const appName = appDisplayName();
+        if (!user || typeof user.id !== "number") {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+        try {
+          const record = await new repository_default2().findByIdOrThrow(user.id);
+          const memberships = await resolveMembershipLookup().listForUser(record.id);
+          const organizationsRepo = new repository_default;
+          const organizations = (await Promise.all(memberships.map((membership) => organizationsRepo.findById(membership.organization_id)))).filter((organization) => Boolean(organization && !organization.deleted_at));
+          const currentId = record.current_organization_id ?? null;
+          const currentOrganization = organizations.find((organization) => organization.id === currentId) ?? organizations[0] ?? null;
+          return { appName, currentOrganization, organizations };
+        } catch {
+          return { appName, currentOrganization: null, organizations: [] };
+        }
+      }
+    });
     configureWebErrorView({
       render: async (input) => engine.render(errorTemplateName(input.status), {
         title: input.title,

package/dist/entries/web/routing.js

@@ -30,6 +30,7 @@ import { requestIdMiddleware } from "@getstrata/core/http/middleware";
 import { createRequireAbilityMiddleware } from "@getstrata/core/http/requireAbilityMiddleware";
 import { createRequireAuthMiddleware } from "@getstrata/core/http/requireAuthMiddleware";
 import { createRequireGlobalAdminMiddleware } from "@getstrata/core/http/requireGlobalAdminMiddleware";
+import { createRequirePasswordConfirmMiddleware } from "@getstrata/core/http/requirePasswordConfirmMiddleware";
 import { createRequireVerifiedMiddleware } from "@getstrata/core/http/requireVerifiedMiddleware";
 import { createRequireWebAuthMiddleware } from "@getstrata/core/http/requireWebAuthMiddleware";
 import { withErrorHandling } from "@getstrata/core/http/response";
@@ -193,7 +194,8 @@ class HttpKernel {
         if (isEmailVerificationRequired() && !hasVerifiedEmail(user)) {
           return Response.redirect("/email/verify", 302);
         }
-        return Response.redirect(home, 302);
+        const location = typeof home === "function" ? await home(user) : home;
+        return Response.redirect(location, 302);
       }
       return handler(request);
     });
@@ -213,6 +215,11 @@ class HttpKernel {
   wrapWebVerified(handler) {
     return this.wrapWebAuth(handler, { verified: true });
   }
+  wrapWebPasswordConfirm(handler) {
+    return this.wrapWebAuth(withMiddleware(createRequirePasswordConfirmMiddleware())(handler), {
+      verified: true
+    });
+  }
   wrapWebAbility(ability, handler) {
     const auth = this.dependencies.container.resolve(CORE_AUTH_TOKEN);
     const abilityChecker = resolveAbilityChecker(this.dependencies.container);