@h-ai/serv 0.1.0-alpha.72 → 0.1.0-alpha.74
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.en.md +18 -0
- package/README.ja.md +18 -0
- package/README.md +18 -0
- package/dist/{chunk-WW25756Z.js → chunk-IRZVJW4V.js} +3 -3
- package/dist/{chunk-WW25756Z.js.map → chunk-IRZVJW4V.js.map} +1 -1
- package/dist/{chunk-KR4H56KP.js → chunk-N6IOKLQY.js} +26 -4
- package/dist/chunk-N6IOKLQY.js.map +1 -0
- package/dist/features/ai.d.ts +2 -2
- package/dist/features/ai.js +1 -1
- package/dist/features/feedback.d.ts +5 -2
- package/dist/features/feedback.js +1 -1
- package/dist/features/iam.d.ts +349 -2
- package/dist/features/iam.js +29 -10
- package/dist/features/iam.js.map +1 -1
- package/dist/features/storage.d.ts +2 -2
- package/dist/features/storage.js +2 -2
- package/dist/index.d.ts +6 -6
- package/dist/index.js +48 -16
- package/dist/index.js.map +1 -1
- package/dist/{serv-context-B-AxU8hj.d.ts → serv-context-DE1JH5bd.d.ts} +2 -0
- package/dist/{serv-router-C8dSz2k-.d.ts → serv-router-BJk04-oS.d.ts} +1 -1
- package/package.json +17 -15
- package/dist/chunk-KR4H56KP.js.map +0 -1
package/dist/features/iam.d.ts
CHANGED
|
@@ -1,10 +1,10 @@
|
|
|
1
|
+
import * as _orpc_contract from '@orpc/contract';
|
|
1
2
|
import * as _orpc_server from '@orpc/server';
|
|
2
3
|
import * as zod_v4_core from 'zod/v4/core';
|
|
3
4
|
import * as zod from 'zod';
|
|
4
|
-
import * as _orpc_contract from '@orpc/contract';
|
|
5
5
|
import { IamFunctions } from '@h-ai/iam';
|
|
6
6
|
export { TokenPair } from '@h-ai/iam';
|
|
7
|
-
import { S as ServContext } from '../serv-context-
|
|
7
|
+
import { S as ServContext } from '../serv-context-DE1JH5bd.js';
|
|
8
8
|
import '@h-ai/core';
|
|
9
9
|
|
|
10
10
|
/**
|
|
@@ -40,9 +40,82 @@ interface IamProcedureDeps {
|
|
|
40
40
|
*/
|
|
41
41
|
declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
42
42
|
auth: {
|
|
43
|
+
createCaptcha: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
44
|
+
operation: zod.ZodEnum<{
|
|
45
|
+
login: "login";
|
|
46
|
+
register: "register";
|
|
47
|
+
sendOtp: "sendOtp";
|
|
48
|
+
passwordReset: "passwordReset";
|
|
49
|
+
renewPassword: "renewPassword";
|
|
50
|
+
}>;
|
|
51
|
+
}, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
|
|
52
|
+
success: zod.ZodLiteral<true>;
|
|
53
|
+
data: zod.ZodObject<{
|
|
54
|
+
id: zod.ZodString;
|
|
55
|
+
challenge: zod.ZodObject<{
|
|
56
|
+
signature: zod.ZodOptional<zod.ZodString>;
|
|
57
|
+
parameters: zod.ZodObject<{
|
|
58
|
+
algorithm: zod.ZodString & zod.ZodType<"PBKDF2/SHA-256", string, zod_v4_core.$ZodTypeInternals<"PBKDF2/SHA-256", string>>;
|
|
59
|
+
nonce: zod.ZodString;
|
|
60
|
+
salt: zod.ZodString;
|
|
61
|
+
cost: zod.ZodNumber;
|
|
62
|
+
keyLength: zod.ZodNumber;
|
|
63
|
+
keyPrefix: zod.ZodString;
|
|
64
|
+
keySignature: zod.ZodOptional<zod.ZodString>;
|
|
65
|
+
data: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnion<readonly [zod.ZodString, zod.ZodNumber, zod.ZodBoolean, zod.ZodNull]>>>;
|
|
66
|
+
}, zod_v4_core.$strip>;
|
|
67
|
+
}, zod_v4_core.$strip>;
|
|
68
|
+
}, zod_v4_core.$strip>;
|
|
69
|
+
}, zod_v4_core.$strip>, zod.ZodObject<{
|
|
70
|
+
success: zod.ZodLiteral<false>;
|
|
71
|
+
error: zod.ZodObject<{
|
|
72
|
+
code: zod.ZodUnion<readonly [zod.ZodString, zod.ZodNumber]>;
|
|
73
|
+
message: zod.ZodString;
|
|
74
|
+
traceId: zod.ZodOptional<zod.ZodString>;
|
|
75
|
+
httpStatus: zod.ZodOptional<zod.ZodNumber>;
|
|
76
|
+
system: zod.ZodOptional<zod.ZodString>;
|
|
77
|
+
module: zod.ZodOptional<zod.ZodString>;
|
|
78
|
+
cause: zod.ZodOptional<zod.ZodUnknown>;
|
|
79
|
+
suggestion: zod.ZodOptional<zod.ZodString>;
|
|
80
|
+
ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
|
|
81
|
+
}, zod_v4_core.$strip>;
|
|
82
|
+
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
83
|
+
reauthenticate: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
84
|
+
password: zod.ZodString;
|
|
85
|
+
operation: zod.ZodString;
|
|
86
|
+
}, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
|
|
87
|
+
success: zod.ZodLiteral<true>;
|
|
88
|
+
data: zod.ZodObject<{
|
|
89
|
+
ticket: zod.ZodString;
|
|
90
|
+
expiresAt: zod.ZodNumber;
|
|
91
|
+
}, zod_v4_core.$strip>;
|
|
92
|
+
}, zod_v4_core.$strip>, zod.ZodObject<{
|
|
93
|
+
success: zod.ZodLiteral<false>;
|
|
94
|
+
error: zod.ZodObject<{
|
|
95
|
+
code: zod.ZodUnion<readonly [zod.ZodString, zod.ZodNumber]>;
|
|
96
|
+
message: zod.ZodString;
|
|
97
|
+
traceId: zod.ZodOptional<zod.ZodString>;
|
|
98
|
+
httpStatus: zod.ZodOptional<zod.ZodNumber>;
|
|
99
|
+
system: zod.ZodOptional<zod.ZodString>;
|
|
100
|
+
module: zod.ZodOptional<zod.ZodString>;
|
|
101
|
+
cause: zod.ZodOptional<zod.ZodUnknown>;
|
|
102
|
+
suggestion: zod.ZodOptional<zod.ZodString>;
|
|
103
|
+
ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
|
|
104
|
+
}, zod_v4_core.$strip>;
|
|
105
|
+
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
43
106
|
publicConfig: _orpc_server.Procedure<ServContext & {}, any, _orpc_contract.Schema<unknown, unknown>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
|
|
44
107
|
success: zod.ZodLiteral<true>;
|
|
45
108
|
data: zod.ZodNullable<zod.ZodObject<{
|
|
109
|
+
captcha: zod.ZodDefault<zod.ZodObject<{
|
|
110
|
+
enabled: zod.ZodBoolean;
|
|
111
|
+
}, zod_v4_core.$strip>>;
|
|
112
|
+
reauthentication: zod.ZodOptional<zod.ZodObject<{
|
|
113
|
+
enabled: zod.ZodBoolean;
|
|
114
|
+
operations: zod.ZodArray<zod.ZodString>;
|
|
115
|
+
}, zod_v4_core.$strip>>;
|
|
116
|
+
initialCredentials: zod.ZodOptional<zod.ZodObject<{
|
|
117
|
+
enabled: zod.ZodBoolean;
|
|
118
|
+
}, zod_v4_core.$strip>>;
|
|
46
119
|
password: zod.ZodObject<{
|
|
47
120
|
minLength: zod.ZodNumber;
|
|
48
121
|
maxLength: zod.ZodNumber;
|
|
@@ -51,6 +124,9 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
51
124
|
requireNumber: zod.ZodBoolean;
|
|
52
125
|
requireSpecialChar: zod.ZodBoolean;
|
|
53
126
|
expirationDays: zod.ZodNumber;
|
|
127
|
+
minCharacterClasses: zod.ZodOptional<zod.ZodNumber>;
|
|
128
|
+
preventSamePassword: zod.ZodOptional<zod.ZodBoolean>;
|
|
129
|
+
requireInitialChange: zod.ZodOptional<zod.ZodBoolean>;
|
|
54
130
|
}, zod_v4_core.$strip>;
|
|
55
131
|
register: zod.ZodObject<{
|
|
56
132
|
enabled: zod.ZodBoolean;
|
|
@@ -95,6 +171,7 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
95
171
|
}, zod_v4_core.$strip>;
|
|
96
172
|
session: zod.ZodObject<{
|
|
97
173
|
maxAge: zod.ZodNumber;
|
|
174
|
+
endOnPageHide: zod.ZodDefault<zod.ZodBoolean>;
|
|
98
175
|
}, zod_v4_core.$strip>;
|
|
99
176
|
}, zod_v4_core.$strip>>;
|
|
100
177
|
}, zod_v4_core.$strip>, zod.ZodObject<{
|
|
@@ -111,9 +188,33 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
111
188
|
ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
|
|
112
189
|
}, zod_v4_core.$strip>;
|
|
113
190
|
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
191
|
+
renewPassword: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
192
|
+
identifier: zod.ZodString;
|
|
193
|
+
password: zod.ZodString;
|
|
194
|
+
newPassword: zod.ZodString;
|
|
195
|
+
captcha: zod.ZodOptional<zod.ZodString>;
|
|
196
|
+
}, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
|
|
197
|
+
success: zod.ZodLiteral<true>;
|
|
198
|
+
data: zod.ZodVoid;
|
|
199
|
+
}, zod_v4_core.$strip>, zod.ZodObject<{
|
|
200
|
+
success: zod.ZodLiteral<false>;
|
|
201
|
+
error: zod.ZodObject<{
|
|
202
|
+
code: zod.ZodUnion<readonly [zod.ZodString, zod.ZodNumber]>;
|
|
203
|
+
message: zod.ZodString;
|
|
204
|
+
traceId: zod.ZodOptional<zod.ZodString>;
|
|
205
|
+
httpStatus: zod.ZodOptional<zod.ZodNumber>;
|
|
206
|
+
system: zod.ZodOptional<zod.ZodString>;
|
|
207
|
+
module: zod.ZodOptional<zod.ZodString>;
|
|
208
|
+
cause: zod.ZodOptional<zod.ZodUnknown>;
|
|
209
|
+
suggestion: zod.ZodOptional<zod.ZodString>;
|
|
210
|
+
ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
|
|
211
|
+
}, zod_v4_core.$strip>;
|
|
212
|
+
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
114
213
|
loginWithLdap: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
115
214
|
username: zod.ZodString;
|
|
116
215
|
password: zod.ZodString;
|
|
216
|
+
captcha: zod.ZodOptional<zod.ZodString>;
|
|
217
|
+
expectedUserId: zod.ZodOptional<zod.ZodString>;
|
|
117
218
|
}, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
|
|
118
219
|
success: zod.ZodLiteral<true>;
|
|
119
220
|
data: zod.ZodObject<{
|
|
@@ -125,6 +226,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
125
226
|
displayName: zod.ZodOptional<zod.ZodString>;
|
|
126
227
|
avatarUrl: zod.ZodOptional<zod.ZodString>;
|
|
127
228
|
enabled: zod.ZodBoolean;
|
|
229
|
+
accountType: zod.ZodOptional<zod.ZodEnum<{
|
|
230
|
+
permanent: "permanent";
|
|
231
|
+
temporary: "temporary";
|
|
232
|
+
}>>;
|
|
233
|
+
accountStatus: zod.ZodOptional<zod.ZodEnum<{
|
|
234
|
+
active: "active";
|
|
235
|
+
dormant: "dormant";
|
|
236
|
+
closed: "closed";
|
|
237
|
+
}>>;
|
|
238
|
+
accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
239
|
+
lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
240
|
+
mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
|
|
128
241
|
emailVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
129
242
|
phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
130
243
|
createdAt: zod.ZodCoercedDate<unknown>;
|
|
@@ -164,6 +277,7 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
164
277
|
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
165
278
|
requestPasswordReset: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
166
279
|
identifier: zod.ZodString;
|
|
280
|
+
captcha: zod.ZodOptional<zod.ZodString>;
|
|
167
281
|
}, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
|
|
168
282
|
success: zod.ZodLiteral<true>;
|
|
169
283
|
data: zod.ZodVoid;
|
|
@@ -202,6 +316,8 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
202
316
|
}, zod_v4_core.$strip>;
|
|
203
317
|
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
204
318
|
login: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
319
|
+
expectedUserId: zod.ZodOptional<zod.ZodString>;
|
|
320
|
+
captcha: zod.ZodOptional<zod.ZodString>;
|
|
205
321
|
identifier: zod.ZodString;
|
|
206
322
|
password: zod.ZodString;
|
|
207
323
|
}, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
|
|
@@ -215,6 +331,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
215
331
|
displayName: zod.ZodOptional<zod.ZodString>;
|
|
216
332
|
avatarUrl: zod.ZodOptional<zod.ZodString>;
|
|
217
333
|
enabled: zod.ZodBoolean;
|
|
334
|
+
accountType: zod.ZodOptional<zod.ZodEnum<{
|
|
335
|
+
permanent: "permanent";
|
|
336
|
+
temporary: "temporary";
|
|
337
|
+
}>>;
|
|
338
|
+
accountStatus: zod.ZodOptional<zod.ZodEnum<{
|
|
339
|
+
active: "active";
|
|
340
|
+
dormant: "dormant";
|
|
341
|
+
closed: "closed";
|
|
342
|
+
}>>;
|
|
343
|
+
accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
344
|
+
lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
345
|
+
mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
|
|
218
346
|
emailVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
219
347
|
phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
220
348
|
createdAt: zod.ZodCoercedDate<unknown>;
|
|
@@ -253,6 +381,8 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
253
381
|
}, zod_v4_core.$strip>;
|
|
254
382
|
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
255
383
|
loginWithOtp: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
384
|
+
expectedUserId: zod.ZodOptional<zod.ZodString>;
|
|
385
|
+
captcha: zod.ZodOptional<zod.ZodString>;
|
|
256
386
|
identifier: zod.ZodString;
|
|
257
387
|
code: zod.ZodString;
|
|
258
388
|
}, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
|
|
@@ -266,6 +396,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
266
396
|
displayName: zod.ZodOptional<zod.ZodString>;
|
|
267
397
|
avatarUrl: zod.ZodOptional<zod.ZodString>;
|
|
268
398
|
enabled: zod.ZodBoolean;
|
|
399
|
+
accountType: zod.ZodOptional<zod.ZodEnum<{
|
|
400
|
+
permanent: "permanent";
|
|
401
|
+
temporary: "temporary";
|
|
402
|
+
}>>;
|
|
403
|
+
accountStatus: zod.ZodOptional<zod.ZodEnum<{
|
|
404
|
+
active: "active";
|
|
405
|
+
dormant: "dormant";
|
|
406
|
+
closed: "closed";
|
|
407
|
+
}>>;
|
|
408
|
+
accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
409
|
+
lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
410
|
+
mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
|
|
269
411
|
emailVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
270
412
|
phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
271
413
|
createdAt: zod.ZodCoercedDate<unknown>;
|
|
@@ -322,6 +464,25 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
322
464
|
ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
|
|
323
465
|
}, zod_v4_core.$strip>;
|
|
324
466
|
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
467
|
+
closeSession: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
468
|
+
accessToken: zod.ZodOptional<zod.ZodString>;
|
|
469
|
+
}, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
|
|
470
|
+
success: zod.ZodLiteral<true>;
|
|
471
|
+
data: zod.ZodVoid;
|
|
472
|
+
}, zod_v4_core.$strip>, zod.ZodObject<{
|
|
473
|
+
success: zod.ZodLiteral<false>;
|
|
474
|
+
error: zod.ZodObject<{
|
|
475
|
+
code: zod.ZodUnion<readonly [zod.ZodString, zod.ZodNumber]>;
|
|
476
|
+
message: zod.ZodString;
|
|
477
|
+
traceId: zod.ZodOptional<zod.ZodString>;
|
|
478
|
+
httpStatus: zod.ZodOptional<zod.ZodNumber>;
|
|
479
|
+
system: zod.ZodOptional<zod.ZodString>;
|
|
480
|
+
module: zod.ZodOptional<zod.ZodString>;
|
|
481
|
+
cause: zod.ZodOptional<zod.ZodUnknown>;
|
|
482
|
+
suggestion: zod.ZodOptional<zod.ZodString>;
|
|
483
|
+
ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
|
|
484
|
+
}, zod_v4_core.$strip>;
|
|
485
|
+
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
325
486
|
currentUser: _orpc_server.Procedure<ServContext & {}, any, _orpc_contract.Schema<unknown, unknown>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
|
|
326
487
|
success: zod.ZodLiteral<true>;
|
|
327
488
|
data: zod.ZodObject<{
|
|
@@ -332,6 +493,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
332
493
|
displayName: zod.ZodOptional<zod.ZodString>;
|
|
333
494
|
avatarUrl: zod.ZodOptional<zod.ZodString>;
|
|
334
495
|
enabled: zod.ZodBoolean;
|
|
496
|
+
accountType: zod.ZodOptional<zod.ZodEnum<{
|
|
497
|
+
permanent: "permanent";
|
|
498
|
+
temporary: "temporary";
|
|
499
|
+
}>>;
|
|
500
|
+
accountStatus: zod.ZodOptional<zod.ZodEnum<{
|
|
501
|
+
active: "active";
|
|
502
|
+
dormant: "dormant";
|
|
503
|
+
closed: "closed";
|
|
504
|
+
}>>;
|
|
505
|
+
accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
506
|
+
lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
507
|
+
mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
|
|
335
508
|
emailVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
336
509
|
phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
337
510
|
createdAt: zod.ZodCoercedDate<unknown>;
|
|
@@ -381,6 +554,7 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
381
554
|
}, zod_v4_core.$strip>;
|
|
382
555
|
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
383
556
|
sendOtp: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
557
|
+
captcha: zod.ZodOptional<zod.ZodString>;
|
|
384
558
|
identifier: zod.ZodString;
|
|
385
559
|
}, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
|
|
386
560
|
success: zod.ZodLiteral<true>;
|
|
@@ -402,6 +576,7 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
402
576
|
}, zod_v4_core.$strip>;
|
|
403
577
|
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
404
578
|
register: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
579
|
+
captcha: zod.ZodOptional<zod.ZodString>;
|
|
405
580
|
username: zod.ZodString;
|
|
406
581
|
password: zod.ZodString;
|
|
407
582
|
email: zod.ZodOptional<zod.ZodString>;
|
|
@@ -419,6 +594,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
419
594
|
displayName: zod.ZodOptional<zod.ZodString>;
|
|
420
595
|
avatarUrl: zod.ZodOptional<zod.ZodString>;
|
|
421
596
|
enabled: zod.ZodBoolean;
|
|
597
|
+
accountType: zod.ZodOptional<zod.ZodEnum<{
|
|
598
|
+
permanent: "permanent";
|
|
599
|
+
temporary: "temporary";
|
|
600
|
+
}>>;
|
|
601
|
+
accountStatus: zod.ZodOptional<zod.ZodEnum<{
|
|
602
|
+
active: "active";
|
|
603
|
+
dormant: "dormant";
|
|
604
|
+
closed: "closed";
|
|
605
|
+
}>>;
|
|
606
|
+
accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
607
|
+
lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
608
|
+
mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
|
|
422
609
|
emailVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
423
610
|
phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
424
611
|
createdAt: zod.ZodCoercedDate<unknown>;
|
|
@@ -493,6 +680,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
493
680
|
displayName: zod.ZodOptional<zod.ZodString>;
|
|
494
681
|
avatarUrl: zod.ZodOptional<zod.ZodString>;
|
|
495
682
|
enabled: zod.ZodBoolean;
|
|
683
|
+
accountType: zod.ZodOptional<zod.ZodEnum<{
|
|
684
|
+
permanent: "permanent";
|
|
685
|
+
temporary: "temporary";
|
|
686
|
+
}>>;
|
|
687
|
+
accountStatus: zod.ZodOptional<zod.ZodEnum<{
|
|
688
|
+
active: "active";
|
|
689
|
+
dormant: "dormant";
|
|
690
|
+
closed: "closed";
|
|
691
|
+
}>>;
|
|
692
|
+
accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
693
|
+
lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
694
|
+
mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
|
|
496
695
|
emailVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
497
696
|
phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
498
697
|
createdAt: zod.ZodCoercedDate<unknown>;
|
|
@@ -515,6 +714,62 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
515
714
|
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
516
715
|
};
|
|
517
716
|
users: {
|
|
717
|
+
invite: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
718
|
+
metadata: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
|
|
719
|
+
email: zod.ZodOptional<zod.ZodString>;
|
|
720
|
+
username: zod.ZodString;
|
|
721
|
+
phone: zod.ZodOptional<zod.ZodString>;
|
|
722
|
+
displayName: zod.ZodOptional<zod.ZodString>;
|
|
723
|
+
accountType: zod.ZodOptional<zod.ZodEnum<{
|
|
724
|
+
permanent: "permanent";
|
|
725
|
+
temporary: "temporary";
|
|
726
|
+
}>>;
|
|
727
|
+
accountExpiresAt: zod.ZodOptional<zod.ZodCoercedDate<unknown>>;
|
|
728
|
+
roleIds: zod.ZodOptional<zod.ZodArray<zod.ZodString>>;
|
|
729
|
+
enabled: zod.ZodOptional<zod.ZodLiteral<true>>;
|
|
730
|
+
accountStatus: zod.ZodOptional<zod.ZodLiteral<"active">>;
|
|
731
|
+
}, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
|
|
732
|
+
success: zod.ZodLiteral<true>;
|
|
733
|
+
data: zod.ZodObject<{
|
|
734
|
+
id: zod.ZodString;
|
|
735
|
+
username: zod.ZodString;
|
|
736
|
+
email: zod.ZodOptional<zod.ZodString>;
|
|
737
|
+
phone: zod.ZodOptional<zod.ZodString>;
|
|
738
|
+
displayName: zod.ZodOptional<zod.ZodString>;
|
|
739
|
+
avatarUrl: zod.ZodOptional<zod.ZodString>;
|
|
740
|
+
enabled: zod.ZodBoolean;
|
|
741
|
+
accountType: zod.ZodOptional<zod.ZodEnum<{
|
|
742
|
+
permanent: "permanent";
|
|
743
|
+
temporary: "temporary";
|
|
744
|
+
}>>;
|
|
745
|
+
accountStatus: zod.ZodOptional<zod.ZodEnum<{
|
|
746
|
+
active: "active";
|
|
747
|
+
dormant: "dormant";
|
|
748
|
+
closed: "closed";
|
|
749
|
+
}>>;
|
|
750
|
+
accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
751
|
+
lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
752
|
+
mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
|
|
753
|
+
emailVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
754
|
+
phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
755
|
+
createdAt: zod.ZodCoercedDate<unknown>;
|
|
756
|
+
updatedAt: zod.ZodCoercedDate<unknown>;
|
|
757
|
+
metadata: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
|
|
758
|
+
}, zod_v4_core.$strip>;
|
|
759
|
+
}, zod_v4_core.$strip>, zod.ZodObject<{
|
|
760
|
+
success: zod.ZodLiteral<false>;
|
|
761
|
+
error: zod.ZodObject<{
|
|
762
|
+
code: zod.ZodUnion<readonly [zod.ZodString, zod.ZodNumber]>;
|
|
763
|
+
message: zod.ZodString;
|
|
764
|
+
traceId: zod.ZodOptional<zod.ZodString>;
|
|
765
|
+
httpStatus: zod.ZodOptional<zod.ZodNumber>;
|
|
766
|
+
system: zod.ZodOptional<zod.ZodString>;
|
|
767
|
+
module: zod.ZodOptional<zod.ZodString>;
|
|
768
|
+
cause: zod.ZodOptional<zod.ZodUnknown>;
|
|
769
|
+
suggestion: zod.ZodOptional<zod.ZodString>;
|
|
770
|
+
ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
|
|
771
|
+
}, zod_v4_core.$strip>;
|
|
772
|
+
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
518
773
|
list: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
519
774
|
page: zod.ZodOptional<zod.ZodCoercedNumber<unknown>>;
|
|
520
775
|
pageSize: zod.ZodOptional<zod.ZodCoercedNumber<unknown>>;
|
|
@@ -535,6 +790,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
535
790
|
displayName: zod.ZodOptional<zod.ZodString>;
|
|
536
791
|
avatarUrl: zod.ZodOptional<zod.ZodString>;
|
|
537
792
|
enabled: zod.ZodBoolean;
|
|
793
|
+
accountType: zod.ZodOptional<zod.ZodEnum<{
|
|
794
|
+
permanent: "permanent";
|
|
795
|
+
temporary: "temporary";
|
|
796
|
+
}>>;
|
|
797
|
+
accountStatus: zod.ZodOptional<zod.ZodEnum<{
|
|
798
|
+
active: "active";
|
|
799
|
+
dormant: "dormant";
|
|
800
|
+
closed: "closed";
|
|
801
|
+
}>>;
|
|
802
|
+
accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
803
|
+
lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
804
|
+
mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
|
|
538
805
|
emailVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
539
806
|
phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
540
807
|
createdAt: zod.ZodCoercedDate<unknown>;
|
|
@@ -571,6 +838,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
571
838
|
displayName: zod.ZodOptional<zod.ZodString>;
|
|
572
839
|
avatarUrl: zod.ZodOptional<zod.ZodString>;
|
|
573
840
|
enabled: zod.ZodBoolean;
|
|
841
|
+
accountType: zod.ZodOptional<zod.ZodEnum<{
|
|
842
|
+
permanent: "permanent";
|
|
843
|
+
temporary: "temporary";
|
|
844
|
+
}>>;
|
|
845
|
+
accountStatus: zod.ZodOptional<zod.ZodEnum<{
|
|
846
|
+
active: "active";
|
|
847
|
+
dormant: "dormant";
|
|
848
|
+
closed: "closed";
|
|
849
|
+
}>>;
|
|
850
|
+
accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
851
|
+
lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
852
|
+
mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
|
|
574
853
|
emailVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
575
854
|
phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
576
855
|
createdAt: zod.ZodCoercedDate<unknown>;
|
|
@@ -592,6 +871,16 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
592
871
|
}, zod_v4_core.$strip>;
|
|
593
872
|
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
594
873
|
create: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
874
|
+
accountType: zod.ZodOptional<zod.ZodEnum<{
|
|
875
|
+
permanent: "permanent";
|
|
876
|
+
temporary: "temporary";
|
|
877
|
+
}>>;
|
|
878
|
+
accountStatus: zod.ZodOptional<zod.ZodEnum<{
|
|
879
|
+
active: "active";
|
|
880
|
+
dormant: "dormant";
|
|
881
|
+
closed: "closed";
|
|
882
|
+
}>>;
|
|
883
|
+
accountExpiresAt: zod.ZodOptional<zod.ZodCoercedDate<unknown>>;
|
|
595
884
|
username: zod.ZodString;
|
|
596
885
|
email: zod.ZodOptional<zod.ZodString>;
|
|
597
886
|
phone: zod.ZodOptional<zod.ZodString>;
|
|
@@ -610,6 +899,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
610
899
|
displayName: zod.ZodOptional<zod.ZodString>;
|
|
611
900
|
avatarUrl: zod.ZodOptional<zod.ZodString>;
|
|
612
901
|
enabled: zod.ZodBoolean;
|
|
902
|
+
accountType: zod.ZodOptional<zod.ZodEnum<{
|
|
903
|
+
permanent: "permanent";
|
|
904
|
+
temporary: "temporary";
|
|
905
|
+
}>>;
|
|
906
|
+
accountStatus: zod.ZodOptional<zod.ZodEnum<{
|
|
907
|
+
active: "active";
|
|
908
|
+
dormant: "dormant";
|
|
909
|
+
closed: "closed";
|
|
910
|
+
}>>;
|
|
911
|
+
accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
912
|
+
lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
913
|
+
mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
|
|
613
914
|
emailVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
614
915
|
phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
615
916
|
createdAt: zod.ZodCoercedDate<unknown>;
|
|
@@ -631,6 +932,16 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
631
932
|
}, zod_v4_core.$strip>;
|
|
632
933
|
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
633
934
|
update: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
935
|
+
accountType: zod.ZodOptional<zod.ZodEnum<{
|
|
936
|
+
permanent: "permanent";
|
|
937
|
+
temporary: "temporary";
|
|
938
|
+
}>>;
|
|
939
|
+
accountStatus: zod.ZodOptional<zod.ZodEnum<{
|
|
940
|
+
active: "active";
|
|
941
|
+
dormant: "dormant";
|
|
942
|
+
closed: "closed";
|
|
943
|
+
}>>;
|
|
944
|
+
accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
634
945
|
id: zod.ZodString;
|
|
635
946
|
username: zod.ZodOptional<zod.ZodString>;
|
|
636
947
|
email: zod.ZodOptional<zod.ZodString>;
|
|
@@ -650,6 +961,18 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
650
961
|
displayName: zod.ZodOptional<zod.ZodString>;
|
|
651
962
|
avatarUrl: zod.ZodOptional<zod.ZodString>;
|
|
652
963
|
enabled: zod.ZodBoolean;
|
|
964
|
+
accountType: zod.ZodOptional<zod.ZodEnum<{
|
|
965
|
+
permanent: "permanent";
|
|
966
|
+
temporary: "temporary";
|
|
967
|
+
}>>;
|
|
968
|
+
accountStatus: zod.ZodOptional<zod.ZodEnum<{
|
|
969
|
+
active: "active";
|
|
970
|
+
dormant: "dormant";
|
|
971
|
+
closed: "closed";
|
|
972
|
+
}>>;
|
|
973
|
+
accountExpiresAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
974
|
+
lastLoginAt: zod.ZodOptional<zod.ZodNullable<zod.ZodCoercedDate<unknown>>>;
|
|
975
|
+
mustChangePassword: zod.ZodOptional<zod.ZodBoolean>;
|
|
653
976
|
emailVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
654
977
|
phoneVerified: zod.ZodOptional<zod.ZodBoolean>;
|
|
655
978
|
createdAt: zod.ZodCoercedDate<unknown>;
|
|
@@ -848,6 +1171,26 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
848
1171
|
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
849
1172
|
};
|
|
850
1173
|
permissions: {
|
|
1174
|
+
setSensitiveOperations: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
1175
|
+
id: zod.ZodString;
|
|
1176
|
+
sensitiveOperations: zod.ZodPipe<zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>, zod.ZodTransform<string[], string[] | null | undefined>>;
|
|
1177
|
+
}, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
|
|
1178
|
+
success: zod.ZodLiteral<true>;
|
|
1179
|
+
data: zod.ZodVoid;
|
|
1180
|
+
}, zod_v4_core.$strip>, zod.ZodObject<{
|
|
1181
|
+
success: zod.ZodLiteral<false>;
|
|
1182
|
+
error: zod.ZodObject<{
|
|
1183
|
+
code: zod.ZodUnion<readonly [zod.ZodString, zod.ZodNumber]>;
|
|
1184
|
+
message: zod.ZodString;
|
|
1185
|
+
traceId: zod.ZodOptional<zod.ZodString>;
|
|
1186
|
+
httpStatus: zod.ZodOptional<zod.ZodNumber>;
|
|
1187
|
+
system: zod.ZodOptional<zod.ZodString>;
|
|
1188
|
+
module: zod.ZodOptional<zod.ZodString>;
|
|
1189
|
+
cause: zod.ZodOptional<zod.ZodUnknown>;
|
|
1190
|
+
suggestion: zod.ZodOptional<zod.ZodString>;
|
|
1191
|
+
ext: zod.ZodOptional<zod.ZodRecord<zod.ZodString, zod.ZodUnknown>>;
|
|
1192
|
+
}, zod_v4_core.$strip>;
|
|
1193
|
+
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
851
1194
|
list: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
852
1195
|
page: zod.ZodOptional<zod.ZodCoercedNumber<unknown>>;
|
|
853
1196
|
pageSize: zod.ZodOptional<zod.ZodCoercedNumber<unknown>>;
|
|
@@ -861,6 +1204,7 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
861
1204
|
success: zod.ZodLiteral<true>;
|
|
862
1205
|
data: zod.ZodObject<{
|
|
863
1206
|
items: zod.ZodArray<zod.ZodObject<{
|
|
1207
|
+
sensitiveOperations: zod.ZodPipe<zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>, zod.ZodTransform<string[], string[] | null | undefined>>;
|
|
864
1208
|
id: zod.ZodString;
|
|
865
1209
|
code: zod.ZodString;
|
|
866
1210
|
name: zod.ZodString;
|
|
@@ -898,6 +1242,7 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
898
1242
|
}, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
|
|
899
1243
|
success: zod.ZodLiteral<true>;
|
|
900
1244
|
data: zod.ZodNullable<zod.ZodObject<{
|
|
1245
|
+
sensitiveOperations: zod.ZodPipe<zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>, zod.ZodTransform<string[], string[] | null | undefined>>;
|
|
901
1246
|
id: zod.ZodString;
|
|
902
1247
|
code: zod.ZodString;
|
|
903
1248
|
name: zod.ZodString;
|
|
@@ -927,6 +1272,7 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
927
1272
|
}, zod_v4_core.$strip>;
|
|
928
1273
|
}, zod_v4_core.$strip>], "success">, Record<never, never>, Record<never, never>>;
|
|
929
1274
|
create: _orpc_server.Procedure<ServContext & {}, any, zod.ZodObject<{
|
|
1275
|
+
sensitiveOperations: zod.ZodDefault<zod.ZodArray<zod.ZodString>>;
|
|
930
1276
|
code: zod.ZodString;
|
|
931
1277
|
name: zod.ZodString;
|
|
932
1278
|
description: zod.ZodOptional<zod.ZodString>;
|
|
@@ -940,6 +1286,7 @@ declare function createIamProcedures(deps: IamProcedureDeps): {
|
|
|
940
1286
|
}, zod_v4_core.$strip>, zod.ZodDiscriminatedUnion<[zod.ZodObject<{
|
|
941
1287
|
success: zod.ZodLiteral<true>;
|
|
942
1288
|
data: zod.ZodObject<{
|
|
1289
|
+
sensitiveOperations: zod.ZodPipe<zod.ZodOptional<zod.ZodNullable<zod.ZodArray<zod.ZodString>>>, zod.ZodTransform<string[], string[] | null | undefined>>;
|
|
943
1290
|
id: zod.ZodString;
|
|
944
1291
|
code: zod.ZodString;
|
|
945
1292
|
name: zod.ZodString;
|
package/dist/features/iam.js
CHANGED
|
@@ -1,13 +1,27 @@
|
|
|
1
1
|
import { mapHaiResult } from '../chunk-XKCLD42I.js';
|
|
2
|
-
import { implement, servM } from '../chunk-
|
|
2
|
+
import { implement, servM } from '../chunk-N6IOKLQY.js';
|
|
3
3
|
import { apiContract } from '@h-ai/api-contract';
|
|
4
|
-
import { core,
|
|
4
|
+
import { core, err, HaiCommonError, ok } from '@h-ai/core';
|
|
5
5
|
|
|
6
6
|
var iamContract = apiContract.iam;
|
|
7
7
|
var iamFeatureLogger = core.logger.child({ module: "serv", scope: "feature-iam" });
|
|
8
8
|
function createIamProcedures(deps) {
|
|
9
9
|
const { iam } = deps;
|
|
10
|
-
|
|
10
|
+
async function sensitive(context, operation, run) {
|
|
11
|
+
const policy = iam.publicConfig?.reauthentication;
|
|
12
|
+
if (policy?.enabled) {
|
|
13
|
+
const checked = await iam.auth.checkSensitiveOperation(context.accessToken ?? "", operation, context.request.headers.get("x-hai-reauthentication") ?? void 0);
|
|
14
|
+
if (!checked.success)
|
|
15
|
+
return checked;
|
|
16
|
+
}
|
|
17
|
+
return run();
|
|
18
|
+
}
|
|
19
|
+
return implement(iamContract).context().route("auth.reauthenticate").auth().handle(({ input, context }) => iam.auth.reauthenticate(context.accessToken ?? "", input.password, input.operation)).route("auth.login", ({ input, context }) => iam.auth.login(input, context)).route("auth.createCaptcha", ({ input }) => iam.auth.createCaptcha(input)).route("auth.loginWithOtp", ({ input, context }) => iam.auth.loginWithOtp(input, context)).route("auth.loginWithLdap", ({ input, context }) => iam.auth.loginWithLdap(input, context)).route("auth.publicConfig", () => iam.getPublicConfig()).route("auth.renewPassword", ({ input }) => iam.user.renewPassword(input)).route("auth.requestPasswordReset", ({ input }) => iam.user.requestPasswordReset(input.identifier, input)).route("auth.confirmPasswordReset", ({ input }) => iam.user.confirmPasswordReset(input.token, input.newPassword)).route("auth.logout", ({ input, context }) => {
|
|
20
|
+
const token = input.accessToken ?? context.accessToken;
|
|
21
|
+
if (!token)
|
|
22
|
+
return err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale }));
|
|
23
|
+
return iam.auth.logout(token);
|
|
24
|
+
}).route("auth.closeSession", ({ input, context }) => {
|
|
11
25
|
const token = input.accessToken ?? context.accessToken;
|
|
12
26
|
if (!token)
|
|
13
27
|
return err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale }));
|
|
@@ -26,7 +40,7 @@ function createIamProcedures(deps) {
|
|
|
26
40
|
);
|
|
27
41
|
}).route("auth.refresh", async ({ input }) => {
|
|
28
42
|
return mapHaiResult(await iam.session.refresh(input.refreshToken), (tokens) => ({ tokens }));
|
|
29
|
-
}).route("auth.sendOtp", ({ input }) => iam.auth.sendOtp(input.identifier)).route("auth.register", ({ input }) => iam.auth.registerAndLogin(input)).route("auth.changePassword").auth().handle(({ input, context }) => {
|
|
43
|
+
}).route("auth.sendOtp", ({ input }) => iam.auth.sendOtp(input.identifier, input)).route("auth.register", ({ input, context }) => iam.auth.registerAndLogin(input, context)).route("auth.changePassword").auth().handle(({ input, context }) => {
|
|
30
44
|
const token = context.accessToken;
|
|
31
45
|
if (!token)
|
|
32
46
|
return err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale }));
|
|
@@ -36,21 +50,26 @@ function createIamProcedures(deps) {
|
|
|
36
50
|
if (!token)
|
|
37
51
|
return err(HaiCommonError.UNAUTHORIZED, servM("serv_errorUnauthorized", { locale: context.locale }));
|
|
38
52
|
return iam.user.updateCurrentUser(token, input);
|
|
39
|
-
}).route("users.list").permission("iam.users.read").handle(({ input }) => iam.user.listUsers(input)).route("users.get").permission("iam.users.read").handle(({ input }) => iam.user.getUser(input.id, { include: ["roles"] })).route("users.create").permission("iam.users.write").handle(({ input }) => createUser(iam, input)).route("users.update").permission("iam.users.write").handle(({ input }) => updateUser(iam, input)).route("users.delete").permission("iam.users.write").handle(({ input, context }) => {
|
|
53
|
+
}).route("users.list").permission("iam.users.read").handle(({ input }) => iam.user.listUsers(input)).route("users.get").permission("iam.users.read").handle(({ input }) => iam.user.getUser(input.id, { include: ["roles"] })).route("users.create").permission("iam.users.write").handle(({ input, context }) => sensitive(context, "iam.users.create", () => createUser(iam, input))).route("users.invite").permission("iam.users.write").handle(({ input, context }) => sensitive(context, "iam.users.invite", () => createUser(iam, input))).route("users.update").permission("iam.users.write").handle(({ input, context }) => sensitive(context, "iam.users.update", () => updateUser(iam, input))).route("users.delete").permission("iam.users.write").handle(({ input, context }) => {
|
|
40
54
|
if (context.session.userId === input.id)
|
|
41
55
|
return err(HaiCommonError.FORBIDDEN, servM("serv_iamCannotDeleteCurrentUser", { locale: context.locale }));
|
|
42
|
-
return iam.user.deleteUser(input.id);
|
|
43
|
-
}).route("users.resetPassword").permission("iam.users.write").handle(({ input }) => iam.user.adminResetPassword(input.id, input.newPassword)).route("roles.list").permission("iam.roles.read").handle(() => iam.authz.getAllRoles()).route("roles.get").permission("iam.roles.read").handle(({ input }) => iam.authz.getRole(input.id)).route("roles.create").permission("iam.roles.write").handle(({ input }) => iam.authz.createRole(input)).route("roles.update").permission("iam.roles.write").handle(({ input }) => {
|
|
56
|
+
return sensitive(context, "iam.users.delete", () => iam.user.deleteUser(input.id));
|
|
57
|
+
}).route("users.resetPassword").permission("iam.users.write").handle(({ input, context }) => sensitive(context, "iam.users.resetPassword", () => iam.user.adminResetPassword(input.id, input.newPassword))).route("roles.list").permission("iam.roles.read").handle(() => iam.authz.getAllRoles()).route("roles.get").permission("iam.roles.read").handle(({ input }) => iam.authz.getRole(input.id)).route("roles.create").permission("iam.roles.write").handle(({ input, context }) => sensitive(context, "iam.roles.create", () => iam.authz.createRole(input))).route("roles.update").permission("iam.roles.write").handle(({ input, context }) => {
|
|
44
58
|
const { id, ...data } = input;
|
|
45
|
-
return iam.authz.updateRole(id, data);
|
|
46
|
-
}).route("roles.delete").permission("iam.roles.write").handle(({ input }) => iam.authz.deleteRole(input.id)).route("permissions.list").permission("iam.permissions.read").handle(({ input }) => iam.authz.getAllPermissions(input)).route("permissions.get").permission("iam.permissions.read").handle(({ input }) => iam.authz.getPermission(input.id)).route("permissions.create").permission("iam.permissions.write").handle(({ input }) => iam.authz.createPermission(input)).route("permissions.delete").permission("iam.permissions.write").handle(({ input }) => iam.authz.deletePermission(input.id)).build();
|
|
59
|
+
return sensitive(context, "iam.roles.update", () => iam.authz.updateRole(id, data));
|
|
60
|
+
}).route("roles.delete").permission("iam.roles.write").handle(({ input, context }) => sensitive(context, "iam.roles.delete", () => iam.authz.deleteRole(input.id))).route("permissions.list").permission("iam.permissions.read").handle(({ input }) => iam.authz.getAllPermissions(input)).route("permissions.get").permission("iam.permissions.read").handle(({ input }) => iam.authz.getPermission(input.id)).route("permissions.create").permission("iam.permissions.write").handle(({ input, context }) => sensitive(context, "iam.permissions.create", () => iam.authz.createPermission(input))).route("permissions.setSensitiveOperations").permission("iam.permissions.write").handle(({ input, context }) => sensitive(context, "iam.permissions.sensitiveOperations", () => iam.authz.setPermissionSensitiveOperations(input.id, input.sensitiveOperations))).route("permissions.delete").permission("iam.permissions.write").handle(({ input, context }) => sensitive(context, "iam.permissions.delete", () => iam.authz.deletePermission(input.id))).build();
|
|
47
61
|
}
|
|
48
62
|
async function createUser(iam, input) {
|
|
49
|
-
const
|
|
63
|
+
const invited = !("password" in input);
|
|
64
|
+
const registerResult = "password" in input ? await iam.user.createUser(input) : await iam.user.inviteUser(input);
|
|
50
65
|
if (!registerResult.success)
|
|
51
66
|
return registerResult;
|
|
52
67
|
const userId = registerResult.data.user.id;
|
|
53
68
|
async function rollback(reason) {
|
|
69
|
+
if (invited) {
|
|
70
|
+
iamFeatureLogger.error("Invited account requires configuration repair", { userId, reason });
|
|
71
|
+
return;
|
|
72
|
+
}
|
|
54
73
|
const deleteResult = await iam.user.deleteUser(userId);
|
|
55
74
|
if (!deleteResult.success)
|
|
56
75
|
iamFeatureLogger.error("createUser rollback failed, orphan user may exist", { userId, reason, error: deleteResult.error });
|