@happyvertical/smrt-users 0.51.18 → 0.51.20

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as normalizeOperationPermissionAction, A as getConfiguredAncestorReadPolicy, B as TenantCollection, C as decodeOidcTransaction, Ct as SessionCollection, Dt as UsersCliAuthRequest, E as resolveOidcProviderConfig, Et as generateSessionId, G as assertTenantTableName, H as MAX_TENANT_HIERARCHY_DEPTH, I as UserEmailKeyBackfillError, J as DEFAULT_ROLE_PERMISSION_PATTERNS, K as planTenantHierarchy, L as backfillUserEmailKeys, M as normalizeAncestorReadPolicy, N as OidcProvisioningError, O as ANCESTOR_READ_ACTION, P as UserCollection, Q as deriveOperationPermissionSlug, R as TenantPermissionOverrideCollection, S as OidcLoginService, St as UsersCliAuthRequestCollection, T as getUsersOidcConfig, Tt as Session, U as TenantHierarchyError, V as Tenant, W as applyTenantHierarchyUpdates, X as PermissionCatalogService, Y as RolePermissionCollection, Z as deriveOperationPermissionCollectionName, _ as readMobileBearerToken, _t as UsersCliAuthApproveLimitCollection, a as TerminalAuthRateLimitError, at as PermissionCollection, b as PermissionResolver, bt as isValidEmail, c as assertOperationPermission, ct as MembershipOverride, d as getCurrentSessionPermissionContext, dt as GroupRoleCollection, et as registerPermissionDefinitions, f as getRequestScopedDatabase, ft as GroupRole, g as MobileAuthService, gt as Group, h as MobileAuthError, ht as GroupCollection, i as TerminalAuthError, it as Role, j as isAncestorReadableSlug, k as DEFAULT_ANCESTOR_READ_MAX_DEPTH, l as checkOperationPermission, lt as MembershipCollection, m as withSessionPermissionContext, mt as GroupMember, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as RolePermission, o as TerminalAuthService, ot as Permission, p as withPrincipalPermissionContext, pt as GroupMemberCollection, q as recordTenantHierarchyChanges, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as RoleCollection, s as OperationPermissionError, st as MembershipOverrideCollection, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as syncPermissionCatalog, u as hasOperationPermission, ut as Membership, v as validateMobileRedirectUri, vt as UsersCliAuthApproveLimit, w as encodeOidcTransaction, wt as DEFAULT_SESSION_TTL, x as OidcLoginError, xt as normalizeEmail, y as SessionService, yt as User, z as TenantPermissionOverride } from "./chunks/TerminalAuthService-C4uNNkwZ.js";
+import { $ as deriveOperationPermissionSlug, A as DEFAULT_ANCESTOR_READ_MAX_DEPTH, B as TenantPermissionOverride, C as OidcLoginService, Ct as UsersCliAuthRequestCollection, D as resolveOidcProviderConfig, Dt as generateSessionId, E as getUsersOidcConfig, Et as Session, F as UserCollection, G as applyTenantHierarchyUpdates, H as Tenant, J as recordTenantHierarchyChanges, K as assertTenantTableName, L as UserEmailKeyBackfillError, M as isAncestorReadableSlug, N as normalizeAncestorReadPolicy, Ot as UsersCliAuthRequest, P as OidcProvisioningError, Q as deriveOperationPermissionCollectionName, R as backfillUserEmailKeys, S as OidcLoginError, St as normalizeEmail, T as encodeOidcTransaction, Tt as DEFAULT_SESSION_TTL, U as MAX_TENANT_HIERARCHY_DEPTH, V as TenantCollection, W as TenantHierarchyError, X as RolePermissionCollection, Y as DEFAULT_ROLE_PERMISSION_PATTERNS, Z as PermissionCatalogService, _ as readMobileBearerToken, _t as Group, a as TerminalAuthRateLimitError, at as Role, b as PermissionResolver, bt as User, c as assertOperationPermission, ct as MembershipOverrideCollection, d as getCurrentSessionPermissionContext, dt as Membership, et as normalizeOperationPermissionAction, f as getRequestScopedDatabase, ft as GroupRoleCollection, g as MobileAuthService, gt as GroupCollection, h as MobileAuthError, ht as GroupMember, i as TerminalAuthError, it as RoleCollection, j as getConfiguredAncestorReadPolicy, k as ANCESTOR_READ_ACTION, l as checkOperationPermission, lt as MembershipOverride, m as withSessionPermissionContext, mt as GroupMemberCollection, n as DEFAULT_CLI_AUTH_REQUEST_TTL_SECONDS, nt as syncPermissionCatalog, o as TerminalAuthService, ot as PermissionCollection, p as withPrincipalPermissionContext, pt as GroupRole, q as planTenantHierarchy, r as DEFAULT_CLI_SESSION_TTL_SECONDS, rt as RolePermission, s as OperationPermissionError, st as Permission, t as DEFAULT_CLI_AUTH_POLL_INTERVAL_SECONDS, tt as registerPermissionDefinitions, u as hasOperationPermission, ut as MembershipCollection, v as validateMobileRedirectUri, vt as UsersCliAuthApproveLimitCollection, w as decodeOidcTransaction, wt as SessionCollection, x as withoutListBounds, xt as isValidEmail, y as SessionService, yt as UsersCliAuthApproveLimit, z as TenantPermissionOverrideCollection } from "./chunks/TerminalAuthService-CSshawK3.js";
 import { a as MembershipStatus, c as TenantPermissionEffect, i as DEFAULT_TENANT_POLICY, l as TenantStatus, n as DEFAULT_ROLES, o as OverrideEffect, r as DEFAULT_ROLE_SLUGS, s as SessionStatus, t as AccessRequestStatus, u as UserStatus } from "./chunks/types-DFqeph0R.js";
 import { ObjectRegistry, SmrtCollection, SmrtObject, field, findManifestEntryByQualifiedName, foreignKey, isUniqueViolationError, registerRetentionTask, smrt, unregisterRetentionTask } from "@happyvertical/smrt-core";
 import { PROFILE_EMAIL_KEY_BACKFILL_NAME, Person, ProfileCollection, ProfileTypeCollection, normalizeIdentityEmail } from "@happyvertical/smrt-profiles";
@@ -1194,7 +1194,7 @@ var MagicLinkService = class MagicLinkService {
 	* The caller is responsible for emailing the token to the user.
 	*/
 	async generate(email) {
-		const { SignJWT } = await import("./chunks/TerminalAuthService-C4uNNkwZ.js").then((n) => n.D);
+		const { SignJWT } = await import("./chunks/TerminalAuthService-CSshawK3.js").then((n) => n.O);
 		const key = await this.getSigningKey();
 		const nonce = crypto.randomUUID();
 		const normalizedEmail = normalizeEmail(email);
@@ -1223,7 +1223,7 @@ var MagicLinkService = class MagicLinkService {
 	* @throws {MagicLinkError} If the token is invalid, expired, or already used
 	*/
 	async verify(token) {
-		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-C4uNNkwZ.js").then((n) => n.D);
+		const { jwtVerify, errors } = await import("./chunks/TerminalAuthService-CSshawK3.js").then((n) => n.O);
 		const key = await this.getSigningKey();
 		let payload;
 		try {
@@ -1561,8 +1561,8 @@ async function checkResourceOperationPermission(options) {
 		allowed: false,
 		reason: "resource_grant_missing"
 	};
-	const grants = await (await ResourceGrantCollection.create(options)).findExact(options.resource.tenantId, userId, options.resource.resourceType, options.resource.resourceId, tenant.permission);
-	const collection = await ResourceGrantCollection.create(options);
+	const collection = await ResourceGrantCollection.create(withoutListBounds(options));
+	const grants = await collection.findExact(options.resource.tenantId, userId, options.resource.resourceType, options.resource.resourceId, tenant.permission);
 	const active = [];
 	for (const grant2 of grants) if (await hasActiveAncestors(collection, grant2)) active.push(grant2);
 	const deny = active.find((grant2) => grant2.effect === "deny");
@@ -1672,9 +1672,10 @@ var TenantService = class TenantService {
 	* Initialize collections
 	*/
 	async initialize() {
-		this.tenantCollection = await TenantCollection.create(this.options);
-		this.membershipCollection = await MembershipCollection.create(this.options);
-		this.roleCollection = await RoleCollection.create(this.options);
+		const options = withoutListBounds(this.options);
+		this.tenantCollection = await TenantCollection.create(options);
+		this.membershipCollection = await MembershipCollection.create(options);
+		this.roleCollection = await RoleCollection.create(options);
 		await this.roleCollection.seedSystemRoles();
 	}
 	/**