@headless-lms/adapter-db 0.2.0 → 0.3.0

package/dist/repositories/entitlements.d.ts

@@ -1,6 +1,6 @@
 import { DbExecutor } from "../client.js";
-import { Entitlement, EntitlementsQuery, GrantEntitlementInput, Logger, Page } from "@headless-lms/core/types";
-import { EntitlementsRepository } from "@headless-lms/core/entitlements";
+import { ContentType, Entitlement, EntitlementsQuery, GrantEntitlementInput, Logger, Page, SpaceMember, SpaceMemberStatus } from "@headless-lms/core/types";
+import { AccessFacts, EndingGrant, EndingGrantKey, EntitlementNotice, EntitlementsRepository, GrantKey, GrantTarget, InsertSpaceMemberInput, SpaceMembersQuery } from "@headless-lms/core/entitlements";
 //#region src/repositories/entitlements.d.ts
 declare class DrizzleEntitlementsRepository implements EntitlementsRepository {
   private readonly db;
@@ -15,14 +15,34 @@ declare class DrizzleEntitlementsRepository implements EntitlementsRepository {
    *  constraint), so the upsert is inferred on whichever of the two partial
    *  uniques the target uses. */
   insert(orgId: string, input: GrantEntitlementInput): Promise<Entitlement>;
+  insertIfAbsent(orgId: string, input: GrantEntitlementInput): Promise<Entitlement | null>;
+  lockGrant(orgId: string, key: GrantKey): Promise<Entitlement | null>;
+  setExpiresAt(orgId: string, id: string, expiresAt: Date | null): Promise<Entitlement | null>;
   setStatus(orgId: string, id: string, status: "active" | "revoked"): Promise<Entitlement | null>;
-  /** Existence check scoped to the course case: same status predicate as
-   *  `list` (revoked never counts; an elapsed expiry reads as expired, not
-   *  active). The course is reachable two ways — granted directly, or granted
-   *  through a bundle that holds it — and either way the row is joined to
-   *  content_items and constrained to type = 'course', so a grant on some other
-   *  content type can never be mistaken for course access. */
-  hasCourseAccess(orgId: string, orgUserId: string, courseId: string): Promise<boolean>;
+  hasAccess(orgId: string, orgUserId: string, contentId: string): Promise<boolean>;
+  listAccessibleContent(orgId: string, orgUserId: string, type?: ContentType): Promise<string[]>;
+  hasCommunityAccess(orgId: string, orgUserId: string, communityId: string): Promise<boolean>;
+  private holds;
+  communitiesOpenedBy(orgId: string, grant: GrantTarget): Promise<string[]>;
+  accessAmong(orgId: string, communityId: string, spaceId: string | null, orgUserIds: string[]): Promise<AccessFacts[]>;
+  findSpaceMember(orgId: string, spaceId: string, orgUserId: string): Promise<SpaceMember | null>;
+  listSpaceMembersFor(orgId: string, orgUserId: string, communityId: string): Promise<SpaceMember[]>;
+  lockSpaceMember(orgId: string, spaceId: string, orgUserId: string): Promise<SpaceMember | null>;
+  listSpaceMembers(orgId: string, spaceId: string, query: SpaceMembersQuery): Promise<Page<SpaceMember>>;
+  insertSpaceMember(orgId: string, input: InsertSpaceMemberInput): Promise<SpaceMember>;
+  updateSpaceMemberStatus(orgId: string, id: string, status: SpaceMemberStatus): Promise<SpaceMember | null>;
+  deleteSpaceMember(orgId: string, id: string): Promise<void>;
+  countActiveSpaceMembers(orgId: string, spaceId: string): Promise<number>;
+  activeSpaceIds(orgId: string, orgUserId: string, communityId: string): Promise<string[]>;
+  listGrantsExpiredBy(orgId: string, now: Date, limit: number, afterId?: string): Promise<Entitlement[]>;
+  listGrantsEndingBetween(orgId: string, after: Date, until: Date, limit: number, afterKey?: EndingGrantKey): Promise<EndingGrant[]>;
+  hasDueNotices(orgId: string, now: Date, until: Date): Promise<boolean>;
+  claimNotice(orgId: string, notice: EntitlementNotice, now: Date): Promise<boolean>;
+  private expiredUnnoticed;
+  private endingUnnoticed;
+  communityModeratorIds(orgId: string, communityId: string): Promise<string[]>;
+  communityMemberIds(orgId: string, communityId: string): Promise<string[]>;
+  communityIdsOpenedFor(orgId: string, orgUserId: string): Promise<string[]>;
 }
 //#endregion
 export { DrizzleEntitlementsRepository };

package/dist/repositories/entitlements.js

@@ -1,19 +1,38 @@
+import { bundles, communities, contentItems, courses, downloads } from "../schema/content.js";
 import { users } from "../schema/identity.js";
 import { orgUsers } from "../schema/organizations.js";
-import { bundleItems, bundles, contentItems, courses, downloads } from "../schema/content.js";
-import { entitlements } from "../schema/entitlements.js";
+import { contentAccess, entitlementEndingSoonNotices, entitlementExpiryNotices, entitlements, spaceMembers } from "../schema/entitlements.js";
 import "../schema/index.js";
 import { translateDbErrors } from "./pg-errors.js";
-import { and, asc, desc, eq, ilike, or, sql } from "drizzle-orm";
-import { alias } from "drizzle-orm/pg-core";
+import { communityMember, grantExpired, grantIsActive, grantOpens, holdsCommunity } from "./grant-covers.js";
+import { and, asc, desc, eq, gt, ilike, inArray, or, sql } from "drizzle-orm";
 import { noopLogger } from "@headless-lms/core/shared/logger";
+import { ROLES, canModerate } from "@headless-lms/core/organizations";
 //#region src/repositories/entitlements.ts
+const MODERATING_ROLES = ROLES.filter((role) => canModerate(role));
 const derivedStatus = sql`case
   when ${entitlements.status} = 'revoked' then 'revoked'
-  when ${entitlements.expiresAt} is not null and ${entitlements.expiresAt} < now() then 'expired'
+  when ${grantExpired(entitlements.expiresAt)} then 'expired'
   else 'active'
 end`;
-const contentTitle = sql`coalesce(${courses.title}, ${downloads.title}, ${bundles.name})`;
+function at(date) {
+	return sql`${date.toISOString()}::timestamptz`;
+}
+const expiryNoticed = sql`exists (
+  select 1 from ${entitlementExpiryNotices}
+  where ${entitlementExpiryNotices.orgId} = ${entitlements.orgId}
+    and ${entitlementExpiryNotices.entitlementId} = ${entitlements.id}
+    and ${entitlementExpiryNotices.expiresAt} = ${entitlements.expiresAt}
+)`;
+const endingSoonNoticed = sql`exists (
+  select 1 from ${entitlementEndingSoonNotices}
+  where ${entitlementEndingSoonNotices.orgId} = ${entitlements.orgId}
+    and ${entitlementEndingSoonNotices.entitlementId} = ${entitlements.id}
+    and ${entitlementEndingSoonNotices.communityId} = ${communities.id}
+    and ${entitlementEndingSoonNotices.expiresAt} = ${entitlements.expiresAt}
+)`;
+const opensPublishedCommunity = and(eq(communities.orgId, entitlements.orgId), eq(communities.status, "published"), grantOpens(entitlements, sql`${communities.id}`, "community"));
+const contentTitle = sql`coalesce(${courses.title}, ${downloads.title}, ${communities.title}, ${bundles.name})`;
 const sortColumns = {
 	firstName: users.firstName,
 	lastName: users.lastName,
@@ -63,7 +82,7 @@ var DrizzleEntitlementsRepository = class {
 	*  LEFT JOIN per concrete content table (title), or bundles (name). Both target
 	*  joins are LEFT — a row carries one of the two, never both. */
 	joined(where) {
-		return this.db.select(selection).from(entitlements).innerJoin(orgUsers, and(eq(orgUsers.orgId, entitlements.orgId), eq(orgUsers.id, entitlements.orgUserId))).innerJoin(users, eq(users.id, orgUsers.userId)).leftJoin(contentItems, and(eq(contentItems.orgId, entitlements.orgId), eq(contentItems.id, entitlements.contentId))).leftJoin(bundles, and(eq(bundles.orgId, entitlements.orgId), eq(bundles.id, entitlements.bundleId))).leftJoin(courses, and(eq(courses.orgId, entitlements.orgId), eq(courses.id, entitlements.contentId))).leftJoin(downloads, and(eq(downloads.orgId, entitlements.orgId), eq(downloads.id, entitlements.contentId))).where(where);
+		return this.db.select(selection).from(entitlements).innerJoin(orgUsers, and(eq(orgUsers.orgId, entitlements.orgId), eq(orgUsers.id, entitlements.orgUserId))).innerJoin(users, eq(users.id, orgUsers.userId)).leftJoin(contentItems, and(eq(contentItems.orgId, entitlements.orgId), eq(contentItems.id, entitlements.contentId))).leftJoin(bundles, and(eq(bundles.orgId, entitlements.orgId), eq(bundles.id, entitlements.bundleId))).leftJoin(courses, and(eq(courses.orgId, entitlements.orgId), eq(courses.id, entitlements.contentId))).leftJoin(downloads, and(eq(downloads.orgId, entitlements.orgId), eq(downloads.id, entitlements.contentId))).leftJoin(communities, and(eq(communities.orgId, entitlements.orgId), eq(communities.id, entitlements.contentId))).where(where);
 	}
 	async list(orgId, query) {
 		const conditions = [eq(entitlements.orgId, orgId)];
@@ -87,7 +106,7 @@ var DrizzleEntitlementsRepository = class {
 		} else orderBy = desc(entitlements.grantedAt);
 		const offset = (query.page - 1) * query.pageSize;
 		const rows = await this.joined(where).orderBy(orderBy).limit(query.pageSize).offset(offset);
-		const [{ total } = { total: 0 }] = await this.db.select({ total: sql`cast(count(*) as int)` }).from(entitlements).innerJoin(orgUsers, and(eq(orgUsers.orgId, entitlements.orgId), eq(orgUsers.id, entitlements.orgUserId))).innerJoin(users, eq(users.id, orgUsers.userId)).leftJoin(contentItems, and(eq(contentItems.orgId, entitlements.orgId), eq(contentItems.id, entitlements.contentId))).leftJoin(bundles, and(eq(bundles.orgId, entitlements.orgId), eq(bundles.id, entitlements.bundleId))).leftJoin(courses, and(eq(courses.orgId, entitlements.orgId), eq(courses.id, entitlements.contentId))).leftJoin(downloads, and(eq(downloads.orgId, entitlements.orgId), eq(downloads.id, entitlements.contentId))).where(where);
+		const [{ total } = { total: 0 }] = await this.db.select({ total: sql`cast(count(*) as int)` }).from(entitlements).innerJoin(orgUsers, and(eq(orgUsers.orgId, entitlements.orgId), eq(orgUsers.id, entitlements.orgUserId))).innerJoin(users, eq(users.id, orgUsers.userId)).leftJoin(contentItems, and(eq(contentItems.orgId, entitlements.orgId), eq(contentItems.id, entitlements.contentId))).leftJoin(bundles, and(eq(bundles.orgId, entitlements.orgId), eq(bundles.id, entitlements.bundleId))).leftJoin(courses, and(eq(courses.orgId, entitlements.orgId), eq(courses.id, entitlements.contentId))).leftJoin(downloads, and(eq(downloads.orgId, entitlements.orgId), eq(downloads.id, entitlements.contentId))).leftJoin(communities, and(eq(communities.orgId, entitlements.orgId), eq(communities.id, entitlements.contentId))).where(where);
 		return {
 			rows: rows.map(toEntitlement),
 			total,
@@ -131,22 +150,193 @@ var DrizzleEntitlementsRepository = class {
 		if (!row) throw new Error("failed to insert entitlement");
 		return toEntitlement(row);
 	}
+	async insertIfAbsent(orgId, input) {
+		const bundleId = input.bundleId ?? null;
+		const contentId = input.contentId ?? null;
+		const target = bundleId ? [
+			entitlements.orgId,
+			entitlements.orgUserId,
+			entitlements.bundleId
+		] : [
+			entitlements.orgId,
+			entitlements.orgUserId,
+			entitlements.contentId
+		];
+		const [row] = await this.db.insert(entitlements).values({
+			orgId,
+			orgUserId: input.orgUserId,
+			bundleId,
+			contentId,
+			status: "active",
+			source: "manual",
+			grantedAt: /* @__PURE__ */ new Date(),
+			expiresAt: input.expiresAt
+		}).onConflictDoNothing({ target }).returning(selection);
+		return row ? toEntitlement(row) : null;
+	}
+	async lockGrant(orgId, key) {
+		const target = key.bundleId ? eq(entitlements.bundleId, key.bundleId) : key.contentId ? eq(entitlements.contentId, key.contentId) : void 0;
+		if (!target) return null;
+		const [row] = await this.db.select(selection).from(entitlements).where(and(eq(entitlements.orgId, orgId), eq(entitlements.orgUserId, key.orgUserId), target)).for("update").limit(1);
+		return row ? toEntitlement(row) : null;
+	}
+	async setExpiresAt(orgId, id, expiresAt) {
+		const [row] = await this.db.update(entitlements).set({ expiresAt }).where(and(eq(entitlements.orgId, orgId), eq(entitlements.id, id))).returning(selection);
+		return row ? toEntitlement(row) : null;
+	}
 	async setStatus(orgId, id, status) {
 		const [row] = await this.db.update(entitlements).set({ status }).where(and(eq(entitlements.orgId, orgId), eq(entitlements.id, id))).returning(selection);
 		if (!row) return null;
 		return toEntitlement(row);
 	}
-	/** Existence check scoped to the course case: same status predicate as
-	*  `list` (revoked never counts; an elapsed expiry reads as expired, not
-	*  active). The course is reachable two ways — granted directly, or granted
-	*  through a bundle that holds it — and either way the row is joined to
-	*  content_items and constrained to type = 'course', so a grant on some other
-	*  content type can never be mistaken for course access. */
-	async hasCourseAccess(orgId, orgUserId, courseId) {
-		const bundledItems = alias(contentItems, "bundled_content_items");
-		return (await this.db.select({ id: entitlements.id }).from(entitlements).leftJoin(contentItems, and(eq(contentItems.orgId, entitlements.orgId), eq(contentItems.id, entitlements.contentId))).leftJoin(bundleItems, and(eq(bundleItems.orgId, entitlements.orgId), eq(bundleItems.bundleId, entitlements.bundleId))).leftJoin(bundledItems, and(eq(bundledItems.orgId, bundleItems.orgId), eq(bundledItems.id, bundleItems.contentId))).where(and(eq(entitlements.orgId, orgId), eq(entitlements.orgUserId, orgUserId), or(and(eq(entitlements.contentId, courseId), eq(contentItems.type, "course")), and(eq(bundleItems.contentId, courseId), eq(bundledItems.type, "course"))), sql`${derivedStatus} = 'active'`)).limit(1)).length > 0;
+	async hasAccess(orgId, orgUserId, contentId) {
+		return (await this.db.select({ id: contentAccess.entitlementId }).from(contentAccess).where(and(eq(contentAccess.orgId, orgId), eq(contentAccess.orgUserId, orgUserId), eq(contentAccess.contentId, contentId))).limit(1)).length > 0;
+	}
+	async listAccessibleContent(orgId, orgUserId, type) {
+		return (await this.db.selectDistinct({ contentId: contentAccess.contentId }).from(contentAccess).innerJoin(contentItems, and(eq(contentItems.orgId, contentAccess.orgId), eq(contentItems.id, contentAccess.contentId))).where(and(eq(contentAccess.orgId, orgId), eq(contentAccess.orgUserId, orgUserId), type ? eq(contentItems.type, type) : void 0))).map((r) => r.contentId);
+	}
+	hasCommunityAccess(orgId, orgUserId, communityId) {
+		return this.holds(holdsCommunity(sql`${orgId}`, sql`${orgUserId}`, sql`${communityId}`));
+	}
+	async holds(predicate) {
+		const result = await this.db.execute(sql`select ${predicate} as covered`);
+		return (Array.isArray(result) ? result : result.rows)[0]?.covered === true;
+	}
+	async communitiesOpenedBy(orgId, grant) {
+		if (!grant.contentId && !grant.bundleId) return [];
+		const target = {
+			orgId: sql`${orgId}`,
+			contentId: sql`${grant.contentId ?? null}::text`,
+			bundleId: sql`${grant.bundleId ?? null}::text`
+		};
+		return (await this.db.select({ id: communities.id }).from(communities).where(and(eq(communities.orgId, orgId), eq(communities.status, "published"), grantOpens(target, sql`${communities.id}`, "community"))).orderBy(asc(communities.id))).map((row) => row.id);
+	}
+	async accessAmong(orgId, communityId, spaceId, orgUserIds) {
+		if (orgUserIds.length === 0) return [];
+		const activeInSpace = spaceId ? sql`exists (
+          select 1 from space_members sm
+          where sm.org_id = ${sql`${orgUsers.orgId}`}
+            and sm.space_id = ${spaceId}
+            and sm.org_user_id = ${sql`${orgUsers.id}`}
+            and sm.status = 'active'
+        )` : sql`false`;
+		return (await this.db.select({
+			orgUserId: orgUsers.id,
+			role: orgUsers.role,
+			member: sql`${communityMember(sql`${orgUsers.orgId}`, sql`${orgUsers.id}`, sql`${orgUsers.role}`, sql`${communityId}`)}`,
+			activeInSpace
+		}).from(orgUsers).where(and(eq(orgUsers.orgId, orgId), inArray(orgUsers.id, orgUserIds)))).map((row) => ({
+			orgUserId: row.orgUserId,
+			role: row.role,
+			member: row.member === true,
+			activeInSpace: row.activeInSpace === true
+		}));
+	}
+	async findSpaceMember(orgId, spaceId, orgUserId) {
+		const [row] = await this.db.select().from(spaceMembers).where(and(eq(spaceMembers.orgId, orgId), eq(spaceMembers.spaceId, spaceId), eq(spaceMembers.orgUserId, orgUserId))).limit(1);
+		return row ? toSpaceMember(row) : null;
+	}
+	async listSpaceMembersFor(orgId, orgUserId, communityId) {
+		return (await this.db.select().from(spaceMembers).where(and(eq(spaceMembers.orgId, orgId), eq(spaceMembers.orgUserId, orgUserId), eq(spaceMembers.communityId, communityId)))).map(toSpaceMember);
+	}
+	async lockSpaceMember(orgId, spaceId, orgUserId) {
+		const [row] = await this.db.select().from(spaceMembers).where(and(eq(spaceMembers.orgId, orgId), eq(spaceMembers.spaceId, spaceId), eq(spaceMembers.orgUserId, orgUserId))).for("update").limit(1);
+		return row ? toSpaceMember(row) : null;
+	}
+	async listSpaceMembers(orgId, spaceId, query) {
+		const where = and(eq(spaceMembers.orgId, orgId), eq(spaceMembers.spaceId, spaceId), query.statuses ? inArray(spaceMembers.status, query.statuses) : void 0);
+		const rows = await this.db.select().from(spaceMembers).where(where).orderBy(asc(spaceMembers.createdAt), asc(spaceMembers.id)).limit(query.pageSize).offset((query.page - 1) * query.pageSize);
+		const [{ total } = { total: 0 }] = await this.db.select({ total: sql`cast(count(*) as int)` }).from(spaceMembers).where(where);
+		return {
+			rows: rows.map(toSpaceMember),
+			total,
+			page: query.page,
+			pageSize: query.pageSize
+		};
+	}
+	async insertSpaceMember(orgId, input) {
+		const [row] = await this.db.insert(spaceMembers).values({
+			orgId,
+			communityId: input.communityId,
+			spaceId: input.spaceId,
+			orgUserId: input.orgUserId,
+			status: input.status,
+			source: input.source
+		}).returning();
+		if (!row) throw new Error("failed to insert space member");
+		return toSpaceMember(row);
+	}
+	async updateSpaceMemberStatus(orgId, id, status) {
+		const [row] = await this.db.update(spaceMembers).set({ status }).where(and(eq(spaceMembers.orgId, orgId), eq(spaceMembers.id, id))).returning();
+		return row ? toSpaceMember(row) : null;
+	}
+	async deleteSpaceMember(orgId, id) {
+		await this.db.delete(spaceMembers).where(and(eq(spaceMembers.orgId, orgId), eq(spaceMembers.id, id)));
+	}
+	async countActiveSpaceMembers(orgId, spaceId) {
+		const [row] = await this.db.select({ total: sql`cast(count(*) as int)` }).from(spaceMembers).where(and(eq(spaceMembers.orgId, orgId), eq(spaceMembers.spaceId, spaceId), eq(spaceMembers.status, "active"), holdsCommunity(sql`${spaceMembers.orgId}`, sql`${spaceMembers.orgUserId}`, sql`${spaceMembers.communityId}`)));
+		return row?.total ?? 0;
+	}
+	async activeSpaceIds(orgId, orgUserId, communityId) {
+		return (await this.db.select({ spaceId: spaceMembers.spaceId }).from(spaceMembers).where(and(eq(spaceMembers.orgId, orgId), eq(spaceMembers.orgUserId, orgUserId), eq(spaceMembers.communityId, communityId), eq(spaceMembers.status, "active")))).map((row) => row.spaceId);
+	}
+	async listGrantsExpiredBy(orgId, now, limit, afterId) {
+		return (await this.db.select(selection).from(entitlements).where(and(this.expiredUnnoticed(orgId, now), afterId === void 0 ? void 0 : gt(entitlements.id, afterId))).orderBy(asc(entitlements.id)).limit(limit)).map(toEntitlement);
+	}
+	async listGrantsEndingBetween(orgId, after, until, limit, afterKey) {
+		return (await this.db.select({
+			...selection,
+			communityId: communities.id
+		}).from(entitlements).innerJoin(communities, opensPublishedCommunity).where(and(this.endingUnnoticed(orgId, after, until), afterKey ? sql`(${entitlements.id}, ${communities.id}) > (${afterKey.entitlementId}, ${afterKey.communityId})` : void 0)).orderBy(asc(entitlements.id), asc(communities.id)).limit(limit)).map(({ communityId, ...grant }) => ({
+			grant: toEntitlement(grant),
+			communityId
+		}));
+	}
+	async hasDueNotices(orgId, now, until) {
+		const expired = this.db.select({ id: entitlements.id }).from(entitlements).where(this.expiredUnnoticed(orgId, now));
+		const ending = this.db.select({ id: entitlements.id }).from(entitlements).innerJoin(communities, opensPublishedCommunity).where(this.endingUnnoticed(orgId, now, until));
+		return this.holds(sql`(exists (${expired}) or exists (${ending}))`);
+	}
+	async claimNotice(orgId, notice, now) {
+		const statement = notice.kind === "expired" ? sql`insert into ${entitlementExpiryNotices} ("org_id", "entitlement_id", "expires_at", "notified_at")
+            values (${orgId}, ${notice.entitlementId}, ${at(notice.expiresAt)}, ${at(now)})
+            on conflict do nothing
+            returning "entitlement_id"` : sql`insert into ${entitlementEndingSoonNotices} ("org_id", "entitlement_id", "community_id", "expires_at", "notified_at")
+            values (${orgId}, ${notice.entitlementId}, ${notice.communityId}, ${at(notice.expiresAt)}, ${at(now)})
+            on conflict do nothing
+            returning "entitlement_id"`;
+		const result = await this.db.execute(statement);
+		return (Array.isArray(result) ? result : result.rows).length > 0;
+	}
+	expiredUnnoticed(orgId, now) {
+		return and(eq(entitlements.orgId, orgId), eq(entitlements.status, "active"), grantExpired(entitlements.expiresAt, at(now)), sql`not ${expiryNoticed}`);
+	}
+	endingUnnoticed(orgId, after, until) {
+		return and(eq(entitlements.orgId, orgId), grantIsActive(entitlements, at(after)), grantExpired(entitlements.expiresAt, at(until)), sql`not ${endingSoonNoticed}`);
+	}
+	async communityModeratorIds(orgId, communityId) {
+		return (await this.db.select({ id: orgUsers.id }).from(orgUsers).where(and(eq(orgUsers.orgId, orgId), inArray(orgUsers.role, MODERATING_ROLES), communityMember(sql`${orgUsers.orgId}`, sql`${orgUsers.id}`, sql`${orgUsers.role}`, sql`${communityId}`))).orderBy(asc(orgUsers.id))).map((row) => row.id);
+	}
+	async communityMemberIds(orgId, communityId) {
+		return (await this.db.select({ id: orgUsers.id }).from(orgUsers).where(and(eq(orgUsers.orgId, orgId), communityMember(sql`${orgUsers.orgId}`, sql`${orgUsers.id}`, sql`${orgUsers.role}`, sql`${communityId}`))).orderBy(asc(orgUsers.id))).map((row) => row.id);
+	}
+	async communityIdsOpenedFor(orgId, orgUserId) {
+		return (await this.db.selectDistinct({ id: communities.id }).from(communities).where(and(eq(communities.orgId, orgId), holdsCommunity(sql`${communities.orgId}`, sql`${orgUserId}`, sql`${communities.id}`))).orderBy(asc(communities.id))).map((row) => row.id);
 	}
 };
+function toSpaceMember(row) {
+	return {
+		orgId: row.orgId,
+		id: row.id,
+		communityId: row.communityId,
+		spaceId: row.spaceId,
+		orgUserId: row.orgUserId,
+		status: row.status,
+		source: row.source,
+		createdAt: row.createdAt,
+		updatedAt: row.updatedAt
+	};
+}
 translateDbErrors(DrizzleEntitlementsRepository);
 //#endregion
 export { DrizzleEntitlementsRepository };

package/dist/repositories/entitlements.js.map

@@ -1 +1 @@
-{"version":3,"file":"entitlements.js","names":[],"sources":["../../src/repositories/entitlements.ts"],"sourcesContent":["import { and, asc, desc, eq, ilike, or, sql, type SQL } from \"drizzle-orm\";\nimport { alias } from \"drizzle-orm/pg-core\";\nimport type { DbExecutor } from \"../client.js\";\nimport type { EntitlementsRepository } from \"@headless-lms/core/entitlements\";\nimport type {\n  Entitlement,\n  EntitlementStatus,\n  EntitlementsQuery,\n  GrantEntitlementInput,\n  Logger,\n  Page,\n} from \"@headless-lms/core/types\";\nimport { entitlements, orgUsers, users } from \"../schema/index.js\";\nimport { bundleItems, bundles, contentItems, courses, downloads } from \"../schema/content.js\";\nimport { noopLogger } from \"@headless-lms/core/shared/logger\";\nimport { translateDbErrors } from \"./pg-errors.js\";\n\ntype ResolvedStatus = \"active\" | \"expired\" | \"revoked\";\n\n// CASE expression: revoked beats everything; otherwise an elapsed expiry reads as\n// expired; otherwise active.\nconst derivedStatus = sql<ResolvedStatus>`case\n  when ${entitlements.status} = 'revoked' then 'revoked'\n  when ${entitlements.expiresAt} is not null and ${entitlements.expiresAt} < now() then 'expired'\n  else 'active'\nend`;\n\n// Display name of the grant's target, whatever it is. One LEFT JOIN per concrete\n// content table plus one for bundles; exactly one hits per row (a grant targets\n// either a bundle or a single content item), so the COALESCE picks the single\n// non-null title. Extended per new content type.\nconst contentTitle = sql<string>`coalesce(${courses.title}, ${downloads.title}, ${bundles.name})`;\n\n// Sortable columns by the client-facing field name. `status` sorts on the derived\n// expression so the ordering matches the displayed value; `contentTitle` on the\n// coalesced join expression.\nconst sortColumns = {\n  firstName: users.firstName,\n  lastName: users.lastName,\n  email: users.email,\n  contentTitle,\n  status: derivedStatus,\n  grantedAt: entitlements.grantedAt,\n  expiresAt: entitlements.expiresAt,\n  source: entitlements.source,\n} as const;\n\nconst selection = {\n  orgId: entitlements.orgId,\n  id: entitlements.id,\n  orgUserId: entitlements.orgUserId,\n  bundleId: entitlements.bundleId,\n  contentId: entitlements.contentId,\n  status: entitlements.status,\n  source: entitlements.source,\n  grantedAt: entitlements.grantedAt,\n  expiresAt: entitlements.expiresAt,\n  createdAt: entitlements.createdAt,\n  updatedAt: entitlements.updatedAt,\n} as const;\n\ninterface Row {\n  orgId: string;\n  id: string;\n  orgUserId: string;\n  bundleId: string | null;\n  contentId: string | null;\n  status: EntitlementStatus;\n  source: string;\n  grantedAt: Date;\n  expiresAt: Date | null;\n  createdAt: Date;\n  updatedAt: Date;\n}\n\nfunction toEntitlement(row: Row): Entitlement {\n  return {\n    orgId: row.orgId,\n    id: row.id,\n    orgUserId: row.orgUserId,\n    bundleId: row.bundleId,\n    contentId: row.contentId,\n    status: row.status,\n    source: row.source,\n    grantedAt: row.grantedAt,\n    expiresAt: row.expiresAt,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n\nexport class DrizzleEntitlementsRepository implements EntitlementsRepository {\n  constructor(\n    private readonly db: DbExecutor,\n    private readonly logger: Logger = noopLogger,\n  ) {}\n\n  /** entitlements → org_users + the grant's target: content_items (type) and one\n   *  LEFT JOIN per concrete content table (title), or bundles (name). Both target\n   *  joins are LEFT — a row carries one of the two, never both. */\n  private joined(where: SQL | undefined) {\n    return this.db\n      .select(selection)\n      .from(entitlements)\n      .innerJoin(\n        orgUsers,\n        and(eq(orgUsers.orgId, entitlements.orgId), eq(orgUsers.id, entitlements.orgUserId)),\n      )\n      .innerJoin(users, eq(users.id, orgUsers.userId))\n      .leftJoin(\n        contentItems,\n        and(\n          eq(contentItems.orgId, entitlements.orgId),\n          eq(contentItems.id, entitlements.contentId),\n        ),\n      )\n      .leftJoin(\n        bundles,\n        and(eq(bundles.orgId, entitlements.orgId), eq(bundles.id, entitlements.bundleId)),\n      )\n      .leftJoin(\n        courses,\n        and(eq(courses.orgId, entitlements.orgId), eq(courses.id, entitlements.contentId)),\n      )\n      .leftJoin(\n        downloads,\n        and(eq(downloads.orgId, entitlements.orgId), eq(downloads.id, entitlements.contentId)),\n      )\n      .where(where);\n  }\n\n  async list(orgId: string, query: EntitlementsQuery): Promise<Page<Entitlement>> {\n    const conditions: SQL[] = [eq(entitlements.orgId, orgId)];\n    if (query.status) {\n      conditions.push(sql`${derivedStatus} = ${query.status}`);\n    }\n    if (query.source) {\n      conditions.push(eq(entitlements.source, query.source));\n    }\n    if (query.orgUserId) {\n      conditions.push(eq(entitlements.orgUserId, query.orgUserId));\n    }\n    if (query.contentId) {\n      conditions.push(eq(entitlements.contentId, query.contentId));\n    }\n    if (query.bundleId) {\n      conditions.push(eq(entitlements.bundleId, query.bundleId));\n    }\n    if (query.type) {\n      conditions.push(eq(contentItems.type, query.type));\n    }\n    if (query.search) {\n      const pattern = `%${query.search}%`;\n      conditions.push(\n        or(\n          ilike(users.firstName, pattern),\n          ilike(users.lastName, pattern),\n          ilike(users.email, pattern),\n          ilike(contentTitle, pattern),\n        ) as SQL,\n      );\n    }\n    const where = and(...conditions);\n\n    // Sort: `-field` for descending; default to most-recently granted first.\n    let orderBy: SQL;\n    if (query.sort) {\n      const isDesc = query.sort.startsWith(\"-\");\n      const field = (isDesc ? query.sort.slice(1) : query.sort) as keyof typeof sortColumns;\n      const col = sortColumns[field] ?? entitlements.grantedAt;\n      orderBy = isDesc ? desc(col) : asc(col);\n    } else {\n      orderBy = desc(entitlements.grantedAt);\n    }\n\n    const offset = (query.page - 1) * query.pageSize;\n\n    const rows = await this.joined(where).orderBy(orderBy).limit(query.pageSize).offset(offset);\n\n    const [{ total } = { total: 0 }] = await this.db\n      .select({ total: sql<number>`cast(count(*) as int)` })\n      .from(entitlements)\n      .innerJoin(\n        orgUsers,\n        and(eq(orgUsers.orgId, entitlements.orgId), eq(orgUsers.id, entitlements.orgUserId)),\n      )\n      .innerJoin(users, eq(users.id, orgUsers.userId))\n      .leftJoin(\n        contentItems,\n        and(\n          eq(contentItems.orgId, entitlements.orgId),\n          eq(contentItems.id, entitlements.contentId),\n        ),\n      )\n      .leftJoin(\n        bundles,\n        and(eq(bundles.orgId, entitlements.orgId), eq(bundles.id, entitlements.bundleId)),\n      )\n      .leftJoin(\n        courses,\n        and(eq(courses.orgId, entitlements.orgId), eq(courses.id, entitlements.contentId)),\n      )\n      .leftJoin(\n        downloads,\n        and(eq(downloads.orgId, entitlements.orgId), eq(downloads.id, entitlements.contentId)),\n      )\n      .where(where);\n\n    return {\n      rows: rows.map(toEntitlement),\n      total,\n      page: query.page,\n      pageSize: query.pageSize,\n    };\n  }\n\n  /** A grant targets exactly one of a bundle or a content item (db check\n   *  constraint), so the upsert is inferred on whichever of the two partial\n   *  uniques the target uses. */\n  async insert(orgId: string, input: GrantEntitlementInput): Promise<Entitlement> {\n    const bundleId = input.bundleId ?? null;\n    const contentId = input.contentId ?? null;\n    const target = bundleId\n      ? [entitlements.orgId, entitlements.orgUserId, entitlements.bundleId]\n      : [entitlements.orgId, entitlements.orgUserId, entitlements.contentId];\n\n    const [row] = await this.db\n      .insert(entitlements)\n      .values({\n        orgId,\n        orgUserId: input.orgUserId,\n        bundleId,\n        contentId,\n        status: \"active\",\n        source: \"manual\",\n        grantedAt: new Date(),\n        expiresAt: input.expiresAt,\n      })\n      .onConflictDoUpdate({\n        target,\n        set: {\n          status: \"active\",\n          source: \"manual\",\n          grantedAt: new Date(),\n          expiresAt: input.expiresAt,\n        },\n      })\n      .returning(selection);\n    if (!row) {\n      throw new Error(\"failed to insert entitlement\");\n    }\n    return toEntitlement(row);\n  }\n\n  async setStatus(\n    orgId: string,\n    id: string,\n    status: \"active\" | \"revoked\",\n  ): Promise<Entitlement | null> {\n    const [row] = await this.db\n      .update(entitlements)\n      .set({ status })\n      .where(and(eq(entitlements.orgId, orgId), eq(entitlements.id, id)))\n      .returning(selection);\n    if (!row) {\n      return null;\n    }\n    return toEntitlement(row);\n  }\n\n  /** Existence check scoped to the course case: same status predicate as\n   *  `list` (revoked never counts; an elapsed expiry reads as expired, not\n   *  active). The course is reachable two ways — granted directly, or granted\n   *  through a bundle that holds it — and either way the row is joined to\n   *  content_items and constrained to type = 'course', so a grant on some other\n   *  content type can never be mistaken for course access. */\n  async hasCourseAccess(orgId: string, orgUserId: string, courseId: string): Promise<boolean> {\n    const bundledItems = alias(contentItems, \"bundled_content_items\");\n    const rows = await this.db\n      .select({ id: entitlements.id })\n      .from(entitlements)\n      .leftJoin(\n        contentItems,\n        and(\n          eq(contentItems.orgId, entitlements.orgId),\n          eq(contentItems.id, entitlements.contentId),\n        ),\n      )\n      .leftJoin(\n        bundleItems,\n        and(\n          eq(bundleItems.orgId, entitlements.orgId),\n          eq(bundleItems.bundleId, entitlements.bundleId),\n        ),\n      )\n      .leftJoin(\n        bundledItems,\n        and(eq(bundledItems.orgId, bundleItems.orgId), eq(bundledItems.id, bundleItems.contentId)),\n      )\n      .where(\n        and(\n          eq(entitlements.orgId, orgId),\n          eq(entitlements.orgUserId, orgUserId),\n          or(\n            and(eq(entitlements.contentId, courseId), eq(contentItems.type, \"course\")),\n            and(eq(bundleItems.contentId, courseId), eq(bundledItems.type, \"course\")),\n          ),\n          sql`${derivedStatus} = 'active'`,\n        ),\n      )\n      .limit(1);\n    return rows.length > 0;\n  }\n}\ntranslateDbErrors(DrizzleEntitlementsRepository);\n"],"mappings":";;;;;;;;;;AAqBA,MAAM,gBAAgB,GAAmB;SAChC,aAAa,OAAO;SACpB,aAAa,UAAU,mBAAmB,aAAa,UAAU;;;AAQ1E,MAAM,eAAe,GAAW,YAAY,QAAQ,MAAM,IAAI,UAAU,MAAM,IAAI,QAAQ,KAAK;AAK/F,MAAM,cAAc;CAClB,WAAW,MAAM;CACjB,UAAU,MAAM;CAChB,OAAO,MAAM;CACb;CACA,QAAQ;CACR,WAAW,aAAa;CACxB,WAAW,aAAa;CACxB,QAAQ,aAAa;AACvB;AAEA,MAAM,YAAY;CAChB,OAAO,aAAa;CACpB,IAAI,aAAa;CACjB,WAAW,aAAa;CACxB,UAAU,aAAa;CACvB,WAAW,aAAa;CACxB,QAAQ,aAAa;CACrB,QAAQ,aAAa;CACrB,WAAW,aAAa;CACxB,WAAW,aAAa;CACxB,WAAW,aAAa;CACxB,WAAW,aAAa;AAC1B;AAgBA,SAAS,cAAc,KAAuB;CAC5C,OAAO;EACL,OAAO,IAAI;EACX,IAAI,IAAI;EACR,WAAW,IAAI;EACf,UAAU,IAAI;EACd,WAAW,IAAI;EACf,QAAQ,IAAI;EACZ,QAAQ,IAAI;EACZ,WAAW,IAAI;EACf,WAAW,IAAI;EACf,WAAW,IAAI;EACf,WAAW,IAAI;CACjB;AACF;AAEA,IAAa,gCAAb,MAA6E;CAExD;CACA;CAFnB,YACE,IACA,SAAkC,YAClC;EAFiB,KAAA,KAAA;EACA,KAAA,SAAA;CAChB;;;;CAKH,OAAe,OAAwB;EACrC,OAAO,KAAK,GACT,OAAO,SAAS,CAAC,CACjB,KAAK,YAAY,CAAC,CAClB,UACC,UACA,IAAI,GAAG,SAAS,OAAO,aAAa,KAAK,GAAG,GAAG,SAAS,IAAI,aAAa,SAAS,CAAC,CACrF,CAAC,CACA,UAAU,OAAO,GAAG,MAAM,IAAI,SAAS,MAAM,CAAC,CAAC,CAC/C,SACC,cACA,IACE,GAAG,aAAa,OAAO,aAAa,KAAK,GACzC,GAAG,aAAa,IAAI,aAAa,SAAS,CAC5C,CACF,CAAC,CACA,SACC,SACA,IAAI,GAAG,QAAQ,OAAO,aAAa,KAAK,GAAG,GAAG,QAAQ,IAAI,aAAa,QAAQ,CAAC,CAClF,CAAC,CACA,SACC,SACA,IAAI,GAAG,QAAQ,OAAO,aAAa,KAAK,GAAG,GAAG,QAAQ,IAAI,aAAa,SAAS,CAAC,CACnF,CAAC,CACA,SACC,WACA,IAAI,GAAG,UAAU,OAAO,aAAa,KAAK,GAAG,GAAG,UAAU,IAAI,aAAa,SAAS,CAAC,CACvF,CAAC,CACA,MAAM,KAAK;CAChB;CAEA,MAAM,KAAK,OAAe,OAAsD;EAC9E,MAAM,aAAoB,CAAC,GAAG,aAAa,OAAO,KAAK,CAAC;EACxD,IAAI,MAAM,QACR,WAAW,KAAK,GAAG,GAAG,cAAc,KAAK,MAAM,QAAQ;EAEzD,IAAI,MAAM,QACR,WAAW,KAAK,GAAG,aAAa,QAAQ,MAAM,MAAM,CAAC;EAEvD,IAAI,MAAM,WACR,WAAW,KAAK,GAAG,aAAa,WAAW,MAAM,SAAS,CAAC;EAE7D,IAAI,MAAM,WACR,WAAW,KAAK,GAAG,aAAa,WAAW,MAAM,SAAS,CAAC;EAE7D,IAAI,MAAM,UACR,WAAW,KAAK,GAAG,aAAa,UAAU,MAAM,QAAQ,CAAC;EAE3D,IAAI,MAAM,MACR,WAAW,KAAK,GAAG,aAAa,MAAM,MAAM,IAAI,CAAC;EAEnD,IAAI,MAAM,QAAQ;GAChB,MAAM,UAAU,IAAI,MAAM,OAAO;GACjC,WAAW,KACT,GACE,MAAM,MAAM,WAAW,OAAO,GAC9B,MAAM,MAAM,UAAU,OAAO,GAC7B,MAAM,MAAM,OAAO,OAAO,GAC1B,MAAM,cAAc,OAAO,CAC7B,CACF;EACF;EACA,MAAM,QAAQ,IAAI,GAAG,UAAU;EAG/B,IAAI;EACJ,IAAI,MAAM,MAAM;GACd,MAAM,SAAS,MAAM,KAAK,WAAW,GAAG;GACxC,MAAM,QAAS,SAAS,MAAM,KAAK,MAAM,CAAC,IAAI,MAAM;GACpD,MAAM,MAAM,YAAY,UAAU,aAAa;GAC/C,UAAU,SAAS,KAAK,GAAG,IAAI,IAAI,GAAG;EACxC,OACE,UAAU,KAAK,aAAa,SAAS;EAGvC,MAAM,UAAU,MAAM,OAAO,KAAK,MAAM;EAExC,MAAM,OAAO,MAAM,KAAK,OAAO,KAAK,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,MAAM,MAAM,QAAQ,CAAC,CAAC,OAAO,MAAM;EAE1F,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,MAAM,KAAK,GAC3C,OAAO,EAAE,OAAO,GAAW,wBAAwB,CAAC,CAAC,CACrD,KAAK,YAAY,CAAC,CAClB,UACC,UACA,IAAI,GAAG,SAAS,OAAO,aAAa,KAAK,GAAG,GAAG,SAAS,IAAI,aAAa,SAAS,CAAC,CACrF,CAAC,CACA,UAAU,OAAO,GAAG,MAAM,IAAI,SAAS,MAAM,CAAC,CAAC,CAC/C,SACC,cACA,IACE,GAAG,aAAa,OAAO,aAAa,KAAK,GACzC,GAAG,aAAa,IAAI,aAAa,SAAS,CAC5C,CACF,CAAC,CACA,SACC,SACA,IAAI,GAAG,QAAQ,OAAO,aAAa,KAAK,GAAG,GAAG,QAAQ,IAAI,aAAa,QAAQ,CAAC,CAClF,CAAC,CACA,SACC,SACA,IAAI,GAAG,QAAQ,OAAO,aAAa,KAAK,GAAG,GAAG,QAAQ,IAAI,aAAa,SAAS,CAAC,CACnF,CAAC,CACA,SACC,WACA,IAAI,GAAG,UAAU,OAAO,aAAa,KAAK,GAAG,GAAG,UAAU,IAAI,aAAa,SAAS,CAAC,CACvF,CAAC,CACA,MAAM,KAAK;EAEd,OAAO;GACL,MAAM,KAAK,IAAI,aAAa;GAC5B;GACA,MAAM,MAAM;GACZ,UAAU,MAAM;EAClB;CACF;;;;CAKA,MAAM,OAAO,OAAe,OAAoD;EAC9E,MAAM,WAAW,MAAM,YAAY;EACnC,MAAM,YAAY,MAAM,aAAa;EACrC,MAAM,SAAS,WACX;GAAC,aAAa;GAAO,aAAa;GAAW,aAAa;EAAQ,IAClE;GAAC,aAAa;GAAO,aAAa;GAAW,aAAa;EAAS;EAEvE,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,YAAY,CAAC,CACpB,OAAO;GACN;GACA,WAAW,MAAM;GACjB;GACA;GACA,QAAQ;GACR,QAAQ;GACR,2BAAW,IAAI,KAAK;GACpB,WAAW,MAAM;EACnB,CAAC,CAAC,CACD,mBAAmB;GAClB;GACA,KAAK;IACH,QAAQ;IACR,QAAQ;IACR,2BAAW,IAAI,KAAK;IACpB,WAAW,MAAM;GACnB;EACF,CAAC,CAAC,CACD,UAAU,SAAS;EACtB,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,8BAA8B;EAEhD,OAAO,cAAc,GAAG;CAC1B;CAEA,MAAM,UACJ,OACA,IACA,QAC6B;EAC7B,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,YAAY,CAAC,CACpB,IAAI,EAAE,OAAO,CAAC,CAAC,CACf,MAAM,IAAI,GAAG,aAAa,OAAO,KAAK,GAAG,GAAG,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAClE,UAAU,SAAS;EACtB,IAAI,CAAC,KACH,OAAO;EAET,OAAO,cAAc,GAAG;CAC1B;;;;;;;CAQA,MAAM,gBAAgB,OAAe,WAAmB,UAAoC;EAC1F,MAAM,eAAe,MAAM,cAAc,uBAAuB;EAkChE,QAAO,MAjCY,KAAK,GACrB,OAAO,EAAE,IAAI,aAAa,GAAG,CAAC,CAAC,CAC/B,KAAK,YAAY,CAAC,CAClB,SACC,cACA,IACE,GAAG,aAAa,OAAO,aAAa,KAAK,GACzC,GAAG,aAAa,IAAI,aAAa,SAAS,CAC5C,CACF,CAAC,CACA,SACC,aACA,IACE,GAAG,YAAY,OAAO,aAAa,KAAK,GACxC,GAAG,YAAY,UAAU,aAAa,QAAQ,CAChD,CACF,CAAC,CACA,SACC,cACA,IAAI,GAAG,aAAa,OAAO,YAAY,KAAK,GAAG,GAAG,aAAa,IAAI,YAAY,SAAS,CAAC,CAC3F,CAAC,CACA,MACC,IACE,GAAG,aAAa,OAAO,KAAK,GAC5B,GAAG,aAAa,WAAW,SAAS,GACpC,GACE,IAAI,GAAG,aAAa,WAAW,QAAQ,GAAG,GAAG,aAAa,MAAM,QAAQ,CAAC,GACzE,IAAI,GAAG,YAAY,WAAW,QAAQ,GAAG,GAAG,aAAa,MAAM,QAAQ,CAAC,CAC1E,GACA,GAAG,GAAG,cAAc,YACtB,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CACE,SAAS;CACvB;AACF;AACA,kBAAkB,6BAA6B"}
+{"version":3,"file":"entitlements.js","names":[],"sources":["../../src/repositories/entitlements.ts"],"sourcesContent":["import { and, asc, desc, eq, gt, ilike, inArray, or, sql, type SQL } from \"drizzle-orm\";\nimport type { DbExecutor } from \"../client.js\";\nimport type {\n  AccessFacts,\n  EndingGrant,\n  EndingGrantKey,\n  EntitlementNotice,\n  EntitlementsRepository,\n  GrantKey,\n  GrantTarget,\n  InsertSpaceMemberInput,\n  SpaceMembersQuery,\n} from \"@headless-lms/core/entitlements\";\nimport type {\n  ContentType,\n  Entitlement,\n  EntitlementStatus,\n  EntitlementsQuery,\n  GrantEntitlementInput,\n  Logger,\n  Page,\n  Role,\n  SpaceMember,\n  SpaceMemberStatus,\n} from \"@headless-lms/core/types\";\nimport {\n  contentAccess,\n  entitlementEndingSoonNotices,\n  entitlementExpiryNotices,\n  entitlements,\n  orgUsers,\n  spaceMembers,\n  users,\n} from \"../schema/index.js\";\nimport {\n  grantExpired,\n  grantIsActive,\n  communityMember,\n  grantOpens,\n  holdsCommunity,\n} from \"./grant-covers.js\";\nimport { bundles, communities, contentItems, courses, downloads } from \"../schema/content.js\";\nimport { noopLogger } from \"@headless-lms/core/shared/logger\";\nimport { ROLES, canModerate } from \"@headless-lms/core/organizations\";\nimport { translateDbErrors } from \"./pg-errors.js\";\n\ntype ResolvedStatus = \"active\" | \"expired\" | \"revoked\";\n\nconst MODERATING_ROLES: Role[] = ROLES.filter((role) => canModerate(role));\n\n// CASE expression: revoked beats everything; otherwise an elapsed expiry reads as\n// expired; otherwise active.\nconst derivedStatus = sql<ResolvedStatus>`case\n  when ${entitlements.status} = 'revoked' then 'revoked'\n  when ${grantExpired(entitlements.expiresAt)} then 'expired'\n  else 'active'\nend`;\n\nfunction at(date: Date): SQL {\n  return sql`${date.toISOString()}::timestamptz`;\n}\n\nconst expiryNoticed = sql`exists (\n  select 1 from ${entitlementExpiryNotices}\n  where ${entitlementExpiryNotices.orgId} = ${entitlements.orgId}\n    and ${entitlementExpiryNotices.entitlementId} = ${entitlements.id}\n    and ${entitlementExpiryNotices.expiresAt} = ${entitlements.expiresAt}\n)`;\n\nconst endingSoonNoticed = sql`exists (\n  select 1 from ${entitlementEndingSoonNotices}\n  where ${entitlementEndingSoonNotices.orgId} = ${entitlements.orgId}\n    and ${entitlementEndingSoonNotices.entitlementId} = ${entitlements.id}\n    and ${entitlementEndingSoonNotices.communityId} = ${communities.id}\n    and ${entitlementEndingSoonNotices.expiresAt} = ${entitlements.expiresAt}\n)`;\n\nconst opensPublishedCommunity = and(\n  eq(communities.orgId, entitlements.orgId),\n  eq(communities.status, \"published\"),\n  grantOpens(entitlements, sql`${communities.id}`, \"community\"),\n);\n\n// Display name of the grant's target, whatever it is. One LEFT JOIN per concrete\n// content table plus one for bundles; exactly one hits per row (a grant targets\n// either a bundle or a single content item), so the COALESCE picks the single\n// non-null title. Extended per new content type.\nconst contentTitle = sql<string>`coalesce(${courses.title}, ${downloads.title}, ${communities.title}, ${bundles.name})`;\n\n// Sortable columns by the client-facing field name. `status` sorts on the derived\n// expression so the ordering matches the displayed value; `contentTitle` on the\n// coalesced join expression.\nconst sortColumns = {\n  firstName: users.firstName,\n  lastName: users.lastName,\n  email: users.email,\n  contentTitle,\n  status: derivedStatus,\n  grantedAt: entitlements.grantedAt,\n  expiresAt: entitlements.expiresAt,\n  source: entitlements.source,\n} as const;\n\nconst selection = {\n  orgId: entitlements.orgId,\n  id: entitlements.id,\n  orgUserId: entitlements.orgUserId,\n  bundleId: entitlements.bundleId,\n  contentId: entitlements.contentId,\n  status: entitlements.status,\n  source: entitlements.source,\n  grantedAt: entitlements.grantedAt,\n  expiresAt: entitlements.expiresAt,\n  createdAt: entitlements.createdAt,\n  updatedAt: entitlements.updatedAt,\n} as const;\n\ninterface Row {\n  orgId: string;\n  id: string;\n  orgUserId: string;\n  bundleId: string | null;\n  contentId: string | null;\n  status: EntitlementStatus;\n  source: string;\n  grantedAt: Date;\n  expiresAt: Date | null;\n  createdAt: Date;\n  updatedAt: Date;\n}\n\nfunction toEntitlement(row: Row): Entitlement {\n  return {\n    orgId: row.orgId,\n    id: row.id,\n    orgUserId: row.orgUserId,\n    bundleId: row.bundleId,\n    contentId: row.contentId,\n    status: row.status,\n    source: row.source,\n    grantedAt: row.grantedAt,\n    expiresAt: row.expiresAt,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n\nexport class DrizzleEntitlementsRepository implements EntitlementsRepository {\n  constructor(\n    private readonly db: DbExecutor,\n    private readonly logger: Logger = noopLogger,\n  ) {}\n\n  /** entitlements → org_users + the grant's target: content_items (type) and one\n   *  LEFT JOIN per concrete content table (title), or bundles (name). Both target\n   *  joins are LEFT — a row carries one of the two, never both. */\n  private joined(where: SQL | undefined) {\n    return this.db\n      .select(selection)\n      .from(entitlements)\n      .innerJoin(\n        orgUsers,\n        and(eq(orgUsers.orgId, entitlements.orgId), eq(orgUsers.id, entitlements.orgUserId)),\n      )\n      .innerJoin(users, eq(users.id, orgUsers.userId))\n      .leftJoin(\n        contentItems,\n        and(\n          eq(contentItems.orgId, entitlements.orgId),\n          eq(contentItems.id, entitlements.contentId),\n        ),\n      )\n      .leftJoin(\n        bundles,\n        and(eq(bundles.orgId, entitlements.orgId), eq(bundles.id, entitlements.bundleId)),\n      )\n      .leftJoin(\n        courses,\n        and(eq(courses.orgId, entitlements.orgId), eq(courses.id, entitlements.contentId)),\n      )\n      .leftJoin(\n        downloads,\n        and(eq(downloads.orgId, entitlements.orgId), eq(downloads.id, entitlements.contentId)),\n      )\n      .leftJoin(\n        communities,\n        and(eq(communities.orgId, entitlements.orgId), eq(communities.id, entitlements.contentId)),\n      )\n      .where(where);\n  }\n\n  async list(orgId: string, query: EntitlementsQuery): Promise<Page<Entitlement>> {\n    const conditions: SQL[] = [eq(entitlements.orgId, orgId)];\n    if (query.status) {\n      conditions.push(sql`${derivedStatus} = ${query.status}`);\n    }\n    if (query.source) {\n      conditions.push(eq(entitlements.source, query.source));\n    }\n    if (query.orgUserId) {\n      conditions.push(eq(entitlements.orgUserId, query.orgUserId));\n    }\n    if (query.contentId) {\n      conditions.push(eq(entitlements.contentId, query.contentId));\n    }\n    if (query.bundleId) {\n      conditions.push(eq(entitlements.bundleId, query.bundleId));\n    }\n    if (query.type) {\n      conditions.push(eq(contentItems.type, query.type));\n    }\n    if (query.search) {\n      const pattern = `%${query.search}%`;\n      conditions.push(\n        or(\n          ilike(users.firstName, pattern),\n          ilike(users.lastName, pattern),\n          ilike(users.email, pattern),\n          ilike(contentTitle, pattern),\n        ) as SQL,\n      );\n    }\n    const where = and(...conditions);\n\n    // Sort: `-field` for descending; default to most-recently granted first.\n    let orderBy: SQL;\n    if (query.sort) {\n      const isDesc = query.sort.startsWith(\"-\");\n      const field = (isDesc ? query.sort.slice(1) : query.sort) as keyof typeof sortColumns;\n      const col = sortColumns[field] ?? entitlements.grantedAt;\n      orderBy = isDesc ? desc(col) : asc(col);\n    } else {\n      orderBy = desc(entitlements.grantedAt);\n    }\n\n    const offset = (query.page - 1) * query.pageSize;\n\n    const rows = await this.joined(where).orderBy(orderBy).limit(query.pageSize).offset(offset);\n\n    const [{ total } = { total: 0 }] = await this.db\n      .select({ total: sql<number>`cast(count(*) as int)` })\n      .from(entitlements)\n      .innerJoin(\n        orgUsers,\n        and(eq(orgUsers.orgId, entitlements.orgId), eq(orgUsers.id, entitlements.orgUserId)),\n      )\n      .innerJoin(users, eq(users.id, orgUsers.userId))\n      .leftJoin(\n        contentItems,\n        and(\n          eq(contentItems.orgId, entitlements.orgId),\n          eq(contentItems.id, entitlements.contentId),\n        ),\n      )\n      .leftJoin(\n        bundles,\n        and(eq(bundles.orgId, entitlements.orgId), eq(bundles.id, entitlements.bundleId)),\n      )\n      .leftJoin(\n        courses,\n        and(eq(courses.orgId, entitlements.orgId), eq(courses.id, entitlements.contentId)),\n      )\n      .leftJoin(\n        downloads,\n        and(eq(downloads.orgId, entitlements.orgId), eq(downloads.id, entitlements.contentId)),\n      )\n      .leftJoin(\n        communities,\n        and(eq(communities.orgId, entitlements.orgId), eq(communities.id, entitlements.contentId)),\n      )\n      .where(where);\n\n    return {\n      rows: rows.map(toEntitlement),\n      total,\n      page: query.page,\n      pageSize: query.pageSize,\n    };\n  }\n\n  /** A grant targets exactly one of a bundle or a content item (db check\n   *  constraint), so the upsert is inferred on whichever of the two partial\n   *  uniques the target uses. */\n  async insert(orgId: string, input: GrantEntitlementInput): Promise<Entitlement> {\n    const bundleId = input.bundleId ?? null;\n    const contentId = input.contentId ?? null;\n    const target = bundleId\n      ? [entitlements.orgId, entitlements.orgUserId, entitlements.bundleId]\n      : [entitlements.orgId, entitlements.orgUserId, entitlements.contentId];\n\n    const [row] = await this.db\n      .insert(entitlements)\n      .values({\n        orgId,\n        orgUserId: input.orgUserId,\n        bundleId,\n        contentId,\n        status: \"active\",\n        source: \"manual\",\n        grantedAt: new Date(),\n        expiresAt: input.expiresAt,\n      })\n      .onConflictDoUpdate({\n        target,\n        set: {\n          status: \"active\",\n          source: \"manual\",\n          grantedAt: new Date(),\n          expiresAt: input.expiresAt,\n        },\n      })\n      .returning(selection);\n    if (!row) {\n      throw new Error(\"failed to insert entitlement\");\n    }\n    return toEntitlement(row);\n  }\n\n  async insertIfAbsent(orgId: string, input: GrantEntitlementInput): Promise<Entitlement | null> {\n    const bundleId = input.bundleId ?? null;\n    const contentId = input.contentId ?? null;\n    const target = bundleId\n      ? [entitlements.orgId, entitlements.orgUserId, entitlements.bundleId]\n      : [entitlements.orgId, entitlements.orgUserId, entitlements.contentId];\n    const [row] = await this.db\n      .insert(entitlements)\n      .values({\n        orgId,\n        orgUserId: input.orgUserId,\n        bundleId,\n        contentId,\n        status: \"active\",\n        source: \"manual\",\n        grantedAt: new Date(),\n        expiresAt: input.expiresAt,\n      })\n      .onConflictDoNothing({ target })\n      .returning(selection);\n    return row ? toEntitlement(row) : null;\n  }\n\n  async lockGrant(orgId: string, key: GrantKey): Promise<Entitlement | null> {\n    const target = key.bundleId\n      ? eq(entitlements.bundleId, key.bundleId)\n      : key.contentId\n        ? eq(entitlements.contentId, key.contentId)\n        : undefined;\n    if (!target) {\n      return null;\n    }\n    const [row] = await this.db\n      .select(selection)\n      .from(entitlements)\n      .where(and(eq(entitlements.orgId, orgId), eq(entitlements.orgUserId, key.orgUserId), target))\n      .for(\"update\")\n      .limit(1);\n    return row ? toEntitlement(row) : null;\n  }\n\n  async setExpiresAt(\n    orgId: string,\n    id: string,\n    expiresAt: Date | null,\n  ): Promise<Entitlement | null> {\n    const [row] = await this.db\n      .update(entitlements)\n      .set({ expiresAt })\n      .where(and(eq(entitlements.orgId, orgId), eq(entitlements.id, id)))\n      .returning(selection);\n    return row ? toEntitlement(row) : null;\n  }\n\n  async setStatus(\n    orgId: string,\n    id: string,\n    status: \"active\" | \"revoked\",\n  ): Promise<Entitlement | null> {\n    const [row] = await this.db\n      .update(entitlements)\n      .set({ status })\n      .where(and(eq(entitlements.orgId, orgId), eq(entitlements.id, id)))\n      .returning(selection);\n    if (!row) {\n      return null;\n    }\n    return toEntitlement(row);\n  }\n\n  async hasAccess(orgId: string, orgUserId: string, contentId: string): Promise<boolean> {\n    const rows = await this.db\n      .select({ id: contentAccess.entitlementId })\n      .from(contentAccess)\n      .where(\n        and(\n          eq(contentAccess.orgId, orgId),\n          eq(contentAccess.orgUserId, orgUserId),\n          eq(contentAccess.contentId, contentId),\n        ),\n      )\n      .limit(1);\n    return rows.length > 0;\n  }\n\n  async listAccessibleContent(\n    orgId: string,\n    orgUserId: string,\n    type?: ContentType,\n  ): Promise<string[]> {\n    const rows = await this.db\n      .selectDistinct({ contentId: contentAccess.contentId })\n      .from(contentAccess)\n      .innerJoin(\n        contentItems,\n        and(\n          eq(contentItems.orgId, contentAccess.orgId),\n          eq(contentItems.id, contentAccess.contentId),\n        ),\n      )\n      .where(\n        and(\n          eq(contentAccess.orgId, orgId),\n          eq(contentAccess.orgUserId, orgUserId),\n          type ? eq(contentItems.type, type) : undefined,\n        ),\n      );\n    return rows.map((r) => r.contentId);\n  }\n\n  hasCommunityAccess(orgId: string, orgUserId: string, communityId: string): Promise<boolean> {\n    return this.holds(holdsCommunity(sql`${orgId}`, sql`${orgUserId}`, sql`${communityId}`));\n  }\n\n  private async holds(predicate: SQL): Promise<boolean> {\n    const result = await this.db.execute<{ covered: boolean }>(sql`select ${predicate} as covered`);\n    const rows = Array.isArray(result) ? result : result.rows;\n    return rows[0]?.covered === true;\n  }\n\n  async communitiesOpenedBy(orgId: string, grant: GrantTarget): Promise<string[]> {\n    if (!grant.contentId && !grant.bundleId) {\n      return [];\n    }\n    const target = {\n      orgId: sql`${orgId}`,\n      contentId: sql`${grant.contentId ?? null}::text`,\n      bundleId: sql`${grant.bundleId ?? null}::text`,\n    };\n    const rows = await this.db\n      .select({ id: communities.id })\n      .from(communities)\n      .where(\n        and(\n          eq(communities.orgId, orgId),\n          eq(communities.status, \"published\"),\n          grantOpens(target, sql`${communities.id}`, \"community\"),\n        ),\n      )\n      .orderBy(asc(communities.id));\n    return rows.map((row) => row.id);\n  }\n\n  async accessAmong(\n    orgId: string,\n    communityId: string,\n    spaceId: string | null,\n    orgUserIds: string[],\n  ): Promise<AccessFacts[]> {\n    if (orgUserIds.length === 0) {\n      return [];\n    }\n    const activeInSpace = spaceId\n      ? sql<boolean>`exists (\n          select 1 from space_members sm\n          where sm.org_id = ${sql`${orgUsers.orgId}`}\n            and sm.space_id = ${spaceId}\n            and sm.org_user_id = ${sql`${orgUsers.id}`}\n            and sm.status = 'active'\n        )`\n      : sql<boolean>`false`;\n    const rows = await this.db\n      .select({\n        orgUserId: orgUsers.id,\n        role: orgUsers.role,\n        member: sql<boolean>`${communityMember(sql`${orgUsers.orgId}`, sql`${orgUsers.id}`, sql`${orgUsers.role}`, sql`${communityId}`)}`,\n        activeInSpace,\n      })\n      .from(orgUsers)\n      .where(and(eq(orgUsers.orgId, orgId), inArray(orgUsers.id, orgUserIds)));\n    return rows.map((row) => ({\n      orgUserId: row.orgUserId,\n      role: row.role as Role,\n      member: row.member === true,\n      activeInSpace: row.activeInSpace === true,\n    }));\n  }\n\n  async findSpaceMember(\n    orgId: string,\n    spaceId: string,\n    orgUserId: string,\n  ): Promise<SpaceMember | null> {\n    const [row] = await this.db\n      .select()\n      .from(spaceMembers)\n      .where(\n        and(\n          eq(spaceMembers.orgId, orgId),\n          eq(spaceMembers.spaceId, spaceId),\n          eq(spaceMembers.orgUserId, orgUserId),\n        ),\n      )\n      .limit(1);\n    return row ? toSpaceMember(row) : null;\n  }\n\n  async listSpaceMembersFor(\n    orgId: string,\n    orgUserId: string,\n    communityId: string,\n  ): Promise<SpaceMember[]> {\n    const rows = await this.db\n      .select()\n      .from(spaceMembers)\n      .where(\n        and(\n          eq(spaceMembers.orgId, orgId),\n          eq(spaceMembers.orgUserId, orgUserId),\n          eq(spaceMembers.communityId, communityId),\n        ),\n      );\n    return rows.map(toSpaceMember);\n  }\n\n  async lockSpaceMember(\n    orgId: string,\n    spaceId: string,\n    orgUserId: string,\n  ): Promise<SpaceMember | null> {\n    const [row] = await this.db\n      .select()\n      .from(spaceMembers)\n      .where(\n        and(\n          eq(spaceMembers.orgId, orgId),\n          eq(spaceMembers.spaceId, spaceId),\n          eq(spaceMembers.orgUserId, orgUserId),\n        ),\n      )\n      .for(\"update\")\n      .limit(1);\n    return row ? toSpaceMember(row) : null;\n  }\n\n  async listSpaceMembers(\n    orgId: string,\n    spaceId: string,\n    query: SpaceMembersQuery,\n  ): Promise<Page<SpaceMember>> {\n    const where = and(\n      eq(spaceMembers.orgId, orgId),\n      eq(spaceMembers.spaceId, spaceId),\n      query.statuses ? inArray(spaceMembers.status, query.statuses) : undefined,\n    );\n    const rows = await this.db\n      .select()\n      .from(spaceMembers)\n      .where(where)\n      .orderBy(asc(spaceMembers.createdAt), asc(spaceMembers.id))\n      .limit(query.pageSize)\n      .offset((query.page - 1) * query.pageSize);\n    const [{ total } = { total: 0 }] = await this.db\n      .select({ total: sql<number>`cast(count(*) as int)` })\n      .from(spaceMembers)\n      .where(where);\n    return { rows: rows.map(toSpaceMember), total, page: query.page, pageSize: query.pageSize };\n  }\n\n  async insertSpaceMember(orgId: string, input: InsertSpaceMemberInput): Promise<SpaceMember> {\n    const [row] = await this.db\n      .insert(spaceMembers)\n      .values({\n        orgId,\n        communityId: input.communityId,\n        spaceId: input.spaceId,\n        orgUserId: input.orgUserId,\n        status: input.status,\n        source: input.source,\n      })\n      .returning();\n    if (!row) {\n      throw new Error(\"failed to insert space member\");\n    }\n    return toSpaceMember(row);\n  }\n\n  async updateSpaceMemberStatus(\n    orgId: string,\n    id: string,\n    status: SpaceMemberStatus,\n  ): Promise<SpaceMember | null> {\n    const [row] = await this.db\n      .update(spaceMembers)\n      .set({ status })\n      .where(and(eq(spaceMembers.orgId, orgId), eq(spaceMembers.id, id)))\n      .returning();\n    return row ? toSpaceMember(row) : null;\n  }\n\n  async deleteSpaceMember(orgId: string, id: string): Promise<void> {\n    await this.db\n      .delete(spaceMembers)\n      .where(and(eq(spaceMembers.orgId, orgId), eq(spaceMembers.id, id)));\n  }\n\n  async countActiveSpaceMembers(orgId: string, spaceId: string): Promise<number> {\n    const [row] = await this.db\n      .select({ total: sql<number>`cast(count(*) as int)` })\n      .from(spaceMembers)\n      .where(\n        and(\n          eq(spaceMembers.orgId, orgId),\n          eq(spaceMembers.spaceId, spaceId),\n          eq(spaceMembers.status, \"active\"),\n          holdsCommunity(\n            sql`${spaceMembers.orgId}`,\n            sql`${spaceMembers.orgUserId}`,\n            sql`${spaceMembers.communityId}`,\n          ),\n        ),\n      );\n    return row?.total ?? 0;\n  }\n\n  async activeSpaceIds(orgId: string, orgUserId: string, communityId: string): Promise<string[]> {\n    const rows = await this.db\n      .select({ spaceId: spaceMembers.spaceId })\n      .from(spaceMembers)\n      .where(\n        and(\n          eq(spaceMembers.orgId, orgId),\n          eq(spaceMembers.orgUserId, orgUserId),\n          eq(spaceMembers.communityId, communityId),\n          eq(spaceMembers.status, \"active\"),\n        ),\n      );\n    return rows.map((row) => row.spaceId);\n  }\n\n  async listGrantsExpiredBy(\n    orgId: string,\n    now: Date,\n    limit: number,\n    afterId?: string,\n  ): Promise<Entitlement[]> {\n    const rows = await this.db\n      .select(selection)\n      .from(entitlements)\n      .where(\n        and(\n          this.expiredUnnoticed(orgId, now),\n          afterId === undefined ? undefined : gt(entitlements.id, afterId),\n        ),\n      )\n      .orderBy(asc(entitlements.id))\n      .limit(limit);\n    return rows.map(toEntitlement);\n  }\n\n  async listGrantsEndingBetween(\n    orgId: string,\n    after: Date,\n    until: Date,\n    limit: number,\n    afterKey?: EndingGrantKey,\n  ): Promise<EndingGrant[]> {\n    const rows = await this.db\n      .select({ ...selection, communityId: communities.id })\n      .from(entitlements)\n      .innerJoin(communities, opensPublishedCommunity)\n      .where(\n        and(\n          this.endingUnnoticed(orgId, after, until),\n          afterKey\n            ? sql`(${entitlements.id}, ${communities.id}) > (${afterKey.entitlementId}, ${afterKey.communityId})`\n            : undefined,\n        ),\n      )\n      .orderBy(asc(entitlements.id), asc(communities.id))\n      .limit(limit);\n    return rows.map(({ communityId, ...grant }) => ({\n      grant: toEntitlement(grant),\n      communityId,\n    }));\n  }\n\n  async hasDueNotices(orgId: string, now: Date, until: Date): Promise<boolean> {\n    const expired = this.db\n      .select({ id: entitlements.id })\n      .from(entitlements)\n      .where(this.expiredUnnoticed(orgId, now));\n    const ending = this.db\n      .select({ id: entitlements.id })\n      .from(entitlements)\n      .innerJoin(communities, opensPublishedCommunity)\n      .where(this.endingUnnoticed(orgId, now, until));\n    return this.holds(sql`(exists (${expired}) or exists (${ending}))`);\n  }\n\n  async claimNotice(orgId: string, notice: EntitlementNotice, now: Date): Promise<boolean> {\n    const statement =\n      notice.kind === \"expired\"\n        ? sql`insert into ${entitlementExpiryNotices} (\"org_id\", \"entitlement_id\", \"expires_at\", \"notified_at\")\n            values (${orgId}, ${notice.entitlementId}, ${at(notice.expiresAt)}, ${at(now)})\n            on conflict do nothing\n            returning \"entitlement_id\"`\n        : sql`insert into ${entitlementEndingSoonNotices} (\"org_id\", \"entitlement_id\", \"community_id\", \"expires_at\", \"notified_at\")\n            values (${orgId}, ${notice.entitlementId}, ${notice.communityId}, ${at(notice.expiresAt)}, ${at(now)})\n            on conflict do nothing\n            returning \"entitlement_id\"`;\n    const result = await this.db.execute<{ entitlement_id: string }>(statement);\n    const rows = Array.isArray(result) ? result : result.rows;\n    return rows.length > 0;\n  }\n\n  private expiredUnnoticed(orgId: string, now: Date): SQL {\n    return and(\n      eq(entitlements.orgId, orgId),\n      eq(entitlements.status, \"active\"),\n      grantExpired(entitlements.expiresAt, at(now)),\n      sql`not ${expiryNoticed}`,\n    )!;\n  }\n\n  private endingUnnoticed(orgId: string, after: Date, until: Date): SQL {\n    return and(\n      eq(entitlements.orgId, orgId),\n      grantIsActive(entitlements, at(after)),\n      grantExpired(entitlements.expiresAt, at(until)),\n      sql`not ${endingSoonNoticed}`,\n    )!;\n  }\n\n  async communityModeratorIds(orgId: string, communityId: string): Promise<string[]> {\n    const rows = await this.db\n      .select({ id: orgUsers.id })\n      .from(orgUsers)\n      .where(\n        and(\n          eq(orgUsers.orgId, orgId),\n          inArray(orgUsers.role, MODERATING_ROLES),\n          communityMember(\n            sql`${orgUsers.orgId}`,\n            sql`${orgUsers.id}`,\n            sql`${orgUsers.role}`,\n            sql`${communityId}`,\n          ),\n        ),\n      )\n      .orderBy(asc(orgUsers.id));\n    return rows.map((row) => row.id);\n  }\n\n  async communityMemberIds(orgId: string, communityId: string): Promise<string[]> {\n    const rows = await this.db\n      .select({ id: orgUsers.id })\n      .from(orgUsers)\n      .where(\n        and(\n          eq(orgUsers.orgId, orgId),\n          communityMember(\n            sql`${orgUsers.orgId}`,\n            sql`${orgUsers.id}`,\n            sql`${orgUsers.role}`,\n            sql`${communityId}`,\n          ),\n        ),\n      )\n      .orderBy(asc(orgUsers.id));\n    return rows.map((row) => row.id);\n  }\n\n  async communityIdsOpenedFor(orgId: string, orgUserId: string): Promise<string[]> {\n    const rows = await this.db\n      .selectDistinct({ id: communities.id })\n      .from(communities)\n      .where(\n        and(\n          eq(communities.orgId, orgId),\n          holdsCommunity(sql`${communities.orgId}`, sql`${orgUserId}`, sql`${communities.id}`),\n        ),\n      )\n      .orderBy(asc(communities.id));\n    return rows.map((row) => row.id);\n  }\n}\n\nfunction toSpaceMember(row: {\n  orgId: string;\n  id: string;\n  communityId: string;\n  spaceId: string;\n  orgUserId: string;\n  status: SpaceMemberStatus;\n  source: \"request\" | \"invite\" | \"manual\";\n  createdAt: Date;\n  updatedAt: Date;\n}): SpaceMember {\n  return {\n    orgId: row.orgId,\n    id: row.id,\n    communityId: row.communityId,\n    spaceId: row.spaceId,\n    orgUserId: row.orgUserId,\n    status: row.status,\n    source: row.source,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n\ntranslateDbErrors(DrizzleEntitlementsRepository);\n"],"mappings":";;;;;;;;;;;AAgDA,MAAM,mBAA2B,MAAM,QAAQ,SAAS,YAAY,IAAI,CAAC;AAIzE,MAAM,gBAAgB,GAAmB;SAChC,aAAa,OAAO;SACpB,aAAa,aAAa,SAAS,EAAE;;;AAI9C,SAAS,GAAG,MAAiB;CAC3B,OAAO,GAAG,GAAG,KAAK,YAAY,EAAE;AAClC;AAEA,MAAM,gBAAgB,GAAG;kBACP,yBAAyB;UACjC,yBAAyB,MAAM,KAAK,aAAa,MAAM;UACvD,yBAAyB,cAAc,KAAK,aAAa,GAAG;UAC5D,yBAAyB,UAAU,KAAK,aAAa,UAAU;;AAGzE,MAAM,oBAAoB,GAAG;kBACX,6BAA6B;UACrC,6BAA6B,MAAM,KAAK,aAAa,MAAM;UAC3D,6BAA6B,cAAc,KAAK,aAAa,GAAG;UAChE,6BAA6B,YAAY,KAAK,YAAY,GAAG;UAC7D,6BAA6B,UAAU,KAAK,aAAa,UAAU;;AAG7E,MAAM,0BAA0B,IAC9B,GAAG,YAAY,OAAO,aAAa,KAAK,GACxC,GAAG,YAAY,QAAQ,WAAW,GAClC,WAAW,cAAc,GAAG,GAAG,YAAY,MAAM,WAAW,CAC9D;AAMA,MAAM,eAAe,GAAW,YAAY,QAAQ,MAAM,IAAI,UAAU,MAAM,IAAI,YAAY,MAAM,IAAI,QAAQ,KAAK;AAKrH,MAAM,cAAc;CAClB,WAAW,MAAM;CACjB,UAAU,MAAM;CAChB,OAAO,MAAM;CACb;CACA,QAAQ;CACR,WAAW,aAAa;CACxB,WAAW,aAAa;CACxB,QAAQ,aAAa;AACvB;AAEA,MAAM,YAAY;CAChB,OAAO,aAAa;CACpB,IAAI,aAAa;CACjB,WAAW,aAAa;CACxB,UAAU,aAAa;CACvB,WAAW,aAAa;CACxB,QAAQ,aAAa;CACrB,QAAQ,aAAa;CACrB,WAAW,aAAa;CACxB,WAAW,aAAa;CACxB,WAAW,aAAa;CACxB,WAAW,aAAa;AAC1B;AAgBA,SAAS,cAAc,KAAuB;CAC5C,OAAO;EACL,OAAO,IAAI;EACX,IAAI,IAAI;EACR,WAAW,IAAI;EACf,UAAU,IAAI;EACd,WAAW,IAAI;EACf,QAAQ,IAAI;EACZ,QAAQ,IAAI;EACZ,WAAW,IAAI;EACf,WAAW,IAAI;EACf,WAAW,IAAI;EACf,WAAW,IAAI;CACjB;AACF;AAEA,IAAa,gCAAb,MAA6E;CAExD;CACA;CAFnB,YACE,IACA,SAAkC,YAClC;EAFiB,KAAA,KAAA;EACA,KAAA,SAAA;CAChB;;;;CAKH,OAAe,OAAwB;EACrC,OAAO,KAAK,GACT,OAAO,SAAS,CAAC,CACjB,KAAK,YAAY,CAAC,CAClB,UACC,UACA,IAAI,GAAG,SAAS,OAAO,aAAa,KAAK,GAAG,GAAG,SAAS,IAAI,aAAa,SAAS,CAAC,CACrF,CAAC,CACA,UAAU,OAAO,GAAG,MAAM,IAAI,SAAS,MAAM,CAAC,CAAC,CAC/C,SACC,cACA,IACE,GAAG,aAAa,OAAO,aAAa,KAAK,GACzC,GAAG,aAAa,IAAI,aAAa,SAAS,CAC5C,CACF,CAAC,CACA,SACC,SACA,IAAI,GAAG,QAAQ,OAAO,aAAa,KAAK,GAAG,GAAG,QAAQ,IAAI,aAAa,QAAQ,CAAC,CAClF,CAAC,CACA,SACC,SACA,IAAI,GAAG,QAAQ,OAAO,aAAa,KAAK,GAAG,GAAG,QAAQ,IAAI,aAAa,SAAS,CAAC,CACnF,CAAC,CACA,SACC,WACA,IAAI,GAAG,UAAU,OAAO,aAAa,KAAK,GAAG,GAAG,UAAU,IAAI,aAAa,SAAS,CAAC,CACvF,CAAC,CACA,SACC,aACA,IAAI,GAAG,YAAY,OAAO,aAAa,KAAK,GAAG,GAAG,YAAY,IAAI,aAAa,SAAS,CAAC,CAC3F,CAAC,CACA,MAAM,KAAK;CAChB;CAEA,MAAM,KAAK,OAAe,OAAsD;EAC9E,MAAM,aAAoB,CAAC,GAAG,aAAa,OAAO,KAAK,CAAC;EACxD,IAAI,MAAM,QACR,WAAW,KAAK,GAAG,GAAG,cAAc,KAAK,MAAM,QAAQ;EAEzD,IAAI,MAAM,QACR,WAAW,KAAK,GAAG,aAAa,QAAQ,MAAM,MAAM,CAAC;EAEvD,IAAI,MAAM,WACR,WAAW,KAAK,GAAG,aAAa,WAAW,MAAM,SAAS,CAAC;EAE7D,IAAI,MAAM,WACR,WAAW,KAAK,GAAG,aAAa,WAAW,MAAM,SAAS,CAAC;EAE7D,IAAI,MAAM,UACR,WAAW,KAAK,GAAG,aAAa,UAAU,MAAM,QAAQ,CAAC;EAE3D,IAAI,MAAM,MACR,WAAW,KAAK,GAAG,aAAa,MAAM,MAAM,IAAI,CAAC;EAEnD,IAAI,MAAM,QAAQ;GAChB,MAAM,UAAU,IAAI,MAAM,OAAO;GACjC,WAAW,KACT,GACE,MAAM,MAAM,WAAW,OAAO,GAC9B,MAAM,MAAM,UAAU,OAAO,GAC7B,MAAM,MAAM,OAAO,OAAO,GAC1B,MAAM,cAAc,OAAO,CAC7B,CACF;EACF;EACA,MAAM,QAAQ,IAAI,GAAG,UAAU;EAG/B,IAAI;EACJ,IAAI,MAAM,MAAM;GACd,MAAM,SAAS,MAAM,KAAK,WAAW,GAAG;GACxC,MAAM,QAAS,SAAS,MAAM,KAAK,MAAM,CAAC,IAAI,MAAM;GACpD,MAAM,MAAM,YAAY,UAAU,aAAa;GAC/C,UAAU,SAAS,KAAK,GAAG,IAAI,IAAI,GAAG;EACxC,OACE,UAAU,KAAK,aAAa,SAAS;EAGvC,MAAM,UAAU,MAAM,OAAO,KAAK,MAAM;EAExC,MAAM,OAAO,MAAM,KAAK,OAAO,KAAK,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,MAAM,MAAM,QAAQ,CAAC,CAAC,OAAO,MAAM;EAE1F,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,MAAM,KAAK,GAC3C,OAAO,EAAE,OAAO,GAAW,wBAAwB,CAAC,CAAC,CACrD,KAAK,YAAY,CAAC,CAClB,UACC,UACA,IAAI,GAAG,SAAS,OAAO,aAAa,KAAK,GAAG,GAAG,SAAS,IAAI,aAAa,SAAS,CAAC,CACrF,CAAC,CACA,UAAU,OAAO,GAAG,MAAM,IAAI,SAAS,MAAM,CAAC,CAAC,CAC/C,SACC,cACA,IACE,GAAG,aAAa,OAAO,aAAa,KAAK,GACzC,GAAG,aAAa,IAAI,aAAa,SAAS,CAC5C,CACF,CAAC,CACA,SACC,SACA,IAAI,GAAG,QAAQ,OAAO,aAAa,KAAK,GAAG,GAAG,QAAQ,IAAI,aAAa,QAAQ,CAAC,CAClF,CAAC,CACA,SACC,SACA,IAAI,GAAG,QAAQ,OAAO,aAAa,KAAK,GAAG,GAAG,QAAQ,IAAI,aAAa,SAAS,CAAC,CACnF,CAAC,CACA,SACC,WACA,IAAI,GAAG,UAAU,OAAO,aAAa,KAAK,GAAG,GAAG,UAAU,IAAI,aAAa,SAAS,CAAC,CACvF,CAAC,CACA,SACC,aACA,IAAI,GAAG,YAAY,OAAO,aAAa,KAAK,GAAG,GAAG,YAAY,IAAI,aAAa,SAAS,CAAC,CAC3F,CAAC,CACA,MAAM,KAAK;EAEd,OAAO;GACL,MAAM,KAAK,IAAI,aAAa;GAC5B;GACA,MAAM,MAAM;GACZ,UAAU,MAAM;EAClB;CACF;;;;CAKA,MAAM,OAAO,OAAe,OAAoD;EAC9E,MAAM,WAAW,MAAM,YAAY;EACnC,MAAM,YAAY,MAAM,aAAa;EACrC,MAAM,SAAS,WACX;GAAC,aAAa;GAAO,aAAa;GAAW,aAAa;EAAQ,IAClE;GAAC,aAAa;GAAO,aAAa;GAAW,aAAa;EAAS;EAEvE,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,YAAY,CAAC,CACpB,OAAO;GACN;GACA,WAAW,MAAM;GACjB;GACA;GACA,QAAQ;GACR,QAAQ;GACR,2BAAW,IAAI,KAAK;GACpB,WAAW,MAAM;EACnB,CAAC,CAAC,CACD,mBAAmB;GAClB;GACA,KAAK;IACH,QAAQ;IACR,QAAQ;IACR,2BAAW,IAAI,KAAK;IACpB,WAAW,MAAM;GACnB;EACF,CAAC,CAAC,CACD,UAAU,SAAS;EACtB,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,8BAA8B;EAEhD,OAAO,cAAc,GAAG;CAC1B;CAEA,MAAM,eAAe,OAAe,OAA2D;EAC7F,MAAM,WAAW,MAAM,YAAY;EACnC,MAAM,YAAY,MAAM,aAAa;EACrC,MAAM,SAAS,WACX;GAAC,aAAa;GAAO,aAAa;GAAW,aAAa;EAAQ,IAClE;GAAC,aAAa;GAAO,aAAa;GAAW,aAAa;EAAS;EACvE,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,YAAY,CAAC,CACpB,OAAO;GACN;GACA,WAAW,MAAM;GACjB;GACA;GACA,QAAQ;GACR,QAAQ;GACR,2BAAW,IAAI,KAAK;GACpB,WAAW,MAAM;EACnB,CAAC,CAAC,CACD,oBAAoB,EAAE,OAAO,CAAC,CAAC,CAC/B,UAAU,SAAS;EACtB,OAAO,MAAM,cAAc,GAAG,IAAI;CACpC;CAEA,MAAM,UAAU,OAAe,KAA4C;EACzE,MAAM,SAAS,IAAI,WACf,GAAG,aAAa,UAAU,IAAI,QAAQ,IACtC,IAAI,YACF,GAAG,aAAa,WAAW,IAAI,SAAS,IACxC,KAAA;EACN,IAAI,CAAC,QACH,OAAO;EAET,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,SAAS,CAAC,CACjB,KAAK,YAAY,CAAC,CAClB,MAAM,IAAI,GAAG,aAAa,OAAO,KAAK,GAAG,GAAG,aAAa,WAAW,IAAI,SAAS,GAAG,MAAM,CAAC,CAAC,CAC5F,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;EACV,OAAO,MAAM,cAAc,GAAG,IAAI;CACpC;CAEA,MAAM,aACJ,OACA,IACA,WAC6B;EAC7B,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,YAAY,CAAC,CACpB,IAAI,EAAE,UAAU,CAAC,CAAC,CAClB,MAAM,IAAI,GAAG,aAAa,OAAO,KAAK,GAAG,GAAG,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAClE,UAAU,SAAS;EACtB,OAAO,MAAM,cAAc,GAAG,IAAI;CACpC;CAEA,MAAM,UACJ,OACA,IACA,QAC6B;EAC7B,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,YAAY,CAAC,CACpB,IAAI,EAAE,OAAO,CAAC,CAAC,CACf,MAAM,IAAI,GAAG,aAAa,OAAO,KAAK,GAAG,GAAG,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAClE,UAAU,SAAS;EACtB,IAAI,CAAC,KACH,OAAO;EAET,OAAO,cAAc,GAAG;CAC1B;CAEA,MAAM,UAAU,OAAe,WAAmB,WAAqC;EAYrF,QAAO,MAXY,KAAK,GACrB,OAAO,EAAE,IAAI,cAAc,cAAc,CAAC,CAAC,CAC3C,KAAK,aAAa,CAAC,CACnB,MACC,IACE,GAAG,cAAc,OAAO,KAAK,GAC7B,GAAG,cAAc,WAAW,SAAS,GACrC,GAAG,cAAc,WAAW,SAAS,CACvC,CACF,CAAC,CACA,MAAM,CAAC,EAAA,CACE,SAAS;CACvB;CAEA,MAAM,sBACJ,OACA,WACA,MACmB;EAkBnB,QAAO,MAjBY,KAAK,GACrB,eAAe,EAAE,WAAW,cAAc,UAAU,CAAC,CAAC,CACtD,KAAK,aAAa,CAAC,CACnB,UACC,cACA,IACE,GAAG,aAAa,OAAO,cAAc,KAAK,GAC1C,GAAG,aAAa,IAAI,cAAc,SAAS,CAC7C,CACF,CAAC,CACA,MACC,IACE,GAAG,cAAc,OAAO,KAAK,GAC7B,GAAG,cAAc,WAAW,SAAS,GACrC,OAAO,GAAG,aAAa,MAAM,IAAI,IAAI,KAAA,CACvC,CACF,EAAA,CACU,KAAK,MAAM,EAAE,SAAS;CACpC;CAEA,mBAAmB,OAAe,WAAmB,aAAuC;EAC1F,OAAO,KAAK,MAAM,eAAe,GAAG,GAAG,SAAS,GAAG,GAAG,aAAa,GAAG,GAAG,aAAa,CAAC;CACzF;CAEA,MAAc,MAAM,WAAkC;EACpD,MAAM,SAAS,MAAM,KAAK,GAAG,QAA8B,GAAG,UAAU,UAAU,YAAY;EAE9F,QADa,MAAM,QAAQ,MAAM,IAAI,SAAS,OAAO,KAAA,CACzC,EAAE,EAAE,YAAY;CAC9B;CAEA,MAAM,oBAAoB,OAAe,OAAuC;EAC9E,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,UAC7B,OAAO,CAAC;EAEV,MAAM,SAAS;GACb,OAAO,GAAG,GAAG;GACb,WAAW,GAAG,GAAG,MAAM,aAAa,KAAK;GACzC,UAAU,GAAG,GAAG,MAAM,YAAY,KAAK;EACzC;EAYA,QAAO,MAXY,KAAK,GACrB,OAAO,EAAE,IAAI,YAAY,GAAG,CAAC,CAAC,CAC9B,KAAK,WAAW,CAAC,CACjB,MACC,IACE,GAAG,YAAY,OAAO,KAAK,GAC3B,GAAG,YAAY,QAAQ,WAAW,GAClC,WAAW,QAAQ,GAAG,GAAG,YAAY,MAAM,WAAW,CACxD,CACF,CAAC,CACA,QAAQ,IAAI,YAAY,EAAE,CAAC,EAAA,CAClB,KAAK,QAAQ,IAAI,EAAE;CACjC;CAEA,MAAM,YACJ,OACA,aACA,SACA,YACwB;EACxB,IAAI,WAAW,WAAW,GACxB,OAAO,CAAC;EAEV,MAAM,gBAAgB,UAClB,GAAY;;8BAEU,GAAG,GAAG,SAAS,QAAQ;gCACrB,QAAQ;mCACL,GAAG,GAAG,SAAS,KAAK;;aAG/C,GAAY;EAUhB,QAAO,MATY,KAAK,GACrB,OAAO;GACN,WAAW,SAAS;GACpB,MAAM,SAAS;GACf,QAAQ,GAAY,GAAG,gBAAgB,GAAG,GAAG,SAAS,SAAS,GAAG,GAAG,SAAS,MAAM,GAAG,GAAG,SAAS,QAAQ,GAAG,GAAG,aAAa;GAC9H;EACF,CAAC,CAAC,CACD,KAAK,QAAQ,CAAC,CACd,MAAM,IAAI,GAAG,SAAS,OAAO,KAAK,GAAG,QAAQ,SAAS,IAAI,UAAU,CAAC,CAAC,EAAA,CAC7D,KAAK,SAAS;GACxB,WAAW,IAAI;GACf,MAAM,IAAI;GACV,QAAQ,IAAI,WAAW;GACvB,eAAe,IAAI,kBAAkB;EACvC,EAAE;CACJ;CAEA,MAAM,gBACJ,OACA,SACA,WAC6B;EAC7B,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,CAAC,CACR,KAAK,YAAY,CAAC,CAClB,MACC,IACE,GAAG,aAAa,OAAO,KAAK,GAC5B,GAAG,aAAa,SAAS,OAAO,GAChC,GAAG,aAAa,WAAW,SAAS,CACtC,CACF,CAAC,CACA,MAAM,CAAC;EACV,OAAO,MAAM,cAAc,GAAG,IAAI;CACpC;CAEA,MAAM,oBACJ,OACA,WACA,aACwB;EAWxB,QAAO,MAVY,KAAK,GACrB,OAAO,CAAC,CACR,KAAK,YAAY,CAAC,CAClB,MACC,IACE,GAAG,aAAa,OAAO,KAAK,GAC5B,GAAG,aAAa,WAAW,SAAS,GACpC,GAAG,aAAa,aAAa,WAAW,CAC1C,CACF,EAAA,CACU,IAAI,aAAa;CAC/B;CAEA,MAAM,gBACJ,OACA,SACA,WAC6B;EAC7B,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,CAAC,CACR,KAAK,YAAY,CAAC,CAClB,MACC,IACE,GAAG,aAAa,OAAO,KAAK,GAC5B,GAAG,aAAa,SAAS,OAAO,GAChC,GAAG,aAAa,WAAW,SAAS,CACtC,CACF,CAAC,CACA,IAAI,QAAQ,CAAC,CACb,MAAM,CAAC;EACV,OAAO,MAAM,cAAc,GAAG,IAAI;CACpC;CAEA,MAAM,iBACJ,OACA,SACA,OAC4B;EAC5B,MAAM,QAAQ,IACZ,GAAG,aAAa,OAAO,KAAK,GAC5B,GAAG,aAAa,SAAS,OAAO,GAChC,MAAM,WAAW,QAAQ,aAAa,QAAQ,MAAM,QAAQ,IAAI,KAAA,CAClE;EACA,MAAM,OAAO,MAAM,KAAK,GACrB,OAAO,CAAC,CACR,KAAK,YAAY,CAAC,CAClB,MAAM,KAAK,CAAC,CACZ,QAAQ,IAAI,aAAa,SAAS,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC,CAC1D,MAAM,MAAM,QAAQ,CAAC,CACrB,QAAQ,MAAM,OAAO,KAAK,MAAM,QAAQ;EAC3C,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,MAAM,KAAK,GAC3C,OAAO,EAAE,OAAO,GAAW,wBAAwB,CAAC,CAAC,CACrD,KAAK,YAAY,CAAC,CAClB,MAAM,KAAK;EACd,OAAO;GAAE,MAAM,KAAK,IAAI,aAAa;GAAG;GAAO,MAAM,MAAM;GAAM,UAAU,MAAM;EAAS;CAC5F;CAEA,MAAM,kBAAkB,OAAe,OAAqD;EAC1F,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,YAAY,CAAC,CACpB,OAAO;GACN;GACA,aAAa,MAAM;GACnB,SAAS,MAAM;GACf,WAAW,MAAM;GACjB,QAAQ,MAAM;GACd,QAAQ,MAAM;EAChB,CAAC,CAAC,CACD,UAAU;EACb,IAAI,CAAC,KACH,MAAM,IAAI,MAAM,+BAA+B;EAEjD,OAAO,cAAc,GAAG;CAC1B;CAEA,MAAM,wBACJ,OACA,IACA,QAC6B;EAC7B,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,YAAY,CAAC,CACpB,IAAI,EAAE,OAAO,CAAC,CAAC,CACf,MAAM,IAAI,GAAG,aAAa,OAAO,KAAK,GAAG,GAAG,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAClE,UAAU;EACb,OAAO,MAAM,cAAc,GAAG,IAAI;CACpC;CAEA,MAAM,kBAAkB,OAAe,IAA2B;EAChE,MAAM,KAAK,GACR,OAAO,YAAY,CAAC,CACpB,MAAM,IAAI,GAAG,aAAa,OAAO,KAAK,GAAG,GAAG,aAAa,IAAI,EAAE,CAAC,CAAC;CACtE;CAEA,MAAM,wBAAwB,OAAe,SAAkC;EAC7E,MAAM,CAAC,OAAO,MAAM,KAAK,GACtB,OAAO,EAAE,OAAO,GAAW,wBAAwB,CAAC,CAAC,CACrD,KAAK,YAAY,CAAC,CAClB,MACC,IACE,GAAG,aAAa,OAAO,KAAK,GAC5B,GAAG,aAAa,SAAS,OAAO,GAChC,GAAG,aAAa,QAAQ,QAAQ,GAChC,eACE,GAAG,GAAG,aAAa,SACnB,GAAG,GAAG,aAAa,aACnB,GAAG,GAAG,aAAa,aACrB,CACF,CACF;EACF,OAAO,KAAK,SAAS;CACvB;CAEA,MAAM,eAAe,OAAe,WAAmB,aAAwC;EAY7F,QAAO,MAXY,KAAK,GACrB,OAAO,EAAE,SAAS,aAAa,QAAQ,CAAC,CAAC,CACzC,KAAK,YAAY,CAAC,CAClB,MACC,IACE,GAAG,aAAa,OAAO,KAAK,GAC5B,GAAG,aAAa,WAAW,SAAS,GACpC,GAAG,aAAa,aAAa,WAAW,GACxC,GAAG,aAAa,QAAQ,QAAQ,CAClC,CACF,EAAA,CACU,KAAK,QAAQ,IAAI,OAAO;CACtC;CAEA,MAAM,oBACJ,OACA,KACA,OACA,SACwB;EAYxB,QAAO,MAXY,KAAK,GACrB,OAAO,SAAS,CAAC,CACjB,KAAK,YAAY,CAAC,CAClB,MACC,IACE,KAAK,iBAAiB,OAAO,GAAG,GAChC,YAAY,KAAA,IAAY,KAAA,IAAY,GAAG,aAAa,IAAI,OAAO,CACjE,CACF,CAAC,CACA,QAAQ,IAAI,aAAa,EAAE,CAAC,CAAC,CAC7B,MAAM,KAAK,EAAA,CACF,IAAI,aAAa;CAC/B;CAEA,MAAM,wBACJ,OACA,OACA,OACA,OACA,UACwB;EAexB,QAAO,MAdY,KAAK,GACrB,OAAO;GAAE,GAAG;GAAW,aAAa,YAAY;EAAG,CAAC,CAAC,CACrD,KAAK,YAAY,CAAC,CAClB,UAAU,aAAa,uBAAuB,CAAC,CAC/C,MACC,IACE,KAAK,gBAAgB,OAAO,OAAO,KAAK,GACxC,WACI,GAAG,IAAI,aAAa,GAAG,IAAI,YAAY,GAAG,OAAO,SAAS,cAAc,IAAI,SAAS,YAAY,KACjG,KAAA,CACN,CACF,CAAC,CACA,QAAQ,IAAI,aAAa,EAAE,GAAG,IAAI,YAAY,EAAE,CAAC,CAAC,CAClD,MAAM,KAAK,EAAA,CACF,KAAK,EAAE,aAAa,GAAG,aAAa;GAC9C,OAAO,cAAc,KAAK;GAC1B;EACF,EAAE;CACJ;CAEA,MAAM,cAAc,OAAe,KAAW,OAA+B;EAC3E,MAAM,UAAU,KAAK,GAClB,OAAO,EAAE,IAAI,aAAa,GAAG,CAAC,CAAC,CAC/B,KAAK,YAAY,CAAC,CAClB,MAAM,KAAK,iBAAiB,OAAO,GAAG,CAAC;EAC1C,MAAM,SAAS,KAAK,GACjB,OAAO,EAAE,IAAI,aAAa,GAAG,CAAC,CAAC,CAC/B,KAAK,YAAY,CAAC,CAClB,UAAU,aAAa,uBAAuB,CAAC,CAC/C,MAAM,KAAK,gBAAgB,OAAO,KAAK,KAAK,CAAC;EAChD,OAAO,KAAK,MAAM,GAAG,YAAY,QAAQ,eAAe,OAAO,GAAG;CACpE;CAEA,MAAM,YAAY,OAAe,QAA2B,KAA6B;EACvF,MAAM,YACJ,OAAO,SAAS,YACZ,GAAG,eAAe,yBAAyB;sBAC/B,MAAM,IAAI,OAAO,cAAc,IAAI,GAAG,OAAO,SAAS,EAAE,IAAI,GAAG,GAAG,EAAE;;0CAGhF,GAAG,eAAe,6BAA6B;sBACnC,MAAM,IAAI,OAAO,cAAc,IAAI,OAAO,YAAY,IAAI,GAAG,OAAO,SAAS,EAAE,IAAI,GAAG,GAAG,EAAE;;;EAG7G,MAAM,SAAS,MAAM,KAAK,GAAG,QAAoC,SAAS;EAE1E,QADa,MAAM,QAAQ,MAAM,IAAI,SAAS,OAAO,KAAA,CACzC,SAAS;CACvB;CAEA,iBAAyB,OAAe,KAAgB;EACtD,OAAO,IACL,GAAG,aAAa,OAAO,KAAK,GAC5B,GAAG,aAAa,QAAQ,QAAQ,GAChC,aAAa,aAAa,WAAW,GAAG,GAAG,CAAC,GAC5C,GAAG,OAAO,eACZ;CACF;CAEA,gBAAwB,OAAe,OAAa,OAAkB;EACpE,OAAO,IACL,GAAG,aAAa,OAAO,KAAK,GAC5B,cAAc,cAAc,GAAG,KAAK,CAAC,GACrC,aAAa,aAAa,WAAW,GAAG,KAAK,CAAC,GAC9C,GAAG,OAAO,mBACZ;CACF;CAEA,MAAM,sBAAsB,OAAe,aAAwC;EAiBjF,QAAO,MAhBY,KAAK,GACrB,OAAO,EAAE,IAAI,SAAS,GAAG,CAAC,CAAC,CAC3B,KAAK,QAAQ,CAAC,CACd,MACC,IACE,GAAG,SAAS,OAAO,KAAK,GACxB,QAAQ,SAAS,MAAM,gBAAgB,GACvC,gBACE,GAAG,GAAG,SAAS,SACf,GAAG,GAAG,SAAS,MACf,GAAG,GAAG,SAAS,QACf,GAAG,GAAG,aACR,CACF,CACF,CAAC,CACA,QAAQ,IAAI,SAAS,EAAE,CAAC,EAAA,CACf,KAAK,QAAQ,IAAI,EAAE;CACjC;CAEA,MAAM,mBAAmB,OAAe,aAAwC;EAgB9E,QAAO,MAfY,KAAK,GACrB,OAAO,EAAE,IAAI,SAAS,GAAG,CAAC,CAAC,CAC3B,KAAK,QAAQ,CAAC,CACd,MACC,IACE,GAAG,SAAS,OAAO,KAAK,GACxB,gBACE,GAAG,GAAG,SAAS,SACf,GAAG,GAAG,SAAS,MACf,GAAG,GAAG,SAAS,QACf,GAAG,GAAG,aACR,CACF,CACF,CAAC,CACA,QAAQ,IAAI,SAAS,EAAE,CAAC,EAAA,CACf,KAAK,QAAQ,IAAI,EAAE;CACjC;CAEA,MAAM,sBAAsB,OAAe,WAAsC;EAW/E,QAAO,MAVY,KAAK,GACrB,eAAe,EAAE,IAAI,YAAY,GAAG,CAAC,CAAC,CACtC,KAAK,WAAW,CAAC,CACjB,MACC,IACE,GAAG,YAAY,OAAO,KAAK,GAC3B,eAAe,GAAG,GAAG,YAAY,SAAS,GAAG,GAAG,aAAa,GAAG,GAAG,YAAY,IAAI,CACrF,CACF,CAAC,CACA,QAAQ,IAAI,YAAY,EAAE,CAAC,EAAA,CAClB,KAAK,QAAQ,IAAI,EAAE;CACjC;AACF;AAEA,SAAS,cAAc,KAUP;CACd,OAAO;EACL,OAAO,IAAI;EACX,IAAI,IAAI;EACR,aAAa,IAAI;EACjB,SAAS,IAAI;EACb,WAAW,IAAI;EACf,QAAQ,IAAI;EACZ,QAAQ,IAAI;EACZ,WAAW,IAAI;EACf,WAAW,IAAI;CACjB;AACF;AAEA,kBAAkB,6BAA6B"}

package/dist/repositories/grant-covers.d.ts

@@ -0,0 +1,20 @@
+import { entitlements } from "../schema/entitlements.js";
+import { SQL, SQLWrapper } from "drizzle-orm";
+//#region src/repositories/grant-covers.d.ts
+type GrantedContentType = "course" | "download" | "community";
+interface GrantColumns {
+  orgId: SQLWrapper;
+  contentId: SQLWrapper;
+  bundleId: SQLWrapper;
+}
+declare function grantUnexpired(expiresAt?: SQLWrapper, at?: SQL): SQL;
+declare function grantExpired(expiresAt?: SQLWrapper, at?: SQL): SQL;
+declare function grantIsActive(row?: typeof entitlements, at?: SQL): SQL;
+declare function grantOpens(row: GrantColumns, contentId: SQL, type: GrantedContentType): SQL;
+declare function activeGrantCovers(orgId: SQL, orgUserId: SQL, contentId: SQL, type: GrantedContentType): SQL;
+declare function communityPublished(orgId: SQL, communityId: SQL): SQL;
+declare function holdsCommunity(orgId: SQL, orgUserId: SQL, communityId: SQL): SQL;
+declare function communityMember(orgId: SQL, orgUserId: SQL, role: SQL, communityId: SQL): SQL;
+//#endregion
+export { GrantColumns, GrantedContentType, activeGrantCovers, communityMember, communityPublished, grantExpired, grantIsActive, grantOpens, grantUnexpired, holdsCommunity };
+//# sourceMappingURL=grant-covers.d.ts.map

package/dist/repositories/grant-covers.js

@@ -0,0 +1,55 @@
+import { entitlements } from "../schema/entitlements.js";
+import { sql } from "drizzle-orm";
+import { STAFF_ROLES } from "@headless-lms/core/organizations";
+//#region src/repositories/grant-covers.ts
+function grantUnexpired(expiresAt = entitlements.expiresAt, at = sql`now()`) {
+	return sql`(${expiresAt} is null or ${expiresAt} > ${at})`;
+}
+function grantExpired(expiresAt = entitlements.expiresAt, at = sql`now()`) {
+	return sql`(${expiresAt} is not null and ${expiresAt} <= ${at})`;
+}
+function grantIsActive(row = entitlements, at) {
+	return sql`(${row.status} = 'active' and ${grantUnexpired(row.expiresAt, at)})`;
+}
+function grantOpens(row, contentId, type) {
+	return sql`(
+    exists (
+      select 1 from content_items ci
+      where ci.org_id = ${row.orgId} and ci.id = ${contentId} and ci.type = ${type}
+    )
+    and (
+      ${row.contentId} = ${contentId}
+      or exists (
+        select 1 from bundle_items bi
+        where bi.org_id = ${row.orgId}
+          and bi.bundle_id = ${row.bundleId}
+          and bi.content_id = ${contentId}
+      )
+    )
+  )`;
+}
+function activeGrantCovers(orgId, orgUserId, contentId, type) {
+	return sql`exists (
+    select 1 from content_access ca
+    join content_items ci on ci.org_id = ca.org_id and ci.id = ca.content_id and ci.type = ${type}
+    where ca.org_id = ${orgId}
+      and ca.org_user_id = ${orgUserId}
+      and ca.content_id = ${contentId}
+  )`;
+}
+function communityPublished(orgId, communityId) {
+	return sql`exists (
+    select 1 from communities pc
+    where pc.org_id = ${orgId} and pc.id = ${communityId} and pc.status = 'published'
+  )`;
+}
+function holdsCommunity(orgId, orgUserId, communityId) {
+	return sql`(${communityPublished(orgId, communityId)} and ${activeGrantCovers(orgId, orgUserId, communityId, "community")})`;
+}
+function communityMember(orgId, orgUserId, role, communityId) {
+	return sql`(${role} in (${sql.join(STAFF_ROLES.map((r) => sql`${r}`), sql`, `)}) or ${holdsCommunity(orgId, orgUserId, communityId)})`;
+}
+//#endregion
+export { activeGrantCovers, communityMember, communityPublished, grantExpired, grantIsActive, grantOpens, grantUnexpired, holdsCommunity };
+
+//# sourceMappingURL=grant-covers.js.map

package/dist/repositories/grant-covers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-covers.js","names":[],"sources":["../../src/repositories/grant-covers.ts"],"sourcesContent":["import { sql, type SQL, type SQLWrapper } from \"drizzle-orm\";\nimport { STAFF_ROLES } from \"@headless-lms/core/organizations\";\nimport { entitlements } from \"../schema/entitlements.js\";\n\nexport type GrantedContentType = \"course\" | \"download\" | \"community\";\n\nexport interface GrantColumns {\n  orgId: SQLWrapper;\n  contentId: SQLWrapper;\n  bundleId: SQLWrapper;\n}\n\nexport function grantUnexpired(\n  expiresAt: SQLWrapper = entitlements.expiresAt,\n  at: SQL = sql`now()`,\n): SQL {\n  return sql`(${expiresAt} is null or ${expiresAt} > ${at})`;\n}\n\nexport function grantExpired(\n  expiresAt: SQLWrapper = entitlements.expiresAt,\n  at: SQL = sql`now()`,\n): SQL {\n  return sql`(${expiresAt} is not null and ${expiresAt} <= ${at})`;\n}\n\nexport function grantIsActive(row: typeof entitlements = entitlements, at?: SQL): SQL {\n  return sql`(${row.status} = 'active' and ${grantUnexpired(row.expiresAt, at)})`;\n}\n\nexport function grantOpens(row: GrantColumns, contentId: SQL, type: GrantedContentType): SQL {\n  return sql`(\n    exists (\n      select 1 from content_items ci\n      where ci.org_id = ${row.orgId} and ci.id = ${contentId} and ci.type = ${type}\n    )\n    and (\n      ${row.contentId} = ${contentId}\n      or exists (\n        select 1 from bundle_items bi\n        where bi.org_id = ${row.orgId}\n          and bi.bundle_id = ${row.bundleId}\n          and bi.content_id = ${contentId}\n      )\n    )\n  )`;\n}\n\nexport function activeGrantCovers(\n  orgId: SQL,\n  orgUserId: SQL,\n  contentId: SQL,\n  type: GrantedContentType,\n): SQL {\n  return sql`exists (\n    select 1 from content_access ca\n    join content_items ci on ci.org_id = ca.org_id and ci.id = ca.content_id and ci.type = ${type}\n    where ca.org_id = ${orgId}\n      and ca.org_user_id = ${orgUserId}\n      and ca.content_id = ${contentId}\n  )`;\n}\n\nexport function communityPublished(orgId: SQL, communityId: SQL): SQL {\n  return sql`exists (\n    select 1 from communities pc\n    where pc.org_id = ${orgId} and pc.id = ${communityId} and pc.status = 'published'\n  )`;\n}\n\nexport function holdsCommunity(orgId: SQL, orgUserId: SQL, communityId: SQL): SQL {\n  return sql`(${communityPublished(orgId, communityId)} and ${activeGrantCovers(orgId, orgUserId, communityId, \"community\")})`;\n}\n\nexport function communityMember(orgId: SQL, orgUserId: SQL, role: SQL, communityId: SQL): SQL {\n  const staff = sql.join(\n    STAFF_ROLES.map((r) => sql`${r}`),\n    sql`, `,\n  );\n  return sql`(${role} in (${staff}) or ${holdsCommunity(orgId, orgUserId, communityId)})`;\n}\n"],"mappings":";;;;AAYA,SAAgB,eACd,YAAwB,aAAa,WACrC,KAAU,GAAG,SACR;CACL,OAAO,GAAG,IAAI,UAAU,cAAc,UAAU,KAAK,GAAG;AAC1D;AAEA,SAAgB,aACd,YAAwB,aAAa,WACrC,KAAU,GAAG,SACR;CACL,OAAO,GAAG,IAAI,UAAU,mBAAmB,UAAU,MAAM,GAAG;AAChE;AAEA,SAAgB,cAAc,MAA2B,cAAc,IAAe;CACpF,OAAO,GAAG,IAAI,IAAI,OAAO,kBAAkB,eAAe,IAAI,WAAW,EAAE,EAAE;AAC/E;AAEA,SAAgB,WAAW,KAAmB,WAAgB,MAA+B;CAC3F,OAAO,GAAG;;;0BAGc,IAAI,MAAM,eAAe,UAAU,iBAAiB,KAAK;;;QAG3E,IAAI,UAAU,KAAK,UAAU;;;4BAGT,IAAI,MAAM;+BACP,IAAI,SAAS;gCACZ,UAAU;;;;AAI1C;AAEA,SAAgB,kBACd,OACA,WACA,WACA,MACK;CACL,OAAO,GAAG;;6FAEiF,KAAK;wBAC1E,MAAM;6BACD,UAAU;4BACX,UAAU;;AAEtC;AAEA,SAAgB,mBAAmB,OAAY,aAAuB;CACpE,OAAO,GAAG;;wBAEY,MAAM,eAAe,YAAY;;AAEzD;AAEA,SAAgB,eAAe,OAAY,WAAgB,aAAuB;CAChF,OAAO,GAAG,IAAI,mBAAmB,OAAO,WAAW,EAAE,OAAO,kBAAkB,OAAO,WAAW,aAAa,WAAW,EAAE;AAC5H;AAEA,SAAgB,gBAAgB,OAAY,WAAgB,MAAW,aAAuB;CAK5F,OAAO,GAAG,IAAI,KAAK,OAJL,IAAI,KAChB,YAAY,KAAK,MAAM,GAAG,GAAG,GAAG,GAChC,GAAG,IAEyB,EAAE,OAAO,eAAe,OAAO,WAAW,WAAW,EAAE;AACvF"}

package/dist/repositories/identity.d.ts

@@ -1,6 +1,6 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { CreateUserInput, Logger, UpdateUserInput, User } from "@headless-lms/core/types";
-import { IdentityRepository } from "@headless-lms/core/identity";
+import { CreateUserInput, Logger, UpdateUserInput, User, UserProfile } from "@headless-lms/core/types";
+import { IdentityRepository, ProfilePatch } from "@headless-lms/core/identity";
 //#region src/repositories/identity.d.ts
 declare class DrizzleIdentityRepository implements IdentityRepository {
   private readonly db;
@@ -11,6 +11,8 @@ declare class DrizzleIdentityRepository implements IdentityRepository {
   findUserById(id: string): Promise<User | null>;
   findUserByExternalId(externalId: string): Promise<User | null>;
   findUserByEmail(email: string): Promise<User | null>;
+  findProfile(userId: string): Promise<UserProfile | null>;
+  upsertProfile(userId: string, patch: ProfilePatch): Promise<UserProfile>;
 }
 //#endregion
 export { DrizzleIdentityRepository };

package/dist/repositories/identity.js

@@ -1,4 +1,4 @@
-import { users } from "../schema/identity.js";
+import { userProfiles, users } from "../schema/identity.js";
 import { translateDbErrors } from "./pg-errors.js";
 import { eq, sql } from "drizzle-orm";
 import { noopLogger } from "@headless-lms/core/shared/logger";
@@ -38,6 +38,37 @@ var DrizzleIdentityRepository = class {
 		const [row] = await this.db.select().from(users).where(sql`lower(${users.email}) = lower(${email})`).limit(1);
 		return row ?? null;
 	}
+	async findProfile(userId) {
+		const [row] = await this.db.select().from(userProfiles).where(eq(userProfiles.userId, userId)).limit(1);
+		return row ?? null;
+	}
+	async upsertProfile(userId, patch) {
+		if (!await this.findProfile(userId)) {
+			const [row] = await this.db.insert(userProfiles).values({
+				userId,
+				displayName: patch.displayName ?? null,
+				headline: patch.headline ?? null,
+				bio: patch.bio ?? null,
+				imageAssetOrgId: patch.imageAssetOrgId ?? null,
+				imageAssetId: patch.imageAssetId ?? null,
+				extra: patch.extra ?? {}
+			}).returning();
+			if (!row) throw new Error("failed to insert profile");
+			return row;
+		}
+		const set = { updatedAt: /* @__PURE__ */ new Date() };
+		if (patch.displayName !== void 0) set.displayName = patch.displayName;
+		if (patch.headline !== void 0) set.headline = patch.headline;
+		if (patch.bio !== void 0) set.bio = patch.bio;
+		if (patch.imageAssetOrgId !== void 0) {
+			set.imageAssetOrgId = patch.imageAssetOrgId;
+			set.imageAssetId = patch.imageAssetId;
+		}
+		if (patch.extra !== void 0) set.extra = patch.extra;
+		const [row] = await this.db.update(userProfiles).set(set).where(eq(userProfiles.userId, userId)).returning();
+		if (!row) throw new Error("failed to update profile");
+		return row;
+	}
 };
 translateDbErrors(DrizzleIdentityRepository);
 //#endregion