@headless-lms/core 0.3.0 → 0.5.0

package/dist/organizations/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","names":[],"sources":["../../src/organizations/permissions.ts"],"sourcesContent":["import { PERMISSION_KEYS } from '../types/schemas/organizations.js';\nimport type { Level, Permission } from '../types/index.js';\n\nexport type PermissionGroup =\n  | 'organization'\n  | 'people'\n  | 'access'\n  | 'content'\n  | 'courses'\n  | 'downloads'\n  | 'communities'\n  | 'events'\n  | 'automations';\n\nexport interface PermissionDefinition {\n  group: PermissionGroup;\n  label: string;\n  description: string;\n  about: Level;\n  implies?: readonly Permission[];\n}\n\nexport const PERMISSIONS = {\n  'organizations:read': {\n    group: 'organization',\n    label: 'See the organization',\n    description: \"See the org's name, slug and general settings.\",\n    about: 'org',\n  },\n  'organizations:write': {\n    group: 'organization',\n    label: 'Edit the organization',\n    description: \"Change the org's name, slug and general settings.\",\n    about: 'org',\n    implies: ['organizations:read'],\n  },\n  'api_keys:read': {\n    group: 'organization',\n    label: 'See your API keys',\n    description: 'List your own API keys.',\n    about: 'org',\n  },\n  'api_keys:write': {\n    group: 'organization',\n    label: 'Create API keys',\n    description: 'Create your own API keys.',\n    about: 'org',\n    implies: ['api_keys:read'],\n  },\n  'api_keys:delete': {\n    group: 'organization',\n    label: 'Revoke API keys',\n    description: 'Revoke your own API keys.',\n    about: 'org',\n    implies: ['api_keys:read'],\n  },\n  'notification_categories:read': {\n    group: 'organization',\n    label: 'See notification categories',\n    description: \"See the notification types, channels and the org's categories and defaults.\",\n    about: 'org',\n  },\n  'notification_categories:write': {\n    group: 'organization',\n    label: 'Edit notification categories',\n    description: \"Edit and reset the org's notification categories.\",\n    about: 'org',\n    implies: ['notification_categories:read'],\n  },\n  'integrations:read': {\n    group: 'organization',\n    label: 'See integrations',\n    description: 'See connected integrations.',\n    about: 'org',\n  },\n  'integrations:write': {\n    group: 'organization',\n    label: 'Manage integrations',\n    description: 'Connect, configure and run actions on integrations.',\n    about: 'org',\n    implies: ['integrations:read'],\n  },\n  'integrations:delete': {\n    group: 'organization',\n    label: 'Disconnect integrations',\n    description: 'Disconnect integrations.',\n    about: 'org',\n    implies: ['integrations:read'],\n  },\n  'analytics:read': {\n    group: 'organization',\n    label: 'See the overview',\n    description: \"See the org's overview report.\",\n    about: 'org',\n  },\n  'people:read': {\n    group: 'people',\n    label: 'See people',\n    description:\n      \"List the org's people and pending invites, with each person's roles, and open any person's record.\",\n    about: 'org',\n    implies: ['progress:read'],\n  },\n  'people:write': {\n    group: 'people',\n    label: 'Manage people',\n    description:\n      \"Invite people, resend and cancel invites, set a person's org role and give and remove roles on content items.\",\n    about: 'org',\n    implies: ['people:read'],\n  },\n  'people:delete': {\n    group: 'people',\n    label: 'Remove people',\n    description: 'Remove a person from the org.',\n    about: 'org',\n    implies: ['people:read'],\n  },\n  'roles:read': {\n    group: 'people',\n    label: 'See roles',\n    description: \"See the org's roles and their permissions.\",\n    about: 'org',\n  },\n  'roles:write': {\n    group: 'people',\n    label: 'Manage roles',\n    description: 'Rename roles; change, reset and add roles through the API.',\n    about: 'org',\n    implies: ['roles:read'],\n  },\n  'roles:delete': {\n    group: 'people',\n    label: 'Delete roles',\n    description: 'Delete a role the org added.',\n    about: 'org',\n    implies: ['roles:read'],\n  },\n  'access:read': {\n    group: 'access',\n    label: 'See access',\n    description: \"See grants, including a community's roster of grant holders.\",\n    about: 'org',\n  },\n  'access:write': {\n    group: 'access',\n    label: 'Manage access',\n    description: 'Grant, change and revoke access.',\n    about: 'org',\n    implies: ['access:read'],\n  },\n  'bundles:read': {\n    group: 'content',\n    label: 'See bundles',\n    description: 'See bundles and their names.',\n    about: 'org',\n  },\n  'bundles:write': {\n    group: 'content',\n    label: 'Edit bundles',\n    description: 'Create and edit bundles.',\n    about: 'org',\n    implies: ['bundles:read'],\n  },\n  'bundles:delete': {\n    group: 'content',\n    label: 'Delete bundles',\n    description: 'Delete bundles.',\n    about: 'org',\n    implies: ['bundles:read'],\n  },\n  'media:read': {\n    group: 'content',\n    label: 'See the media library',\n    description: 'See the whole media library and attach any of its files.',\n    about: 'org',\n  },\n  'media:write': {\n    group: 'content',\n    label: 'Upload media',\n    description: 'Upload to the media library and edit its files.',\n    about: 'org',\n    implies: ['media:read'],\n  },\n  'media:delete': {\n    group: 'content',\n    label: 'Delete media',\n    description: 'Delete files from the media library.',\n    about: 'org',\n    implies: ['media:read'],\n  },\n  'courses:read': {\n    group: 'courses',\n    label: 'See courses',\n    description:\n      'See the course, its modules and activities in the admin app; open it, its lessons, files and titles without a grant, unpublished included; be reachable for its lesson-comment mentions.',\n    about: 'course',\n  },\n  'courses:write': {\n    group: 'courses',\n    label: 'Edit courses',\n    description:\n      'Edit and publish the course; add, change and delete its modules and activities; upload media for it and attach media uploaded for it. Creating a course needs it on the org.',\n    about: 'course',\n    implies: ['courses:read'],\n  },\n  'courses:delete': {\n    group: 'courses',\n    label: 'Delete courses',\n    description: 'Delete the course.',\n    about: 'course',\n    implies: ['courses:read'],\n  },\n  'courses:moderate': {\n    group: 'courses',\n    label: 'Moderate lesson comments',\n    description:\n      \"See the course's lesson comments, held ones included; approve, remove, restore, reply to and resolve reports on them; be notified of reports. The holder's own lesson comments publish without review.\",\n    about: 'course',\n    implies: ['courses:read'],\n  },\n  'progress:read': {\n    group: 'courses',\n    label: 'See learners and progress',\n    description: \"See the course's learners, their progress and the course's analytics.\",\n    about: 'course',\n  },\n  'downloads:read': {\n    group: 'downloads',\n    label: 'See downloads',\n    description:\n      'See the download in the admin app, and open it and its files without a grant, unpublished included.',\n    about: 'download',\n  },\n  'downloads:write': {\n    group: 'downloads',\n    label: 'Edit downloads',\n    description:\n      'Edit and publish the download; upload files for it and attach files uploaded for it. Creating a download needs it on the org.',\n    about: 'download',\n    implies: ['downloads:read'],\n  },\n  'downloads:delete': {\n    group: 'downloads',\n    label: 'Delete downloads',\n    description: 'Delete the download.',\n    about: 'download',\n    implies: ['downloads:read'],\n  },\n  'communities:read': {\n    group: 'communities',\n    label: 'See communities',\n    description:\n      'See the community, its spaces, notification categories and analytics in the admin app; be a member of it without a grant, unpublished included, open every space in it and see its thumbnail while unpublished.',\n    about: 'community',\n  },\n  'communities:write': {\n    group: 'communities',\n    label: 'Configure communities',\n    description:\n      'Configure the community, its spaces, topics, links, settings and notification categories; publish it; delete its spaces; upload media for it and attach media uploaded for it. Creating a community needs it on the org.',\n    about: 'community',\n    implies: ['communities:read'],\n  },\n  'communities:delete': {\n    group: 'communities',\n    label: 'Delete communities',\n    description: 'Delete the community.',\n    about: 'community',\n    implies: ['communities:read'],\n  },\n  'communities:moderate': {\n    group: 'communities',\n    label: 'Moderate communities',\n    description:\n      \"See the review queue, pending and removed posts, held comments and their titles; open every space; approve, remove, restore, pin and lock posts and comments; turn comments and reactions on and off; delete any message, see deleted messages, read reported attachments, lock chats, see the message queue; see every space member and locked spaces' rosters; invite, add, approve, decline and remove space members; resolve reports; be notified of reviews, reports and join requests. The holder's own posts publish without review.\",\n    about: 'community',\n  },\n  'events:read': {\n    group: 'events',\n    label: 'See events',\n    description:\n      'See the event in the admin app, drafts and canceled included; open it without a grant; see its attendees and analytics.',\n    about: 'event',\n  },\n  'events:write': {\n    group: 'events',\n    label: 'Edit events',\n    description:\n      'Edit, publish and cancel the event; set its recording; grant and revoke it for others; upload files for it and attach, rename, reorder and remove them. Creating an event needs it on the org.',\n    about: 'event',\n    implies: ['events:read'],\n  },\n  'events:delete': {\n    group: 'events',\n    label: 'Delete events',\n    description: 'Delete the event.',\n    about: 'event',\n    implies: ['events:read'],\n  },\n  'automations:read': {\n    group: 'automations',\n    label: 'See automations',\n    description: 'See workflows, webhooks and their runs.',\n    about: 'org',\n  },\n  'automations:write': {\n    group: 'automations',\n    label: 'Edit automations',\n    description: \"Create and edit workflows and webhooks, and reveal a webhook's signing secret.\",\n    about: 'org',\n    implies: ['automations:read'],\n  },\n  'automations:delete': {\n    group: 'automations',\n    label: 'Delete automations',\n    description: 'Delete workflows and webhooks.',\n    about: 'org',\n    implies: ['automations:read'],\n  },\n} as const satisfies Record<Permission, PermissionDefinition>;\n\nexport const ALL_PERMISSIONS: readonly Permission[] = PERMISSION_KEYS;\n\nexport function isPermission(value: string): value is Permission {\n  return (PERMISSION_KEYS as readonly string[]).includes(value);\n}\n\nexport function permissionAbout(permission: Permission): Level {\n  return PERMISSIONS[permission].about;\n}\n\nexport function fitsLevels(permission: Permission, levels: readonly Level[]): boolean {\n  const about = permissionAbout(permission);\n  if (levels.includes('org')) {\n    return true;\n  }\n  return about !== 'org' && levels.includes(about);\n}\n\nexport function withImplied(permissions: Iterable<Permission>): Set<Permission> {\n  const out = new Set<Permission>();\n  const queue = [...permissions];\n  while (queue.length > 0) {\n    const next = queue.pop()!;\n    if (out.has(next)) {\n      continue;\n    }\n    out.add(next);\n    const def: PermissionDefinition = PERMISSIONS[next];\n    for (const implied of def.implies ?? []) {\n      queue.push(implied);\n    }\n  }\n  return out;\n}\n\nexport interface PermissionListEntry extends Omit<PermissionDefinition, 'implies'> {\n  key: Permission;\n  implies?: Permission[];\n}\n\nexport function permissionList(): PermissionListEntry[] {\n  return PERMISSION_KEYS.map((key) => {\n    const { implies, ...definition }: PermissionDefinition = PERMISSIONS[key];\n    return { key, ...definition, ...(implies && { implies: [...implies] }) };\n  });\n}\n"],"mappings":";;AAsBA,MAAa,cAAc;CACzB,sBAAsB;EACpB,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;CACT;CACA,uBAAuB;EACrB,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,oBAAoB;CAChC;CACA,iBAAiB;EACf,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;CACT;CACA,kBAAkB;EAChB,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,eAAe;CAC3B;CACA,mBAAmB;EACjB,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,eAAe;CAC3B;CACA,gCAAgC;EAC9B,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;CACT;CACA,iCAAiC;EAC/B,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,8BAA8B;CAC1C;CACA,qBAAqB;EACnB,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;CACT;CACA,sBAAsB;EACpB,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,mBAAmB;CAC/B;CACA,uBAAuB;EACrB,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,mBAAmB;CAC/B;CACA,kBAAkB;EAChB,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;CACT;CACA,eAAe;EACb,OAAO;EACP,OAAO;EACP,aACE;EACF,OAAO;EACP,SAAS,CAAC,eAAe;CAC3B;CACA,gBAAgB;EACd,OAAO;EACP,OAAO;EACP,aACE;EACF,OAAO;EACP,SAAS,CAAC,aAAa;CACzB;CACA,iBAAiB;EACf,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,aAAa;CACzB;CACA,cAAc;EACZ,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;CACT;CACA,eAAe;EACb,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,YAAY;CACxB;CACA,gBAAgB;EACd,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,YAAY;CACxB;CACA,eAAe;EACb,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;CACT;CACA,gBAAgB;EACd,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,aAAa;CACzB;CACA,gBAAgB;EACd,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;CACT;CACA,iBAAiB;EACf,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,cAAc;CAC1B;CACA,kBAAkB;EAChB,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,cAAc;CAC1B;CACA,cAAc;EACZ,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;CACT;CACA,eAAe;EACb,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,YAAY;CACxB;CACA,gBAAgB;EACd,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,YAAY;CACxB;CACA,gBAAgB;EACd,OAAO;EACP,OAAO;EACP,aACE;EACF,OAAO;CACT;CACA,iBAAiB;EACf,OAAO;EACP,OAAO;EACP,aACE;EACF,OAAO;EACP,SAAS,CAAC,cAAc;CAC1B;CACA,kBAAkB;EAChB,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,cAAc;CAC1B;CACA,oBAAoB;EAClB,OAAO;EACP,OAAO;EACP,aACE;EACF,OAAO;EACP,SAAS,CAAC,cAAc;CAC1B;CACA,iBAAiB;EACf,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;CACT;CACA,kBAAkB;EAChB,OAAO;EACP,OAAO;EACP,aACE;EACF,OAAO;CACT;CACA,mBAAmB;EACjB,OAAO;EACP,OAAO;EACP,aACE;EACF,OAAO;EACP,SAAS,CAAC,gBAAgB;CAC5B;CACA,oBAAoB;EAClB,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,gBAAgB;CAC5B;CACA,oBAAoB;EAClB,OAAO;EACP,OAAO;EACP,aACE;EACF,OAAO;CACT;CACA,qBAAqB;EACnB,OAAO;EACP,OAAO;EACP,aACE;EACF,OAAO;EACP,SAAS,CAAC,kBAAkB;CAC9B;CACA,sBAAsB;EACpB,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,kBAAkB;CAC9B;CACA,wBAAwB;EACtB,OAAO;EACP,OAAO;EACP,aACE;EACF,OAAO;CACT;CACA,eAAe;EACb,OAAO;EACP,OAAO;EACP,aACE;EACF,OAAO;CACT;CACA,gBAAgB;EACd,OAAO;EACP,OAAO;EACP,aACE;EACF,OAAO;EACP,SAAS,CAAC,aAAa;CACzB;CACA,iBAAiB;EACf,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,aAAa;CACzB;CACA,oBAAoB;EAClB,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;CACT;CACA,qBAAqB;EACnB,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,kBAAkB;CAC9B;CACA,sBAAsB;EACpB,OAAO;EACP,OAAO;EACP,aAAa;EACb,OAAO;EACP,SAAS,CAAC,kBAAkB;CAC9B;AACF;AAEA,MAAa,kBAAyC;AAEtD,SAAgB,aAAa,OAAoC;CAC/D,OAAQ,gBAAsC,SAAS,KAAK;AAC9D;AAEA,SAAgB,gBAAgB,YAA+B;CAC7D,OAAO,YAAY,WAAW,CAAC;AACjC;AAEA,SAAgB,WAAW,YAAwB,QAAmC;CACpF,MAAM,QAAQ,gBAAgB,UAAU;CACxC,IAAI,OAAO,SAAS,KAAK,GACvB,OAAO;CAET,OAAO,UAAU,SAAS,OAAO,SAAS,KAAK;AACjD;AAEA,SAAgB,YAAY,aAAoD;CAC9E,MAAM,sBAAM,IAAI,IAAgB;CAChC,MAAM,QAAQ,CAAC,GAAG,WAAW;CAC7B,OAAO,MAAM,SAAS,GAAG;EACvB,MAAM,OAAO,MAAM,IAAI;EACvB,IAAI,IAAI,IAAI,IAAI,GACd;EAEF,IAAI,IAAI,IAAI;EACZ,MAAM,MAA4B,YAAY;EAC9C,KAAK,MAAM,WAAW,IAAI,WAAW,CAAC,GACpC,MAAM,KAAK,OAAO;CAEtB;CACA,OAAO;AACT;AAOA,SAAgB,iBAAwC;CACtD,OAAO,gBAAgB,KAAK,QAAQ;EAClC,MAAM,EAAE,SAAS,GAAG,eAAqC,YAAY;EACrE,OAAO;GAAE;GAAK,GAAG;GAAY,GAAI,WAAW,EAAE,SAAS,CAAC,GAAG,OAAO,EAAE;EAAG;CACzE,CAAC;AACH"}

package/dist/organizations/ports.d.ts

@@ -1,44 +1,153 @@
-import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, InviteRole, NewOrganizationInput, OrgUser, Organization, Role, UpdateOrgUserInput } from "../types/schemas/organizations.js";
+import { ContentType } from "../types/schemas/content.js";
+import { ApiKeySummary, ConnectedApp, CreatedApiKey } from "../types/identity.js";
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, NewOrganizationInput, OrgUser, OrgUserProfile, Organization, Permission, RoleAssignment, UpdateOrgUserInput } from "../types/schemas/organizations.js";
+import "../types/index.js";
+import { Actor, EffectivePermissions } from "../shared/actor.js";
 import { OutboxAppender, UnitOfWork } from "../shared/ports.js";
-import { Actor } from "../shared/actor.js";
-import "./model.js";
-import "./roles.js";
-import { Member, MemberRoleChange, MembersQuery, Page } from "./members.js";
-import { CreateOrganizationInput, ResendStudentInviteInput, UpdateOrganizationInput } from "./types.js";
 import { AuthHeaders } from "../identity/ports.js";
 import "../identity/index.js";
+import { StoredOrgRole } from "./org-roles.js";
+import { AssignmentRow } from "./effective-permissions.js";
+import "./model.js";
+import { AssignmentView, CreateRoleInput, InviteDetails, Member, MembersQuery, Page, RoleView, UpdateRoleInput, ViewerPermissions } from "./members.js";
+import { PermissionListEntry } from "./permissions.js";
+import { CreateOrganizationInput, UpdateOrganizationInput } from "./types.js";
 //#region src/organizations/ports.d.ts
+interface TransferOwnershipInput {
+  newOwnerOrgUserId: string;
+  previousOwnerRoleKey?: string | undefined;
+}
+interface CreateApiKeyInput {
+  name: string;
+  role: string;
+  expiresInDays?: number | undefined;
+}
+interface ApiKeyRole {
+  key: string;
+  name: string;
+  description: string;
+}
+type CallerLimit = {
+  scopes: readonly Permission[];
+} | {
+  roleKey: string;
+};
+interface PlatformOrganizationInput {
+  name: string;
+  slug: string;
+  keyName?: string | undefined;
+}
+interface PlatformOrganization {
+  organization: AuthOrganization;
+  apiKey: CreatedApiKey;
+}
+interface PlatformAccount {
+  email: string;
+  name: string;
+}
 interface OrganizationService {
-  createOrganization(input: CreateOrganizationInput): Promise<Organization>;
-  updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization>;
+  createOrganization(input: NewOrganizationInput, headers: AuthHeaders): Promise<AuthOrganization>;
+  provisionOrganization(input: CreateOrganizationInput): Promise<Organization>;
+  updateOrganization(input: UpdateOrganizationInput, actor: Actor): Promise<Organization>;
   deleteOrganization(id: string): Promise<Organization>;
   addOrgUser(input: AddOrgUserInput): Promise<OrgUser>;
-  removeOrgUser(orgId: string, userId: string): Promise<OrgUser>;
-  updateOrgUser(orgId: string, userId: string, patch: UpdateOrgUserInput): Promise<OrgUser>;
+  removeOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
   getByExternalId(externalId: string): Promise<Organization | null>;
+  getBySlug(slug: string): Promise<Organization | null>;
+  getById(id: string): Promise<Organization | null>;
+  portalIdentity(id: string): Promise<Pick<Organization, 'id' | 'name' | 'slug'>>;
   getOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
   getOrgUserById(orgId: string, id: string): Promise<OrgUser | null>;
+  getOrgUsersByIds(orgId: string, ids: string[]): Promise<OrgUser[]>;
   getOrgUsersForUser(userId: string): Promise<OrgUser[]>;
-  getById(id: string): Promise<Organization | null>;
-  createInvite(actor: Actor, input: CreateInviteInput): Promise<Invite>;
+  orgIds(): Promise<string[]>;
+  actorFor(orgId: string, orgUserId: string, limit?: CallerLimit): Promise<Actor | null>;
+  resolveCaller(authOrgId: string, authUserId: string, limit?: CallerLimit): Promise<ResolvedCaller | null>;
+  systemActor(orgId: string): Actor;
+  permissionsOfMany(orgId: string, orgUserIds: string[]): Promise<Map<string, EffectivePermissions>>;
+  holders(orgId: string, permission: Permission, on?: string): Promise<string[]>;
+  permissionList(): PermissionListEntry[];
+  viewerPermissions(actor: Actor): ViewerPermissions;
+  auditRoleKeys(): Promise<number>;
+  listRoles(actor: Actor): Promise<RoleView[]>;
+  getRole(key: string, actor: Actor): Promise<RoleView>;
+  updateRole(key: string, input: UpdateRoleInput, actor: Actor): Promise<RoleView>;
+  createRole(input: CreateRoleInput, actor: Actor): Promise<RoleView>;
+  resetRole(key: string, actor: Actor): Promise<RoleView>;
+  deleteRole(key: string, actor: Actor): Promise<void>;
+  listTeam(query: MembersQuery, actor: Actor): Promise<Page<Member>>;
+  listAssignments(orgUserId: string, actor: Actor): Promise<AssignmentView[]>;
+  listAssignmentsOn(contentId: string, actor: Actor): Promise<AssignmentView[]>;
+  setOrgRole(orgUserId: string, roleKey: string, actor: Actor): Promise<AssignmentView[]>;
+  assignRole(orgUserId: string, contentId: string, roleKey: string, actor: Actor): Promise<AssignmentView[]>;
+  unassignRole(orgUserId: string, contentId: string, actor: Actor): Promise<AssignmentView[]>;
+  removePerson(orgUserId: string, actor: Actor): Promise<void>;
+  transferOwnership(input: TransferOwnershipInput, actor: Actor): Promise<void>;
+  createInvite(input: CreateInviteInput, actor: Actor, inviterUserId: string): Promise<Invite>;
+  resendInvite(orgUserId: string, actor: Actor, inviterUserId: string): Promise<void>;
+  cancelInvite(orgUserId: string, actor: Actor): Promise<void>;
   peekInvite(token: string): Promise<Invite | null>;
-  acceptInvite(input: AcceptInviteInput): Promise<OrgUser>;
-  deleteOrgUser(orgId: string, actor: Actor, id: string): Promise<OrgUser>;
-  resendStudentInvite(actor: Actor, input: ResendStudentInviteInput): Promise<void>;
-  getBySlug(slug: string): Promise<Organization | null>;
-  listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>>;
-  updateMemberRole(ctx: MemberWriteContext, actor: Actor, id: string, role: Role): Promise<MemberRoleChange | null>;
-  removeMember(ctx: MemberWriteContext, actor: Actor, id: string): Promise<boolean>;
-  staffOrgUserIds(orgId: string): Promise<string[]>;
+  describeInvite(token: string): Promise<InviteDetails>;
+  acceptInvite(input: AcceptInviteInput, headers: AuthHeaders): Promise<OrgUser>;
+  listApiKeys(actor: Actor): Promise<ApiKeySummary[]>;
+  listApiKeyRoles(actor: Actor): Promise<ApiKeyRole[]>;
+  createApiKey(input: CreateApiKeyInput, actor: Actor): Promise<CreatedApiKey>;
+  deleteApiKey(keyId: string, actor: Actor): Promise<void>;
+  listConnectedApps(actor: Actor): Promise<ConnectedApp[]>;
+  revokeConnectedApp(clientId: string, actor: Actor): Promise<void>;
+  createPlatformOrganization(input: PlatformOrganizationInput): Promise<PlatformOrganization>;
+  createPlatformApiKey(orgId: string, name: string): Promise<CreatedApiKey>;
+  isPlatformAccount(email: string): boolean;
+}
+interface ActorFacts {
+  orgUserId: string;
+  status: OrgUser['status'];
+  assignments: AssignmentRow[];
+  storedRoles: StoredOrgRole[];
+}
+interface CallerFacts {
+  orgId: string;
+  userId: string | null;
+  orgUser: ActorFacts | null;
+}
+interface ResolvedCaller {
+  orgId: string;
+  userId: string | null;
+  orgUserId: string | null;
+  actor: Actor | null;
+}
+interface RolesRepository {
+  actorFacts(orgId: string, orgUserId: string): Promise<ActorFacts | null>;
+  callerFacts(authOrgId: string, authUserId: string): Promise<CallerFacts | null>;
+  storedRoles(orgId: string): Promise<StoredOrgRole[]>;
+  saveStoredRole(orgId: string, role: StoredOrgRole): Promise<void>;
+  deleteStoredRole(orgId: string, key: string): Promise<boolean>;
+  assignmentsOf(orgId: string, orgUserId: string): Promise<RoleAssignment[]>;
+  assignmentsOfMany(orgId: string, orgUserIds: string[]): Promise<Map<string, AssignmentRow[]>>;
+  assignmentsOn(orgId: string, contentId: string): Promise<RoleAssignment[]>;
+  holdersOf(orgId: string, roleKeys: string[], contentId?: string): Promise<string[]>;
+  setOrgRole(orgId: string, orgUserId: string, roleKey: string | null, assignedBy: string): Promise<void>;
+  setItemRole(orgId: string, orgUserId: string, contentId: string, contentType: ContentType, roleKey: string, assignedBy: string): Promise<void>;
+  removeItemRole(orgId: string, orgUserId: string, contentId: string): Promise<RoleAssignment | null>;
+  countHolders(orgId: string, roleKey: string, contentType?: ContentType | 'org'): Promise<number>;
+  holderCounts(orgId: string): Promise<Record<string, number>>;
+  contentTypeOf(orgId: string, contentId: string): Promise<ContentType | null>;
+  ownerOrgUserId(orgId: string): Promise<string | null>;
+  roleKeyUsage(): Promise<{
+    orgId: string;
+    roleKey: string;
+    level: string;
+    count: number;
+    stored: boolean;
+  }[]>;
+  lock(keys: string[]): Promise<void>;
 }
-/** Atomic write scope: tx-bound repo + outbox appender, one transaction. */
 interface OrganizationsWriteScope {
   organizations: OrganizationsRepository;
+  roles: RolesRepository;
   outbox: OutboxAppender;
 }
 type OrganizationsUnitOfWork = UnitOfWork<OrganizationsWriteScope>;
-/** Repo-facing write shape for a new org row. The service mints the id and
- *  resolves the defaults, so nothing is optional by the time it lands here. */
 interface NewOrganizationRow {
   id: string;
   externalId?: string | null;
@@ -46,10 +155,9 @@ interface NewOrganizationRow {
   slug: string;
   ownerId: string;
 }
-/** Repo-facing write shape for a freshly minted invite. */
 interface NewInviteRow {
   email: string;
-  role: InviteRole;
+  roleKey: string;
   invitedBy: string;
   tokenHash: string;
   expiresAt: Date;
@@ -57,70 +165,84 @@ interface NewInviteRow {
 interface OrganizationsRepository {
   create(input: NewOrganizationRow): Promise<Organization>;
   update(id: string, input: UpdateOrganizationInput): Promise<Organization | null>;
-  /** Drops the org row and its dependents; null when none matched. */
   delete(id: string): Promise<Organization>;
   findById(id: string): Promise<Organization | null>;
+  listIds(): Promise<string[]>;
   findByExternalId(externalId: string): Promise<Organization | null>;
   findBySlug(slug: string): Promise<Organization | null>;
-  /** Inserts a pending invite, or re-issues the org's existing pending one
-   *  for this email (fresh token/expiry/role) — atomic upsert. */
   upsertPendingInvite(orgId: string, input: NewInviteRow): Promise<Invite>;
   setInviteStatus(orgId: string, id: string, status: string): Promise<Invite | null>;
+  setInviteRole(orgId: string, id: string, roleKey: string, invitedBy: string): Promise<Invite | null>;
   findInviteByTokenHash(tokenHash: string): Promise<Invite | null>;
   findPendingInvite(orgId: string, email: string): Promise<Invite | null>;
-  setInviteToken(orgId: string, id: string, tokenHash: string, expiresAt: Date): Promise<Invite | null>;
-  /** The person's row in one org. `(org_id, user_id)` is unique. */
+  setInviteToken(orgId: string, id: string, tokenHash: string, expiresAt: Date, invitedBy: string): Promise<Invite | null>;
   findOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
-  /** Every org this person belongs to, oldest first. */
   findOrgUsersByUser(userId: string): Promise<OrgUser[]>;
   findOrgUserById(orgId: string, id: string): Promise<OrgUser | null>;
   findOrgUsersByIds(orgId: string, ids: string[]): Promise<OrgUser[]>;
-  findOrgUserIdsByRole(orgId: string, roles: Role[]): Promise<string[]>;
-  /** Links a user to the org under a role. Throws ConflictError when they
-   *  already hold a row there. */
   createOrgUser(input: CreateOrgUserInput): Promise<OrgUser>;
   updateOrgUser(orgId: string, id: string, patch: UpdateOrgUserInput): Promise<OrgUser | null>;
-  /** Every org this person is a student in — the scope of `student.linked`. */
-  findStudentOrgUsers(userId: string): Promise<OrgUser[]>;
-  /** Kills the org's pending invite for an address, if any. */
   deleteOrgUser(orgId: string, id: string): Promise<OrgUser | null>;
 }
-/** A member row enriched with the ids needed to drive writes. */
-interface MemberRecord extends Member {
-  kind: 'member' | 'invite';
-  userExternalId: string | null;
-  inviteId: string | null;
-}
-interface MembersRepository {
-  list(orgId: string, query: MembersQuery): Promise<Page<Member>>;
-  findByEmail(orgId: string, email: string): Promise<MemberRecord | null>;
-  findById(orgId: string, id: string): Promise<MemberRecord | null>;
+interface GrantReader {
+  holdsAnyGrant(orgId: string, orgUserId: string): Promise<boolean>;
 }
-/** The person as this context reads them back after a correction. */
-interface PersonRecord {
-  id: string;
-  email: string;
-  firstName: string | null;
-  lastName: string | null;
+interface TeamRow extends OrgUserProfile {
+  status: OrgUser['status'];
+  joinedAt: Date;
+  invitedAt: Date | null;
+  orgRoleKey: string | null;
+  inviteRoleKey: string | null;
+  items: {
+    contentId: string;
+    contentType: ContentType;
+    roleKey: string;
+  }[];
 }
-/** Context for a write: domain org (reads/rules) + auth org & session (writes). */
-interface MemberWriteContext {
-  orgId: string;
-  authOrgId: string;
-  headers: Record<string, string | string[] | undefined>;
+interface MembersRepository {
+  teamRows(orgId: string, memberRoleKey: string): Promise<TeamRow[]>;
 }
-/** The provider's view of an org: what it stores itself, minus the fields only
- *  the domain row carries (`ownerId`, `externalId`, `updatedAt`). */
 type AuthOrganization = Pick<Organization, 'id' | 'name' | 'slug' | 'createdAt'>;
 interface OrgAdmin {
   createOrganization(headers: AuthHeaders, input: NewOrganizationInput): Promise<AuthOrganization>;
+  createOrganizationFor(ownerExternalId: string, input: NewOrganizationInput): Promise<AuthOrganization>;
   setActiveOrganization(headers: AuthHeaders, externalId: string): Promise<void>;
-  updateOrganization(headers: AuthHeaders, id: string, input: UpdateOrganizationInput): Promise<AuthOrganization>;
   deleteOrganization(headers: AuthHeaders, externalId: string): Promise<void>;
-  grantMembership(orgExternalId: string, userExternalId: string, role: string): Promise<void>;
-  updateRole(ctx: MemberWriteContext, userExternalId: string, role: Role): Promise<void>;
-  removeMember(ctx: MemberWriteContext, userExternalId: string): Promise<void>;
+  updateOrganization(externalId: string, input: UpdateOrganizationInput): Promise<void>;
+  grantMembership(orgExternalId: string, userExternalId: string): Promise<void>;
+  setMembershipOwner(orgExternalId: string, userExternalId: string, owner: boolean): Promise<void>;
+  removeMembership(orgExternalId: string, userExternalId: string): Promise<void>;
+}
+interface Accounts {
+  createAccount(input: PlatformAccount): Promise<{
+    externalId: string;
+  }>;
+}
+interface StoredApiKey {
+  id: string;
+  name: string | null;
+  start: string | null;
+  roleKey: string | null;
+  createdAt: Date;
+  lastUsedAt: Date | null;
+  expiresAt: Date | null;
+}
+interface NewApiKey {
+  name: string;
+  roleKey: string;
+  expiresInDays?: number | undefined;
+}
+interface ApiKeys {
+  list(orgId: string, userExternalId: string): Promise<StoredApiKey[]>;
+  create(orgId: string, userExternalId: string, input: NewApiKey): Promise<StoredApiKey & {
+    key: string;
+  }>;
+  countWithRole(orgId: string, roleKey: string): Promise<number>;
+  revoke(orgId: string, userExternalId: string, keyId: string): Promise<void>;
+  listApps(orgId: string, userExternalId: string): Promise<ConnectedApp[]>;
+  revokeApp(orgId: string, userExternalId: string, clientId: string): Promise<void>;
+  revokeAllFor(orgId: string, userExternalId: string): Promise<void>;
 }
 //#endregion
-export { type AuthHeaders, AuthOrganization, MemberRecord, MemberWriteContext, MembersRepository, NewInviteRow, NewOrganizationRow, OrgAdmin, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork, OrganizationsWriteScope, PersonRecord };
+export { Accounts, ActorFacts, ApiKeyRole, ApiKeys, type AuthHeaders, AuthOrganization, CallerFacts, CallerLimit, CreateApiKeyInput, GrantReader, MembersRepository, NewApiKey, NewInviteRow, NewOrganizationRow, OrgAdmin, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork, OrganizationsWriteScope, PlatformAccount, PlatformOrganization, PlatformOrganizationInput, ResolvedCaller, RolesRepository, StoredApiKey, TeamRow, TransferOwnershipInput };
 //# sourceMappingURL=ports.d.ts.map

package/dist/organizations/service.d.ts

@@ -1,15 +1,20 @@
 import { Logger } from "../types/ports.js";
-import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, Invite, OrgUser, Organization, Role, UpdateOrgUserInput } from "../types/schemas/organizations.js";
+import { ApiKeySummary, ConnectedApp, CreatedApiKey } from "../types/identity.js";
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, Invite, NewOrganizationInput, OrgUser, Organization, Permission } from "../types/schemas/organizations.js";
+import "../types/index.js";
+import { Actor, EffectivePermissions } from "../shared/actor.js";
 import "../shared/ports.js";
-import { Actor } from "../shared/actor.js";
-import "./model.js";
-import "./roles.js";
-import { Member, MemberRoleChange, MembersQuery, Page } from "./members.js";
-import { CreateOrganizationInput, ResendStudentInviteInput, UpdateOrganizationInput } from "./types.js";
-import { IdentityService } from "../identity/ports.js";
+import { AssetFiles } from "../assets/ports.js";
+import "../assets/index.js";
 import { Mailer } from "../shared/mailer.js";
+import { AuthHeaders, IdentityService, SessionAdmin } from "../identity/ports.js";
 import "../identity/index.js";
-import { MemberWriteContext, MembersRepository, OrgAdmin, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork } from "./ports.js";
+import { RoleDefinition } from "./default-roles.js";
+import "./model.js";
+import { AssignmentView, CreateRoleInput, InviteDetails, Member, MembersQuery, Page, RoleView, UpdateRoleInput, ViewerPermissions } from "./members.js";
+import { PermissionListEntry } from "./permissions.js";
+import { CreateOrganizationInput, UpdateOrganizationInput } from "./types.js";
+import { Accounts, ApiKeyRole, ApiKeys, AuthOrganization, CallerLimit, CreateApiKeyInput, GrantReader, MembersRepository, OrgAdmin, OrganizationService, OrganizationsRepository, OrganizationsUnitOfWork, PlatformAccount, PlatformOrganization, PlatformOrganizationInput, ResolvedCaller, RolesRepository, TransferOwnershipInput } from "./ports.js";
 //#region src/organizations/service.d.ts
 interface InviteUrls {
   studentPortalUrl: string;
@@ -17,55 +22,119 @@ interface InviteUrls {
 }
 type OrganizationServiceParams = {
   repo: OrganizationsRepository;
+  roles: RolesRepository;
   membersRepo: MembersRepository;
   people: IdentityService;
+  images: Pick<AssetFiles, 'syncPublicImage'>;
   uow: OrganizationsUnitOfWork;
   orgAdmin: () => OrgAdmin;
+  sessions: () => SessionAdmin;
+  apiKeys?: () => ApiKeys;
+  accounts?: () => Accounts;
+  platform?: PlatformAccount;
+  grants?: () => GrantReader;
+  defaultRoles?: readonly RoleDefinition[];
   logger?: Logger;
   mailer?: Pick<Mailer, 'send'>;
   inviteUrls?: InviteUrls;
 };
 declare class OrganizationServiceImpl implements OrganizationService {
   private readonly repo;
+  private readonly roles;
   private readonly membersRepo;
   private readonly people;
+  private readonly images;
   private readonly uow;
   private readonly orgAdmin;
+  private readonly sessions;
+  private readonly apiKeysPort?;
+  private readonly accountsPort?;
+  private readonly platform?;
+  private readonly grants?;
+  private readonly catalog;
   private readonly logger;
   private readonly mailer?;
   private readonly inviteUrls?;
-  private readonly memberWrites;
   constructor(params: OrganizationServiceParams);
-  createOrganization(input: CreateOrganizationInput): Promise<Organization>;
-  updateOrganization(id: string, input: UpdateOrganizationInput): Promise<Organization>;
+  createOrganization(input: NewOrganizationInput, headers: AuthHeaders): Promise<AuthOrganization>;
+  provisionOrganization(input: CreateOrganizationInput): Promise<Organization>;
+  updateOrganization(input: UpdateOrganizationInput, actor: Actor): Promise<Organization>;
   deleteOrganization(id: string): Promise<Organization>;
-  addOrgUser({ orgId, userId, role }: AddOrgUserInput): Promise<OrgUser>;
-  removeOrgUser(orgId: string, userId: string): Promise<OrgUser>;
-  updateOrgUser(orgId: string, userId: string, patch: UpdateOrgUserInput): Promise<OrgUser>;
-  createInvite(actor: Actor, input: CreateInviteInput): Promise<Invite>;
-  resendStudentInvite(actor: Actor, input: ResendStudentInviteInput): Promise<void>;
-  peekInvite(token: string): Promise<Invite | null>;
-  acceptInvite(input: AcceptInviteInput): Promise<OrgUser>;
-  private acceptStudentInvite;
-  private acceptStaffInvite;
-  getOrgUserById(orgId: string, id: string): Promise<OrgUser | null>;
+  addOrgUser({ orgId, userId }: AddOrgUserInput): Promise<OrgUser>;
+  removeOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
+  getByExternalId(externalId: string): Promise<Organization | null>;
+  getBySlug(slug: string): Promise<Organization | null>;
+  getById(id: string): Promise<Organization | null>;
+  portalIdentity(id: string): Promise<Pick<Organization, 'id' | 'name' | 'slug'>>;
   getOrgUser(orgId: string, userId: string): Promise<OrgUser | null>;
-  deleteOrgUser(orgId: string, actor: Actor, id: string): Promise<OrgUser>;
+  getOrgUserById(orgId: string, id: string): Promise<OrgUser | null>;
+  getOrgUsersByIds(orgId: string, ids: string[]): Promise<OrgUser[]>;
   getOrgUsersForUser(userId: string): Promise<OrgUser[]>;
-  getById(id: string): Promise<Organization | null>;
+  orgIds(): Promise<string[]>;
+  actorFor(orgId: string, orgUserId: string, limit?: CallerLimit): Promise<Actor | null>;
+  resolveCaller(authOrgId: string, authUserId: string, limit?: CallerLimit): Promise<ResolvedCaller | null>;
+  systemActor(orgId: string): Actor;
+  permissionsOfMany(orgId: string, orgUserIds: string[]): Promise<Map<string, EffectivePermissions>>;
+  holders(orgId: string, permission: Permission, on?: string): Promise<string[]>;
+  permissionList(): PermissionListEntry[];
+  viewerPermissions(actor: Actor): ViewerPermissions;
+  auditRoleKeys(): Promise<number>;
+  listRoles(actor: Actor): Promise<RoleView[]>;
+  getRole(key: string, actor: Actor): Promise<RoleView>;
+  updateRole(key: string, input: UpdateRoleInput, actor: Actor): Promise<RoleView>;
+  createRole(input: CreateRoleInput, actor: Actor): Promise<RoleView>;
+  resetRole(key: string, actor: Actor): Promise<RoleView>;
+  deleteRole(key: string, actor: Actor): Promise<void>;
+  listTeam(query: MembersQuery, actor: Actor): Promise<Page<Member>>;
+  listAssignments(orgUserId: string, actor: Actor): Promise<AssignmentView[]>;
+  listAssignmentsOn(contentId: string, actor: Actor): Promise<AssignmentView[]>;
+  setOrgRole(orgUserId: string, roleKey: string, actor: Actor): Promise<AssignmentView[]>;
+  assignRole(orgUserId: string, contentId: string, roleKey: string, actor: Actor): Promise<AssignmentView[]>;
+  unassignRole(orgUserId: string, contentId: string, actor: Actor): Promise<AssignmentView[]>;
+  removePerson(orgUserId: string, actor: Actor): Promise<void>;
+  transferOwnership(input: TransferOwnershipInput, actor: Actor): Promise<void>;
+  createInvite(input: CreateInviteInput, actor: Actor, inviterUserId: string): Promise<Invite>;
+  resendInvite(orgUserId: string, actor: Actor, inviterUserId: string): Promise<void>;
+  cancelInvite(orgUserId: string, actor: Actor): Promise<void>;
+  peekInvite(token: string): Promise<Invite | null>;
+  describeInvite(token: string): Promise<InviteDetails>;
+  acceptInvite(input: AcceptInviteInput, headers: AuthHeaders): Promise<OrgUser>;
+  private checkAcceptance;
+  listApiKeys(actor: Actor): Promise<ApiKeySummary[]>;
+  listApiKeyRoles(actor: Actor): Promise<ApiKeyRole[]>;
+  createApiKey(input: CreateApiKeyInput, actor: Actor): Promise<CreatedApiKey>;
+  deleteApiKey(keyId: string, actor: Actor): Promise<void>;
+  listConnectedApps(actor: Actor): Promise<ConnectedApp[]>;
+  revokeConnectedApp(clientId: string, actor: Actor): Promise<void>;
+  createPlatformOrganization(input: PlatformOrganizationInput): Promise<PlatformOrganization>;
+  createPlatformApiKey(orgId: string, name: string): Promise<CreatedApiKey>;
+  isPlatformAccount(email: string): boolean;
+  private platformKey;
+  private platformAccountId;
+  private platformAccount;
+  private accounts;
+  private keysWithRole;
+  private cleanUpAfterRemoval;
+  private apiKeys;
+  private externalIdsOf;
+  private pendingInviteOf;
+  private deleteOrgUserRow;
+  private deleteOrgUserIn;
   private sendInviteEmail;
-  getByExternalId(externalId: string): Promise<Organization | null>;
-  getBySlug(slug: string): Promise<Organization | null>;
-  staffOrgUserIds(orgId: string): Promise<string[]>;
-  listMembers(orgId: string, query: MembersQuery): Promise<Page<Member>>;
-  updateMemberRole(ctx: MemberWriteContext, actor: Actor, id: string, role: Role): Promise<MemberRoleChange | null>;
-  private demoteModerator;
-  private promoteStudent;
-  private asActor;
-  private memberWrite;
-  private assertManagesUsers;
-  private assertNotOwner;
-  removeMember(ctx: MemberWriteContext, actor: Actor, id: string): Promise<boolean>;
+  private toMember;
+  private assignmentViews;
+  private roleMap;
+  private resolveIn;
+  private findRole;
+  private relockedActor;
+  private itemPermissions;
+  private assertHolds;
+  private assertHoldsOn;
+  private assertNotSelf;
+  private assertUniqueName;
+  private parseLevels;
+  private assertFits;
+  private assertLevelsNotInUse;
 }
 //#endregion
 export { InviteUrls, OrganizationServiceImpl, OrganizationServiceParams };