@headless-lms/core 0.5.0 → 0.6.0

package/dist/entitlements/events.d.ts

@@ -8,7 +8,7 @@ declare const entitlementEvents: {
     orgUserId: string;
     bundleId: string | null;
     contentId: string | null;
-    status: "active" | "revoked";
+    status: "revoked" | "active";
     source: string;
     grantedAt: Date;
     expiresAt: Date | null;
@@ -20,7 +20,7 @@ declare const entitlementEvents: {
     orgUserId: string;
     bundleId: string | null;
     contentId: string | null;
-    status: "active" | "revoked";
+    status: "revoked" | "active";
     source: string;
     grantedAt: unknown;
     expiresAt: unknown;
@@ -29,14 +29,14 @@ declare const entitlementEvents: {
   }, import("zod").ZodObject<{
     orgId: import("zod").ZodString;
     id: import("zod").ZodString;
-    createdAt: import("zod").ZodCoercedDate<unknown>;
-    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    source: import("zod").ZodString;
     status: import("zod").ZodEnum<{
-      active: "active";
       revoked: "revoked";
+      active: "active";
     }>;
-    source: import("zod").ZodString;
     contentId: import("zod").ZodNullable<import("zod").ZodString>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
     bundleId: import("zod").ZodNullable<import("zod").ZodString>;
     orgUserId: import("zod").ZodString;
     grantedAt: import("zod").ZodCoercedDate<unknown>;
@@ -48,7 +48,7 @@ declare const entitlementEvents: {
     orgUserId: string;
     bundleId: string | null;
     contentId: string | null;
-    status: "active" | "revoked";
+    status: "revoked" | "active";
     source: string;
     grantedAt: Date;
     expiresAt: Date | null;
@@ -60,7 +60,7 @@ declare const entitlementEvents: {
     orgUserId: string;
     bundleId: string | null;
     contentId: string | null;
-    status: "active" | "revoked";
+    status: "revoked" | "active";
     source: string;
     grantedAt: unknown;
     expiresAt: unknown;
@@ -69,14 +69,14 @@ declare const entitlementEvents: {
   }, import("zod").ZodObject<{
     orgId: import("zod").ZodString;
     id: import("zod").ZodString;
-    createdAt: import("zod").ZodCoercedDate<unknown>;
-    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    source: import("zod").ZodString;
     status: import("zod").ZodEnum<{
-      active: "active";
       revoked: "revoked";
+      active: "active";
     }>;
-    source: import("zod").ZodString;
     contentId: import("zod").ZodNullable<import("zod").ZodString>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
     bundleId: import("zod").ZodNullable<import("zod").ZodString>;
     orgUserId: import("zod").ZodString;
     grantedAt: import("zod").ZodCoercedDate<unknown>;
@@ -88,7 +88,7 @@ declare const entitlementEvents: {
     orgUserId: string;
     bundleId: string | null;
     contentId: string | null;
-    status: "active" | "revoked";
+    status: "revoked" | "active";
     source: string;
     grantedAt: Date;
     expiresAt: Date | null;
@@ -100,7 +100,7 @@ declare const entitlementEvents: {
     orgUserId: string;
     bundleId: string | null;
     contentId: string | null;
-    status: "active" | "revoked";
+    status: "revoked" | "active";
     source: string;
     grantedAt: unknown;
     expiresAt: unknown;
@@ -109,14 +109,14 @@ declare const entitlementEvents: {
   }, import("zod").ZodObject<{
     orgId: import("zod").ZodString;
     id: import("zod").ZodString;
-    createdAt: import("zod").ZodCoercedDate<unknown>;
-    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    source: import("zod").ZodString;
     status: import("zod").ZodEnum<{
-      active: "active";
       revoked: "revoked";
+      active: "active";
     }>;
-    source: import("zod").ZodString;
     contentId: import("zod").ZodNullable<import("zod").ZodString>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
     bundleId: import("zod").ZodNullable<import("zod").ZodString>;
     orgUserId: import("zod").ZodString;
     grantedAt: import("zod").ZodCoercedDate<unknown>;
@@ -128,7 +128,7 @@ declare const entitlementEvents: {
     orgUserId: string;
     bundleId: string | null;
     contentId: string | null;
-    status: "active" | "revoked";
+    status: "revoked" | "active";
     source: string;
     grantedAt: Date;
     expiresAt: Date | null;
@@ -140,7 +140,7 @@ declare const entitlementEvents: {
     orgUserId: string;
     bundleId: string | null;
     contentId: string | null;
-    status: "active" | "revoked";
+    status: "revoked" | "active";
     source: string;
     grantedAt: unknown;
     expiresAt: unknown;
@@ -149,14 +149,14 @@ declare const entitlementEvents: {
   }, import("zod").ZodObject<{
     orgId: import("zod").ZodString;
     id: import("zod").ZodString;
-    createdAt: import("zod").ZodCoercedDate<unknown>;
-    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    source: import("zod").ZodString;
     status: import("zod").ZodEnum<{
-      active: "active";
       revoked: "revoked";
+      active: "active";
     }>;
-    source: import("zod").ZodString;
     contentId: import("zod").ZodNullable<import("zod").ZodString>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
     bundleId: import("zod").ZodNullable<import("zod").ZodString>;
     orgUserId: import("zod").ZodString;
     grantedAt: import("zod").ZodCoercedDate<unknown>;
@@ -168,7 +168,7 @@ declare const entitlementEvents: {
     orgUserId: string;
     bundleId: string | null;
     contentId: string | null;
-    status: "active" | "revoked";
+    status: "revoked" | "active";
     source: string;
     grantedAt: Date;
     expiresAt: Date | null;
@@ -181,7 +181,7 @@ declare const entitlementEvents: {
     orgUserId: string;
     bundleId: string | null;
     contentId: string | null;
-    status: "active" | "revoked";
+    status: "revoked" | "active";
     source: string;
     grantedAt: unknown;
     expiresAt: unknown;
@@ -191,14 +191,14 @@ declare const entitlementEvents: {
   }, import("zod").ZodObject<{
     orgId: import("zod").ZodString;
     id: import("zod").ZodString;
-    createdAt: import("zod").ZodCoercedDate<unknown>;
-    updatedAt: import("zod").ZodCoercedDate<unknown>;
+    source: import("zod").ZodString;
     status: import("zod").ZodEnum<{
-      active: "active";
       revoked: "revoked";
+      active: "active";
     }>;
-    source: import("zod").ZodString;
     contentId: import("zod").ZodNullable<import("zod").ZodString>;
+    createdAt: import("zod").ZodCoercedDate<unknown>;
+    updatedAt: import("zod").ZodCoercedDate<unknown>;
     bundleId: import("zod").ZodNullable<import("zod").ZodString>;
     orgUserId: import("zod").ZodString;
     grantedAt: import("zod").ZodCoercedDate<unknown>;
@@ -211,8 +211,8 @@ declare const entitlementEvents: {
     communityId: string;
     spaceId: string;
     orgUserId: string;
-    status: "active" | "revoked" | "requested" | "invited";
-    source: "request" | "invite" | "manual";
+    status: "revoked" | "active" | "requested" | "invited";
+    source: "manual" | "request" | "invite";
     createdAt: Date;
     updatedAt: Date;
   }, "entitlement.space_member.created", 1>, {
@@ -221,8 +221,8 @@ declare const entitlementEvents: {
     communityId: string;
     spaceId: string;
     orgUserId: string;
-    status: "active" | "revoked" | "requested" | "invited";
-    source: "request" | "invite" | "manual";
+    status: "revoked" | "active" | "requested" | "invited";
+    source: "manual" | "request" | "invite";
     createdAt: unknown;
     updatedAt: unknown;
   }, import("zod").ZodObject<{
@@ -232,15 +232,15 @@ declare const entitlementEvents: {
     spaceId: import("zod").ZodString;
     orgUserId: import("zod").ZodString;
     status: import("zod").ZodEnum<{
-      active: "active";
       revoked: "revoked";
+      active: "active";
       requested: "requested";
       invited: "invited";
     }>;
     source: import("zod").ZodEnum<{
+      manual: "manual";
       request: "request";
       invite: "invite";
-      manual: "manual";
     }>;
     createdAt: import("zod").ZodCoercedDate<unknown>;
     updatedAt: import("zod").ZodCoercedDate<unknown>;
@@ -251,8 +251,8 @@ declare const entitlementEvents: {
     communityId: string;
     spaceId: string;
     orgUserId: string;
-    status: "active" | "revoked" | "requested" | "invited";
-    source: "request" | "invite" | "manual";
+    status: "revoked" | "active" | "requested" | "invited";
+    source: "manual" | "request" | "invite";
     createdAt: Date;
     updatedAt: Date;
   }, "entitlement.space_member.updated", 1>, {
@@ -261,8 +261,8 @@ declare const entitlementEvents: {
     communityId: string;
     spaceId: string;
     orgUserId: string;
-    status: "active" | "revoked" | "requested" | "invited";
-    source: "request" | "invite" | "manual";
+    status: "revoked" | "active" | "requested" | "invited";
+    source: "manual" | "request" | "invite";
     createdAt: unknown;
     updatedAt: unknown;
   }, import("zod").ZodObject<{
@@ -272,15 +272,15 @@ declare const entitlementEvents: {
     spaceId: import("zod").ZodString;
     orgUserId: import("zod").ZodString;
     status: import("zod").ZodEnum<{
-      active: "active";
       revoked: "revoked";
+      active: "active";
       requested: "requested";
       invited: "invited";
     }>;
     source: import("zod").ZodEnum<{
+      manual: "manual";
       request: "request";
       invite: "invite";
-      manual: "manual";
     }>;
     createdAt: import("zod").ZodCoercedDate<unknown>;
     updatedAt: import("zod").ZodCoercedDate<unknown>;
@@ -291,8 +291,8 @@ declare const entitlementEvents: {
     communityId: string;
     spaceId: string;
     orgUserId: string;
-    status: "active" | "revoked" | "requested" | "invited";
-    source: "request" | "invite" | "manual";
+    status: "revoked" | "active" | "requested" | "invited";
+    source: "manual" | "request" | "invite";
     createdAt: Date;
     updatedAt: Date;
   }, "entitlement.space_member.deleted", 1>, {
@@ -301,8 +301,8 @@ declare const entitlementEvents: {
     communityId: string;
     spaceId: string;
     orgUserId: string;
-    status: "active" | "revoked" | "requested" | "invited";
-    source: "request" | "invite" | "manual";
+    status: "revoked" | "active" | "requested" | "invited";
+    source: "manual" | "request" | "invite";
     createdAt: unknown;
     updatedAt: unknown;
   }, import("zod").ZodObject<{
@@ -312,15 +312,15 @@ declare const entitlementEvents: {
     spaceId: import("zod").ZodString;
     orgUserId: import("zod").ZodString;
     status: import("zod").ZodEnum<{
-      active: "active";
       revoked: "revoked";
+      active: "active";
       requested: "requested";
       invited: "invited";
     }>;
     source: import("zod").ZodEnum<{
+      manual: "manual";
       request: "request";
       invite: "invite";
-      manual: "manual";
     }>;
     createdAt: import("zod").ZodCoercedDate<unknown>;
     updatedAt: import("zod").ZodCoercedDate<unknown>;

package/dist/entitlements/service.js

@@ -1,5 +1,5 @@
-import { noopLogger } from "../shared/logger.js";
 import { ConflictError, ForbiddenError, NotFoundError } from "../shared/errors.js";
+import { noopLogger } from "../shared/logger.js";
 import { entitlementEvents } from "./events.js";
 import { opensSpace, seesSpace } from "./rules.js";
 //#region src/entitlements/service.ts

package/dist/identity/devices.js

@@ -1,5 +1,5 @@
-import { noopLogger } from "../shared/logger.js";
 import { NotFoundError, ValidationError } from "../shared/errors.js";
+import { noopLogger } from "../shared/logger.js";
 //#region src/identity/devices.ts
 function pushDevice(device) {
 	return {

package/dist/identity/events.d.ts

@@ -22,9 +22,9 @@ declare const identityEvents: {
     id: import("zod").ZodString;
     createdAt: import("zod").ZodCoercedDate<unknown>;
     updatedAt: import("zod").ZodCoercedDate<unknown>;
-    email: import("zod").ZodEmail;
     firstName: import("zod").ZodNullable<import("zod").ZodString>;
     lastName: import("zod").ZodNullable<import("zod").ZodString>;
+    email: import("zod").ZodEmail;
   }, import("zod/v4/core").$strip>>;
   userUpdated: RuntimeEventDefinition<VersionedDomainEvent<{
     id: string;
@@ -46,9 +46,9 @@ declare const identityEvents: {
     id: import("zod").ZodString;
     createdAt: import("zod").ZodCoercedDate<unknown>;
     updatedAt: import("zod").ZodCoercedDate<unknown>;
-    email: import("zod").ZodEmail;
     firstName: import("zod").ZodNullable<import("zod").ZodString>;
     lastName: import("zod").ZodNullable<import("zod").ZodString>;
+    email: import("zod").ZodEmail;
   }, import("zod/v4/core").$strip>>;
   userDeleted: RuntimeEventDefinition<VersionedDomainEvent<{
     id: string;

package/dist/identity/notification-settings.js

@@ -1,5 +1,5 @@
-import { noopLogger } from "../shared/logger.js";
 import { NotFoundError, ValidationError } from "../shared/errors.js";
+import { noopLogger } from "../shared/logger.js";
 //#region src/identity/notification-settings.ts
 function communityOf(scope) {
 	return scope === "org" ? null : scope.communityId;

package/dist/identity/service.d.ts

@@ -23,7 +23,7 @@ declare class IdentityServiceImpl implements IdentityService {
     logger?: Logger;
     mailer: Mailer;
     uow: IdentityUnitOfWork;
-    images: MemberImageReader & Pick<AssetFiles, 'syncPublicImage'>;
+    images: MemberImageReader & Pick<AssetFiles, 'syncPublicImages'>;
     fileUrls: FileUrls;
   });
   createUser(input: CreateUserInput): Promise<User>;

package/dist/identity/service.js

@@ -1,6 +1,6 @@
-import { noopLogger } from "../shared/logger.js";
-import { ConflictError, NotFoundError } from "../shared/errors.js";
 import { genId } from "../shared/id.js";
+import { ConflictError, NotFoundError } from "../shared/errors.js";
+import { noopLogger } from "../shared/logger.js";
 import { identityEvents } from "./events.js";
 //#region src/identity/service.ts
 const UNNAMED_MEMBER = "A member";
@@ -141,7 +141,7 @@ var IdentityServiceImpl = class {
 			imageAssetOrgId
 		});
 		this.logger.info("profile updated", { userId });
-		if (patch.imageAssetId !== void 0) await this.images.syncPublicImage(orgId, orgUserId, profile.imageAssetOrgId === orgId ? profile.imageAssetId : null);
+		if (patch.imageAssetId !== void 0) await this.images.syncPublicImages(orgId, orgUserId, profile.imageAssetOrgId === orgId && profile.imageAssetId ? [profile.imageAssetId] : []);
 		return this.view(orgId, orgUserId, profile);
 	}
 };

package/dist/identity/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","names":[],"sources":["../../src/identity/service.ts"],"sourcesContent":["import type { IdentityRepository, IdentityService, IdentityUnitOfWork } from './ports.js';\nimport type { User, UserProfile, UserProfileView } from './model.js';\nimport type { MemberActor, UpdateProfileInput } from './ports.js';\nimport type { CreateUserInput, UpdateUserInput } from './types.js';\nimport type { Logger } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { genId } from '../shared/id.js';\nimport { ConflictError, NotFoundError } from '../shared/errors.js';\nimport type { Mailer } from '../shared/mailer.js';\nimport type { AssetFiles, FileUrls, MemberImageReader } from '../assets/index.js';\nimport { identityEvents } from './events.js';\n\nexport const UNNAMED_MEMBER = 'A member';\n\nexport class IdentityServiceImpl implements IdentityService {\n  private readonly repo: IdentityRepository;\n  private readonly logger: Logger;\n  private readonly uow: IdentityUnitOfWork;\n  private readonly mailer: Pick<Mailer, 'send'>;\n  private readonly images: MemberImageReader & Pick<AssetFiles, 'syncPublicImage'>;\n  private readonly fileUrls: FileUrls;\n\n  constructor(input: {\n    repo: IdentityRepository;\n    logger?: Logger;\n    mailer: Mailer;\n    uow: IdentityUnitOfWork;\n    images: MemberImageReader & Pick<AssetFiles, 'syncPublicImage'>;\n    fileUrls: FileUrls;\n  }) {\n    this.repo = input.repo;\n    this.mailer = input.mailer;\n    this.logger = input.logger ?? noopLogger;\n    this.uow = input.uow;\n    this.images = input.images;\n    this.fileUrls = input.fileUrls;\n  }\n\n  async createUser(input: CreateUserInput): Promise<User> {\n    const created = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.insertUser(input);\n      await outbox.append([identityEvents.userCreated.make({ orgId: '-', data: user })]);\n      return user;\n    });\n    this.logger.info('user created', { userId: created.id });\n    return created;\n  }\n\n  async linkOrCreateUser(input: CreateUserInput): Promise<User> {\n    const existing = await this.repo.findUserByEmail(input.email);\n    if (!existing) {\n      const id = input.id ?? genId('user');\n      return this.createUser({ ...input, id, externalId: id });\n    }\n    if (existing.externalId !== null) {\n      throw new ConflictError('That email already has an account');\n    }\n    // Existing user without external link, so invited. update the user with the\n    // id.\n    const linked = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.updateUser(existing.id, {\n        externalId: existing.id,\n        ...(input.firstName !== undefined && { firstName: input.firstName }),\n        ...(input.lastName !== undefined && { lastName: input.lastName }),\n      });\n      await outbox.append([identityEvents.userUpdated.make({ orgId: '-', data: user! })]);\n      return user!;\n    });\n    this.logger.info('user linked to auth account', { userId: linked.id });\n    return linked;\n  }\n\n  async updateUser(id: string, input: UpdateUserInput): Promise<User> {\n    const person = await this.repo.findUserById(id);\n    if (!person) {\n      throw new NotFoundError('User', id);\n    }\n\n    const updated = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.updateUser(id, input);\n      await outbox.append([identityEvents.userUpdated.make({ orgId: '-', data: user! })]);\n      return user!;\n    });\n    this.logger.info('user updated', { userId: updated.id });\n    return updated;\n  }\n\n  async getUserByExternalId(externalId: string): Promise<User | null> {\n    return this.repo.findUserByExternalId(externalId);\n  }\n\n  async getUserByEmail(email: string): Promise<User | null> {\n    return this.repo.findUserByEmail(email);\n  }\n\n  async getUserById(id: string): Promise<User | null> {\n    return this.repo.findUserById(id);\n  }\n\n  async sendPasswordReset(input: { email: string; url: string }): Promise<void> {\n    await this.mailer.send(input.email, 'passwordReset', { resetUrl: input.url });\n  }\n\n  async sendPasswordChanged(input: { email: string }): Promise<void> {\n    await this.mailer.send(input.email, 'passwordChanged', {});\n  }\n\n  async sendMagicLink(input: { email: string; url: string }): Promise<void> {\n    await this.mailer.send(input.email, 'magicLink', { url: input.url });\n  }\n\n  async profileOf(actor: MemberActor): Promise<UserProfileView> {\n    const userId = actor.userId;\n    const stored = await this.repo.findProfile(userId);\n    if (stored) {\n      return this.view(actor.orgId, actor.id, stored);\n    }\n    const never = new Date(0);\n    return {\n      userId,\n      displayName: null,\n      headline: null,\n      bio: null,\n      imageAssetOrgId: null,\n      imageAssetId: null,\n      imageUrl: null,\n      extra: {},\n      createdAt: never,\n      updatedAt: never,\n    };\n  }\n\n  private view(orgId: string, orgUserId: string, profile: UserProfile): UserProfileView {\n    const imageAssetId = profile.imageAssetOrgId === orgId ? profile.imageAssetId : null;\n    return {\n      ...profile,\n      imageUrl: imageAssetId ? this.fileUrls.publicImage(orgId, orgUserId, imageAssetId) : null,\n    };\n  }\n\n  async displayName(userId: string | null): Promise<string> {\n    if (userId === null) {\n      return UNNAMED_MEMBER;\n    }\n    const [profile, user] = await Promise.all([\n      this.repo.findProfile(userId),\n      this.repo.findUserById(userId),\n    ]);\n    const named = profile?.displayName?.trim();\n    if (named) {\n      return named;\n    }\n    const composed = [user?.firstName, user?.lastName].filter(Boolean).join(' ').trim();\n    return composed || UNNAMED_MEMBER;\n  }\n\n  async updateProfile(patch: UpdateProfileInput, actor: MemberActor): Promise<UserProfileView> {\n    const orgId = actor.orgId;\n    const userId = actor.userId;\n    const orgUserId = actor.id;\n    const user = await this.repo.findUserById(userId);\n    if (!user) {\n      throw new NotFoundError('User', userId);\n    }\n    if (patch.imageAssetId != null) {\n      const owned = await this.images.ownsImage(orgId, patch.imageAssetId, orgUserId);\n      if (!owned) {\n        this.logger.debug('profile photo refused', {\n          userId,\n          orgUserId,\n          assetId: patch.imageAssetId,\n        });\n        throw new NotFoundError('Asset', patch.imageAssetId);\n      }\n    }\n    const imageAssetOrgId =\n      patch.imageAssetId === undefined ? undefined : patch.imageAssetId === null ? null : orgId;\n    const profile = await this.repo.upsertProfile(userId, { ...patch, imageAssetOrgId });\n    this.logger.info('profile updated', { userId });\n    if (patch.imageAssetId !== undefined) {\n      await this.images.syncPublicImage(\n        orgId,\n        orgUserId,\n        profile.imageAssetOrgId === orgId ? profile.imageAssetId : null,\n      );\n    }\n    return this.view(orgId, orgUserId, profile);\n  }\n}\n"],"mappings":";;;;;AAYA,MAAa,iBAAiB;AAE9B,IAAa,sBAAb,MAA4D;CAC1D;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,OAOT;EACD,KAAK,OAAO,MAAM;EAClB,KAAK,SAAS,MAAM;EACpB,KAAK,SAAS,MAAM,UAAU;EAC9B,KAAK,MAAM,MAAM;EACjB,KAAK,SAAS,MAAM;EACpB,KAAK,WAAW,MAAM;CACxB;CAEA,MAAM,WAAW,OAAuC;EACtD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GACjE,MAAM,OAAO,MAAM,SAAS,WAAW,KAAK;GAC5C,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAK,CAAC,CAAC,CAAC;GACjF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,gBAAgB,EAAE,QAAQ,QAAQ,GAAG,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,iBAAiB,OAAuC;EAC5D,MAAM,WAAW,MAAM,KAAK,KAAK,gBAAgB,MAAM,KAAK;EAC5D,IAAI,CAAC,UAAU;GACb,MAAM,KAAK,MAAM,MAAM,MAAM,MAAM;GACnC,OAAO,KAAK,WAAW;IAAE,GAAG;IAAO;IAAI,YAAY;GAAG,CAAC;EACzD;EACA,IAAI,SAAS,eAAe,MAC1B,MAAM,IAAI,cAAc,mCAAmC;EAI7D,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GAChE,MAAM,OAAO,MAAM,SAAS,WAAW,SAAS,IAAI;IAClD,YAAY,SAAS;IACrB,GAAI,MAAM,cAAc,KAAA,KAAa,EAAE,WAAW,MAAM,UAAU;IAClE,GAAI,MAAM,aAAa,KAAA,KAAa,EAAE,UAAU,MAAM,SAAS;GACjE,CAAC;GACD,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAM,CAAC,CAAC,CAAC;GAClF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,+BAA+B,EAAE,QAAQ,OAAO,GAAG,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,WAAW,IAAY,OAAuC;EAElE,IAAI,CAAC,MADgB,KAAK,KAAK,aAAa,EAAE,GAE5C,MAAM,IAAI,cAAc,QAAQ,EAAE;EAGpC,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GACjE,MAAM,OAAO,MAAM,SAAS,WAAW,IAAI,KAAK;GAChD,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAM,CAAC,CAAC,CAAC;GAClF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,gBAAgB,EAAE,QAAQ,QAAQ,GAAG,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,oBAAoB,YAA0C;EAClE,OAAO,KAAK,KAAK,qBAAqB,UAAU;CAClD;CAEA,MAAM,eAAe,OAAqC;EACxD,OAAO,KAAK,KAAK,gBAAgB,KAAK;CACxC;CAEA,MAAM,YAAY,IAAkC;EAClD,OAAO,KAAK,KAAK,aAAa,EAAE;CAClC;CAEA,MAAM,kBAAkB,OAAsD;EAC5E,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,iBAAiB,EAAE,UAAU,MAAM,IAAI,CAAC;CAC9E;CAEA,MAAM,oBAAoB,OAAyC;EACjE,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,mBAAmB,CAAC,CAAC;CAC3D;CAEA,MAAM,cAAc,OAAsD;EACxE,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,aAAa,EAAE,KAAK,MAAM,IAAI,CAAC;CACrE;CAEA,MAAM,UAAU,OAA8C;EAC5D,MAAM,SAAS,MAAM;EACrB,MAAM,SAAS,MAAM,KAAK,KAAK,YAAY,MAAM;EACjD,IAAI,QACF,OAAO,KAAK,KAAK,MAAM,OAAO,MAAM,IAAI,MAAM;EAEhD,MAAM,wBAAQ,IAAI,KAAK,CAAC;EACxB,OAAO;GACL;GACA,aAAa;GACb,UAAU;GACV,KAAK;GACL,iBAAiB;GACjB,cAAc;GACd,UAAU;GACV,OAAO,CAAC;GACR,WAAW;GACX,WAAW;EACb;CACF;CAEA,KAAa,OAAe,WAAmB,SAAuC;EACpF,MAAM,eAAe,QAAQ,oBAAoB,QAAQ,QAAQ,eAAe;EAChF,OAAO;GACL,GAAG;GACH,UAAU,eAAe,KAAK,SAAS,YAAY,OAAO,WAAW,YAAY,IAAI;EACvF;CACF;CAEA,MAAM,YAAY,QAAwC;EACxD,IAAI,WAAW,MACb,OAAO;EAET,MAAM,CAAC,SAAS,QAAQ,MAAM,QAAQ,IAAI,CACxC,KAAK,KAAK,YAAY,MAAM,GAC5B,KAAK,KAAK,aAAa,MAAM,CAC/B,CAAC;EACD,MAAM,QAAQ,SAAS,aAAa,KAAK;EACzC,IAAI,OACF,OAAO;EAGT,OADiB,CAAC,MAAM,WAAW,MAAM,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAC/D,KAAA;CAChB;CAEA,MAAM,cAAc,OAA2B,OAA8C;EAC3F,MAAM,QAAQ,MAAM;EACpB,MAAM,SAAS,MAAM;EACrB,MAAM,YAAY,MAAM;EAExB,IAAI,CAAC,MADc,KAAK,KAAK,aAAa,MAAM,GAE9C,MAAM,IAAI,cAAc,QAAQ,MAAM;EAExC,IAAI,MAAM,gBAAgB,MAEpB;OAAA,CAAC,MADe,KAAK,OAAO,UAAU,OAAO,MAAM,cAAc,SAAS,GAClE;IACV,KAAK,OAAO,MAAM,yBAAyB;KACzC;KACA;KACA,SAAS,MAAM;IACjB,CAAC;IACD,MAAM,IAAI,cAAc,SAAS,MAAM,YAAY;GACrD;;EAEF,MAAM,kBACJ,MAAM,iBAAiB,KAAA,IAAY,KAAA,IAAY,MAAM,iBAAiB,OAAO,OAAO;EACtF,MAAM,UAAU,MAAM,KAAK,KAAK,cAAc,QAAQ;GAAE,GAAG;GAAO;EAAgB,CAAC;EACnF,KAAK,OAAO,KAAK,mBAAmB,EAAE,OAAO,CAAC;EAC9C,IAAI,MAAM,iBAAiB,KAAA,GACzB,MAAM,KAAK,OAAO,gBAChB,OACA,WACA,QAAQ,oBAAoB,QAAQ,QAAQ,eAAe,IAC7D;EAEF,OAAO,KAAK,KAAK,OAAO,WAAW,OAAO;CAC5C;AACF"}
+{"version":3,"file":"service.js","names":[],"sources":["../../src/identity/service.ts"],"sourcesContent":["import type { IdentityRepository, IdentityService, IdentityUnitOfWork } from './ports.js';\nimport type { User, UserProfile, UserProfileView } from './model.js';\nimport type { MemberActor, UpdateProfileInput } from './ports.js';\nimport type { CreateUserInput, UpdateUserInput } from './types.js';\nimport type { Logger } from '../shared/ports.js';\nimport { noopLogger } from '../shared/logger.js';\nimport { genId } from '../shared/id.js';\nimport { ConflictError, NotFoundError } from '../shared/errors.js';\nimport type { Mailer } from '../shared/mailer.js';\nimport type { AssetFiles, FileUrls, MemberImageReader } from '../assets/index.js';\nimport { identityEvents } from './events.js';\n\nexport const UNNAMED_MEMBER = 'A member';\n\nexport class IdentityServiceImpl implements IdentityService {\n  private readonly repo: IdentityRepository;\n  private readonly logger: Logger;\n  private readonly uow: IdentityUnitOfWork;\n  private readonly mailer: Pick<Mailer, 'send'>;\n  private readonly images: MemberImageReader & Pick<AssetFiles, 'syncPublicImages'>;\n  private readonly fileUrls: FileUrls;\n\n  constructor(input: {\n    repo: IdentityRepository;\n    logger?: Logger;\n    mailer: Mailer;\n    uow: IdentityUnitOfWork;\n    images: MemberImageReader & Pick<AssetFiles, 'syncPublicImages'>;\n    fileUrls: FileUrls;\n  }) {\n    this.repo = input.repo;\n    this.mailer = input.mailer;\n    this.logger = input.logger ?? noopLogger;\n    this.uow = input.uow;\n    this.images = input.images;\n    this.fileUrls = input.fileUrls;\n  }\n\n  async createUser(input: CreateUserInput): Promise<User> {\n    const created = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.insertUser(input);\n      await outbox.append([identityEvents.userCreated.make({ orgId: '-', data: user })]);\n      return user;\n    });\n    this.logger.info('user created', { userId: created.id });\n    return created;\n  }\n\n  async linkOrCreateUser(input: CreateUserInput): Promise<User> {\n    const existing = await this.repo.findUserByEmail(input.email);\n    if (!existing) {\n      const id = input.id ?? genId('user');\n      return this.createUser({ ...input, id, externalId: id });\n    }\n    if (existing.externalId !== null) {\n      throw new ConflictError('That email already has an account');\n    }\n    // Existing user without external link, so invited. update the user with the\n    // id.\n    const linked = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.updateUser(existing.id, {\n        externalId: existing.id,\n        ...(input.firstName !== undefined && { firstName: input.firstName }),\n        ...(input.lastName !== undefined && { lastName: input.lastName }),\n      });\n      await outbox.append([identityEvents.userUpdated.make({ orgId: '-', data: user! })]);\n      return user!;\n    });\n    this.logger.info('user linked to auth account', { userId: linked.id });\n    return linked;\n  }\n\n  async updateUser(id: string, input: UpdateUserInput): Promise<User> {\n    const person = await this.repo.findUserById(id);\n    if (!person) {\n      throw new NotFoundError('User', id);\n    }\n\n    const updated = await this.uow.run(async ({ identity, outbox }) => {\n      const user = await identity.updateUser(id, input);\n      await outbox.append([identityEvents.userUpdated.make({ orgId: '-', data: user! })]);\n      return user!;\n    });\n    this.logger.info('user updated', { userId: updated.id });\n    return updated;\n  }\n\n  async getUserByExternalId(externalId: string): Promise<User | null> {\n    return this.repo.findUserByExternalId(externalId);\n  }\n\n  async getUserByEmail(email: string): Promise<User | null> {\n    return this.repo.findUserByEmail(email);\n  }\n\n  async getUserById(id: string): Promise<User | null> {\n    return this.repo.findUserById(id);\n  }\n\n  async sendPasswordReset(input: { email: string; url: string }): Promise<void> {\n    await this.mailer.send(input.email, 'passwordReset', { resetUrl: input.url });\n  }\n\n  async sendPasswordChanged(input: { email: string }): Promise<void> {\n    await this.mailer.send(input.email, 'passwordChanged', {});\n  }\n\n  async sendMagicLink(input: { email: string; url: string }): Promise<void> {\n    await this.mailer.send(input.email, 'magicLink', { url: input.url });\n  }\n\n  async profileOf(actor: MemberActor): Promise<UserProfileView> {\n    const userId = actor.userId;\n    const stored = await this.repo.findProfile(userId);\n    if (stored) {\n      return this.view(actor.orgId, actor.id, stored);\n    }\n    const never = new Date(0);\n    return {\n      userId,\n      displayName: null,\n      headline: null,\n      bio: null,\n      imageAssetOrgId: null,\n      imageAssetId: null,\n      imageUrl: null,\n      extra: {},\n      createdAt: never,\n      updatedAt: never,\n    };\n  }\n\n  private view(orgId: string, orgUserId: string, profile: UserProfile): UserProfileView {\n    const imageAssetId = profile.imageAssetOrgId === orgId ? profile.imageAssetId : null;\n    return {\n      ...profile,\n      imageUrl: imageAssetId ? this.fileUrls.publicImage(orgId, orgUserId, imageAssetId) : null,\n    };\n  }\n\n  async displayName(userId: string | null): Promise<string> {\n    if (userId === null) {\n      return UNNAMED_MEMBER;\n    }\n    const [profile, user] = await Promise.all([\n      this.repo.findProfile(userId),\n      this.repo.findUserById(userId),\n    ]);\n    const named = profile?.displayName?.trim();\n    if (named) {\n      return named;\n    }\n    const composed = [user?.firstName, user?.lastName].filter(Boolean).join(' ').trim();\n    return composed || UNNAMED_MEMBER;\n  }\n\n  async updateProfile(patch: UpdateProfileInput, actor: MemberActor): Promise<UserProfileView> {\n    const orgId = actor.orgId;\n    const userId = actor.userId;\n    const orgUserId = actor.id;\n    const user = await this.repo.findUserById(userId);\n    if (!user) {\n      throw new NotFoundError('User', userId);\n    }\n    if (patch.imageAssetId != null) {\n      const owned = await this.images.ownsImage(orgId, patch.imageAssetId, orgUserId);\n      if (!owned) {\n        this.logger.debug('profile photo refused', {\n          userId,\n          orgUserId,\n          assetId: patch.imageAssetId,\n        });\n        throw new NotFoundError('Asset', patch.imageAssetId);\n      }\n    }\n    const imageAssetOrgId =\n      patch.imageAssetId === undefined ? undefined : patch.imageAssetId === null ? null : orgId;\n    const profile = await this.repo.upsertProfile(userId, { ...patch, imageAssetOrgId });\n    this.logger.info('profile updated', { userId });\n    if (patch.imageAssetId !== undefined) {\n      await this.images.syncPublicImages(\n        orgId,\n        orgUserId,\n        profile.imageAssetOrgId === orgId && profile.imageAssetId ? [profile.imageAssetId] : [],\n      );\n    }\n    return this.view(orgId, orgUserId, profile);\n  }\n}\n"],"mappings":";;;;;AAYA,MAAa,iBAAiB;AAE9B,IAAa,sBAAb,MAA4D;CAC1D;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,OAOT;EACD,KAAK,OAAO,MAAM;EAClB,KAAK,SAAS,MAAM;EACpB,KAAK,SAAS,MAAM,UAAU;EAC9B,KAAK,MAAM,MAAM;EACjB,KAAK,SAAS,MAAM;EACpB,KAAK,WAAW,MAAM;CACxB;CAEA,MAAM,WAAW,OAAuC;EACtD,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GACjE,MAAM,OAAO,MAAM,SAAS,WAAW,KAAK;GAC5C,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAK,CAAC,CAAC,CAAC;GACjF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,gBAAgB,EAAE,QAAQ,QAAQ,GAAG,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,iBAAiB,OAAuC;EAC5D,MAAM,WAAW,MAAM,KAAK,KAAK,gBAAgB,MAAM,KAAK;EAC5D,IAAI,CAAC,UAAU;GACb,MAAM,KAAK,MAAM,MAAM,MAAM,MAAM;GACnC,OAAO,KAAK,WAAW;IAAE,GAAG;IAAO;IAAI,YAAY;GAAG,CAAC;EACzD;EACA,IAAI,SAAS,eAAe,MAC1B,MAAM,IAAI,cAAc,mCAAmC;EAI7D,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GAChE,MAAM,OAAO,MAAM,SAAS,WAAW,SAAS,IAAI;IAClD,YAAY,SAAS;IACrB,GAAI,MAAM,cAAc,KAAA,KAAa,EAAE,WAAW,MAAM,UAAU;IAClE,GAAI,MAAM,aAAa,KAAA,KAAa,EAAE,UAAU,MAAM,SAAS;GACjE,CAAC;GACD,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAM,CAAC,CAAC,CAAC;GAClF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,+BAA+B,EAAE,QAAQ,OAAO,GAAG,CAAC;EACrE,OAAO;CACT;CAEA,MAAM,WAAW,IAAY,OAAuC;EAElE,IAAI,CAAC,MADgB,KAAK,KAAK,aAAa,EAAE,GAE5C,MAAM,IAAI,cAAc,QAAQ,EAAE;EAGpC,MAAM,UAAU,MAAM,KAAK,IAAI,IAAI,OAAO,EAAE,UAAU,aAAa;GACjE,MAAM,OAAO,MAAM,SAAS,WAAW,IAAI,KAAK;GAChD,MAAM,OAAO,OAAO,CAAC,eAAe,YAAY,KAAK;IAAE,OAAO;IAAK,MAAM;GAAM,CAAC,CAAC,CAAC;GAClF,OAAO;EACT,CAAC;EACD,KAAK,OAAO,KAAK,gBAAgB,EAAE,QAAQ,QAAQ,GAAG,CAAC;EACvD,OAAO;CACT;CAEA,MAAM,oBAAoB,YAA0C;EAClE,OAAO,KAAK,KAAK,qBAAqB,UAAU;CAClD;CAEA,MAAM,eAAe,OAAqC;EACxD,OAAO,KAAK,KAAK,gBAAgB,KAAK;CACxC;CAEA,MAAM,YAAY,IAAkC;EAClD,OAAO,KAAK,KAAK,aAAa,EAAE;CAClC;CAEA,MAAM,kBAAkB,OAAsD;EAC5E,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,iBAAiB,EAAE,UAAU,MAAM,IAAI,CAAC;CAC9E;CAEA,MAAM,oBAAoB,OAAyC;EACjE,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,mBAAmB,CAAC,CAAC;CAC3D;CAEA,MAAM,cAAc,OAAsD;EACxE,MAAM,KAAK,OAAO,KAAK,MAAM,OAAO,aAAa,EAAE,KAAK,MAAM,IAAI,CAAC;CACrE;CAEA,MAAM,UAAU,OAA8C;EAC5D,MAAM,SAAS,MAAM;EACrB,MAAM,SAAS,MAAM,KAAK,KAAK,YAAY,MAAM;EACjD,IAAI,QACF,OAAO,KAAK,KAAK,MAAM,OAAO,MAAM,IAAI,MAAM;EAEhD,MAAM,wBAAQ,IAAI,KAAK,CAAC;EACxB,OAAO;GACL;GACA,aAAa;GACb,UAAU;GACV,KAAK;GACL,iBAAiB;GACjB,cAAc;GACd,UAAU;GACV,OAAO,CAAC;GACR,WAAW;GACX,WAAW;EACb;CACF;CAEA,KAAa,OAAe,WAAmB,SAAuC;EACpF,MAAM,eAAe,QAAQ,oBAAoB,QAAQ,QAAQ,eAAe;EAChF,OAAO;GACL,GAAG;GACH,UAAU,eAAe,KAAK,SAAS,YAAY,OAAO,WAAW,YAAY,IAAI;EACvF;CACF;CAEA,MAAM,YAAY,QAAwC;EACxD,IAAI,WAAW,MACb,OAAO;EAET,MAAM,CAAC,SAAS,QAAQ,MAAM,QAAQ,IAAI,CACxC,KAAK,KAAK,YAAY,MAAM,GAC5B,KAAK,KAAK,aAAa,MAAM,CAC/B,CAAC;EACD,MAAM,QAAQ,SAAS,aAAa,KAAK;EACzC,IAAI,OACF,OAAO;EAGT,OADiB,CAAC,MAAM,WAAW,MAAM,QAAQ,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAC/D,KAAA;CAChB;CAEA,MAAM,cAAc,OAA2B,OAA8C;EAC3F,MAAM,QAAQ,MAAM;EACpB,MAAM,SAAS,MAAM;EACrB,MAAM,YAAY,MAAM;EAExB,IAAI,CAAC,MADc,KAAK,KAAK,aAAa,MAAM,GAE9C,MAAM,IAAI,cAAc,QAAQ,MAAM;EAExC,IAAI,MAAM,gBAAgB,MAEpB;OAAA,CAAC,MADe,KAAK,OAAO,UAAU,OAAO,MAAM,cAAc,SAAS,GAClE;IACV,KAAK,OAAO,MAAM,yBAAyB;KACzC;KACA;KACA,SAAS,MAAM;IACjB,CAAC;IACD,MAAM,IAAI,cAAc,SAAS,MAAM,YAAY;GACrD;;EAEF,MAAM,kBACJ,MAAM,iBAAiB,KAAA,IAAY,KAAA,IAAY,MAAM,iBAAiB,OAAO,OAAO;EACtF,MAAM,UAAU,MAAM,KAAK,KAAK,cAAc,QAAQ;GAAE,GAAG;GAAO;EAAgB,CAAC;EACnF,KAAK,OAAO,KAAK,mBAAmB,EAAE,OAAO,CAAC;EAC9C,IAAI,MAAM,iBAAiB,KAAA,GACzB,MAAM,KAAK,OAAO,iBAChB,OACA,WACA,QAAQ,oBAAoB,SAAS,QAAQ,eAAe,CAAC,QAAQ,YAAY,IAAI,CAAC,CACxF;EAEF,OAAO,KAAK,KAAK,OAAO,WAAW,OAAO;CAC5C;AACF"}

package/dist/integrations/service.js

@@ -1,6 +1,6 @@
-import { noopLogger } from "../shared/logger.js";
-import { ConflictError, NotFoundError } from "../shared/errors.js";
 import { genId } from "../shared/id.js";
+import { ConflictError, NotFoundError } from "../shared/errors.js";
+import { noopLogger } from "../shared/logger.js";
 import { ActionInvocationError, AlreadyConnectedError, InvalidConfigError, UnknownIntegrationError } from "./model.js";
 import { integrationEvents } from "./events.js";
 //#region src/integrations/service.ts

package/dist/organizations/effective-permissions.d.ts

@@ -24,7 +24,8 @@ declare class ResolvedPermissions implements EffectivePermissions {
   private readonly orgRole;
   private readonly content;
   private readonly owner;
-  constructor(org: Set<Permission>, orgRole: RoleRef, content: Map<ContentId, ContentEntry>, owner: boolean);
+  private readonly token;
+  constructor(org: Set<Permission>, orgRole: RoleRef, content: Map<ContentId, ContentEntry>, owner: boolean, token: boolean);
   has(permission: Permission, on?: ContentId): boolean;
   require(permission: Permission, on?: ContentId): void;
   anywhere(permission: Permission): boolean;
@@ -34,6 +35,7 @@ declare class ResolvedPermissions implements EffectivePermissions {
   };
   roleOn(on?: ContentId): RoleRef;
   isOwner(): boolean;
+  isToken(): boolean;
   orgPermissions(): Permission[];
   contentPermissions(): Record<ContentId, Permission[]>;
   teamOn(on?: ContentId): boolean;

package/dist/organizations/effective-permissions.js

@@ -23,11 +23,13 @@ var ResolvedPermissions = class {
 	orgRole;
 	content;
 	owner;
-	constructor(org, orgRole, content, owner) {
+	token;
+	constructor(org, orgRole, content, owner, token) {
 		this.org = org;
 		this.orgRole = orgRole;
 		this.content = content;
 		this.owner = owner;
+		this.token = token;
 	}
 	has(permission, on) {
 		if (this.org.has(permission)) return true;
@@ -66,6 +68,9 @@ var ResolvedPermissions = class {
 	isOwner() {
 		return this.owner;
 	}
+	isToken() {
+		return this.token;
+	}
 	orgPermissions() {
 		return ALL_PERMISSIONS.filter((permission) => this.org.has(permission));
 	}
@@ -98,14 +103,14 @@ function resolvePermissions({ assignments, roles, tokenScopes }) {
 		});
 	}
 	const owner = orgRow?.roleKey === "owner" && orgRole !== void 0;
-	return new ResolvedPermissions(intersect(orgSet, scopes), orgRole ? refOf(orgRole) : roles.get("member") ? refOf(roles.get(MEMBER_ROLE_KEY)) : MEMBER_REF, content, owner && scopes === null);
+	return new ResolvedPermissions(intersect(orgSet, scopes), orgRole ? refOf(orgRole) : roles.get("member") ? refOf(roles.get(MEMBER_ROLE_KEY)) : MEMBER_REF, content, owner && scopes === null, scopes !== null);
 }
 function systemPermissions() {
 	return new ResolvedPermissions(new Set(ALL_PERMISSIONS), {
 		key: "system",
 		name: "System",
 		team: false
-	}, /* @__PURE__ */ new Map(), false);
+	}, /* @__PURE__ */ new Map(), false, false);
 }
 //#endregion
 export { ResolvedPermissions, resolvePermissions, systemPermissions };

package/dist/organizations/effective-permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"effective-permissions.js","names":[],"sources":["../../src/organizations/effective-permissions.ts"],"sourcesContent":["import type { ContentId, ContentType, Permission } from '../types/index.js';\nimport type { EffectivePermissions, RoleRef } from '../shared/actor.js';\nimport { ForbiddenError } from '../shared/errors.js';\nimport { ALL_PERMISSIONS, permissionAbout, withImplied } from './permissions.js';\nimport { MEMBER_ROLE_KEY, OWNER_ROLE_KEY } from './default-roles.js';\nimport type { OrgRole } from './org-roles.js';\n\nexport interface AssignmentRow {\n  roleKey: string;\n  contentId: ContentId | null;\n  contentType: ContentType | null;\n}\n\nexport interface ResolveInput {\n  assignments: readonly AssignmentRow[];\n  roles: ReadonlyMap<string, OrgRole>;\n  tokenScopes?: readonly Permission[];\n}\n\ninterface ContentEntry {\n  permissions: Set<Permission>;\n  role: RoleRef;\n}\n\nconst MEMBER_REF: RoleRef = { key: MEMBER_ROLE_KEY, name: 'Member', team: false };\n\nfunction refOf(role: OrgRole): RoleRef {\n  return { key: role.key, name: role.name, team: role.team };\n}\n\nfunction intersect(set: Set<Permission>, scopes: Set<Permission> | null): Set<Permission> {\n  if (!scopes) {\n    return set;\n  }\n  return new Set([...set].filter((permission) => scopes.has(permission)));\n}\n\nexport class ResolvedPermissions implements EffectivePermissions {\n  constructor(\n    private readonly org: Set<Permission>,\n    private readonly orgRole: RoleRef,\n    private readonly content: Map<ContentId, ContentEntry>,\n    private readonly owner: boolean,\n  ) {}\n\n  has(permission: Permission, on?: ContentId): boolean {\n    if (this.org.has(permission)) {\n      return true;\n    }\n    return on !== undefined && (this.content.get(on)?.permissions.has(permission) ?? false);\n  }\n\n  require(permission: Permission, on?: ContentId): void {\n    if (!this.has(permission, on)) {\n      throw Object.assign(new ForbiddenError(`You need ${permission}`), {\n        permission,\n        ...(on !== undefined && { contentId: on }),\n      });\n    }\n  }\n\n  anywhere(permission: Permission): boolean {\n    if (this.org.has(permission)) {\n      return true;\n    }\n    for (const entry of this.content.values()) {\n      if (entry.permissions.has(permission)) {\n        return true;\n      }\n    }\n    return false;\n  }\n\n  where(permission: Permission): { org: boolean; content: ContentId[] } {\n    if (this.org.has(permission)) {\n      return { org: true, content: [] };\n    }\n    const content: ContentId[] = [];\n    for (const [id, entry] of this.content) {\n      if (entry.permissions.has(permission)) {\n        content.push(id);\n      }\n    }\n    return { org: false, content };\n  }\n\n  roleOn(on?: ContentId): RoleRef {\n    if (on !== undefined) {\n      const entry = this.content.get(on);\n      if (entry) {\n        return entry.role;\n      }\n    }\n    return this.orgRole;\n  }\n\n  isOwner(): boolean {\n    return this.owner;\n  }\n\n  orgPermissions(): Permission[] {\n    return ALL_PERMISSIONS.filter((permission) => this.org.has(permission));\n  }\n\n  contentPermissions(): Record<ContentId, Permission[]> {\n    const out: Record<ContentId, Permission[]> = {};\n    for (const [id, entry] of this.content) {\n      out[id] = ALL_PERMISSIONS.filter((permission) => entry.permissions.has(permission));\n    }\n    return out;\n  }\n\n  teamOn(on?: ContentId): boolean {\n    if (on !== undefined && this.content.get(on)?.role.team) {\n      return true;\n    }\n    return this.orgRole.team;\n  }\n}\n\nexport function resolvePermissions({\n  assignments,\n  roles,\n  tokenScopes,\n}: ResolveInput): ResolvedPermissions {\n  const scopes = tokenScopes ? withImplied(tokenScopes) : null;\n  const orgRow = assignments.find((row) => row.contentId === null);\n  const listed = orgRow ? roles.get(orgRow.roleKey) : undefined;\n  const orgRole = listed?.levels.includes('org') ? listed : undefined;\n  const orgSet = orgRole ? withImplied(orgRole.permissions) : new Set<Permission>();\n  const content = new Map<ContentId, ContentEntry>();\n  for (const row of assignments) {\n    if (row.contentId === null || row.contentType === null) {\n      continue;\n    }\n    const role = roles.get(row.roleKey);\n    if (!role || !role.levels.includes(row.contentType)) {\n      continue;\n    }\n    const type = row.contentType;\n    const own = role.permissions.filter((permission) => permissionAbout(permission) === type);\n    const expanded = [...withImplied(own)].filter(\n      (permission) => permissionAbout(permission) === type,\n    );\n    content.set(row.contentId, {\n      permissions: intersect(new Set(expanded), scopes),\n      role: refOf(role),\n    });\n  }\n  const owner = orgRow?.roleKey === OWNER_ROLE_KEY && orgRole !== undefined;\n  return new ResolvedPermissions(\n    intersect(orgSet, scopes),\n    orgRole\n      ? refOf(orgRole)\n      : roles.get(MEMBER_ROLE_KEY)\n        ? refOf(roles.get(MEMBER_ROLE_KEY)!)\n        : MEMBER_REF,\n    content,\n    owner && scopes === null,\n  );\n}\n\nexport function systemPermissions(): ResolvedPermissions {\n  return new ResolvedPermissions(\n    new Set(ALL_PERMISSIONS),\n    { key: 'system', name: 'System', team: false },\n    new Map(),\n    false,\n  );\n}\n"],"mappings":";;;;AAwBA,MAAM,aAAsB;CAAE,KAAK;CAAiB,MAAM;CAAU,MAAM;AAAM;AAEhF,SAAS,MAAM,MAAwB;CACrC,OAAO;EAAE,KAAK,KAAK;EAAK,MAAM,KAAK;EAAM,MAAM,KAAK;CAAK;AAC3D;AAEA,SAAS,UAAU,KAAsB,QAAiD;CACxF,IAAI,CAAC,QACH,OAAO;CAET,OAAO,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,eAAe,OAAO,IAAI,UAAU,CAAC,CAAC;AACxE;AAEA,IAAa,sBAAb,MAAiE;CAE5C;CACA;CACA;CACA;CAJnB,YACE,KACA,SACA,SACA,OACA;EAJiB,KAAA,MAAA;EACA,KAAA,UAAA;EACA,KAAA,UAAA;EACA,KAAA,QAAA;CAChB;CAEH,IAAI,YAAwB,IAAyB;EACnD,IAAI,KAAK,IAAI,IAAI,UAAU,GACzB,OAAO;EAET,OAAO,OAAO,KAAA,MAAc,KAAK,QAAQ,IAAI,EAAE,CAAC,EAAE,YAAY,IAAI,UAAU,KAAK;CACnF;CAEA,QAAQ,YAAwB,IAAsB;EACpD,IAAI,CAAC,KAAK,IAAI,YAAY,EAAE,GAC1B,MAAM,OAAO,OAAO,IAAI,eAAe,YAAY,YAAY,GAAG;GAChE;GACA,GAAI,OAAO,KAAA,KAAa,EAAE,WAAW,GAAG;EAC1C,CAAC;CAEL;CAEA,SAAS,YAAiC;EACxC,IAAI,KAAK,IAAI,IAAI,UAAU,GACzB,OAAO;EAET,KAAK,MAAM,SAAS,KAAK,QAAQ,OAAO,GACtC,IAAI,MAAM,YAAY,IAAI,UAAU,GAClC,OAAO;EAGX,OAAO;CACT;CAEA,MAAM,YAAgE;EACpE,IAAI,KAAK,IAAI,IAAI,UAAU,GACzB,OAAO;GAAE,KAAK;GAAM,SAAS,CAAC;EAAE;EAElC,MAAM,UAAuB,CAAC;EAC9B,KAAK,MAAM,CAAC,IAAI,UAAU,KAAK,SAC7B,IAAI,MAAM,YAAY,IAAI,UAAU,GAClC,QAAQ,KAAK,EAAE;EAGnB,OAAO;GAAE,KAAK;GAAO;EAAQ;CAC/B;CAEA,OAAO,IAAyB;EAC9B,IAAI,OAAO,KAAA,GAAW;GACpB,MAAM,QAAQ,KAAK,QAAQ,IAAI,EAAE;GACjC,IAAI,OACF,OAAO,MAAM;EAEjB;EACA,OAAO,KAAK;CACd;CAEA,UAAmB;EACjB,OAAO,KAAK;CACd;CAEA,iBAA+B;EAC7B,OAAO,gBAAgB,QAAQ,eAAe,KAAK,IAAI,IAAI,UAAU,CAAC;CACxE;CAEA,qBAAsD;EACpD,MAAM,MAAuC,CAAC;EAC9C,KAAK,MAAM,CAAC,IAAI,UAAU,KAAK,SAC7B,IAAI,MAAM,gBAAgB,QAAQ,eAAe,MAAM,YAAY,IAAI,UAAU,CAAC;EAEpF,OAAO;CACT;CAEA,OAAO,IAAyB;EAC9B,IAAI,OAAO,KAAA,KAAa,KAAK,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,MACjD,OAAO;EAET,OAAO,KAAK,QAAQ;CACtB;AACF;AAEA,SAAgB,mBAAmB,EACjC,aACA,OACA,eACoC;CACpC,MAAM,SAAS,cAAc,YAAY,WAAW,IAAI;CACxD,MAAM,SAAS,YAAY,MAAM,QAAQ,IAAI,cAAc,IAAI;CAC/D,MAAM,SAAS,SAAS,MAAM,IAAI,OAAO,OAAO,IAAI,KAAA;CACpD,MAAM,UAAU,QAAQ,OAAO,SAAS,KAAK,IAAI,SAAS,KAAA;CAC1D,MAAM,SAAS,UAAU,YAAY,QAAQ,WAAW,oBAAI,IAAI,IAAgB;CAChF,MAAM,0BAAU,IAAI,IAA6B;CACjD,KAAK,MAAM,OAAO,aAAa;EAC7B,IAAI,IAAI,cAAc,QAAQ,IAAI,gBAAgB,MAChD;EAEF,MAAM,OAAO,MAAM,IAAI,IAAI,OAAO;EAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,SAAS,IAAI,WAAW,GAChD;EAEF,MAAM,OAAO,IAAI;EAEjB,MAAM,WAAW,CAAC,GAAG,YADT,KAAK,YAAY,QAAQ,eAAe,gBAAgB,UAAU,MAAM,IACjD,CAAC,CAAC,CAAC,CAAC,QACpC,eAAe,gBAAgB,UAAU,MAAM,IAClD;EACA,QAAQ,IAAI,IAAI,WAAW;GACzB,aAAa,UAAU,IAAI,IAAI,QAAQ,GAAG,MAAM;GAChD,MAAM,MAAM,IAAI;EAClB,CAAC;CACH;CACA,MAAM,QAAQ,QAAQ,YAAA,WAA8B,YAAY,KAAA;CAChE,OAAO,IAAI,oBACT,UAAU,QAAQ,MAAM,GACxB,UACI,MAAM,OAAO,IACb,MAAM,IAAA,QAAmB,IACvB,MAAM,MAAM,IAAI,eAAe,CAAE,IACjC,YACN,SACA,SAAS,WAAW,IACtB;AACF;AAEA,SAAgB,oBAAyC;CACvD,OAAO,IAAI,oBACT,IAAI,IAAI,eAAe,GACvB;EAAE,KAAK;EAAU,MAAM;EAAU,MAAM;CAAM,mBAC7C,IAAI,IAAI,GACR,KACF;AACF"}
+{"version":3,"file":"effective-permissions.js","names":[],"sources":["../../src/organizations/effective-permissions.ts"],"sourcesContent":["import type { ContentId, ContentType, Permission } from '../types/index.js';\nimport type { EffectivePermissions, RoleRef } from '../shared/actor.js';\nimport { ForbiddenError } from '../shared/errors.js';\nimport { ALL_PERMISSIONS, permissionAbout, withImplied } from './permissions.js';\nimport { MEMBER_ROLE_KEY, OWNER_ROLE_KEY } from './default-roles.js';\nimport type { OrgRole } from './org-roles.js';\n\nexport interface AssignmentRow {\n  roleKey: string;\n  contentId: ContentId | null;\n  contentType: ContentType | null;\n}\n\nexport interface ResolveInput {\n  assignments: readonly AssignmentRow[];\n  roles: ReadonlyMap<string, OrgRole>;\n  tokenScopes?: readonly Permission[];\n}\n\ninterface ContentEntry {\n  permissions: Set<Permission>;\n  role: RoleRef;\n}\n\nconst MEMBER_REF: RoleRef = { key: MEMBER_ROLE_KEY, name: 'Member', team: false };\n\nfunction refOf(role: OrgRole): RoleRef {\n  return { key: role.key, name: role.name, team: role.team };\n}\n\nfunction intersect(set: Set<Permission>, scopes: Set<Permission> | null): Set<Permission> {\n  if (!scopes) {\n    return set;\n  }\n  return new Set([...set].filter((permission) => scopes.has(permission)));\n}\n\nexport class ResolvedPermissions implements EffectivePermissions {\n  constructor(\n    private readonly org: Set<Permission>,\n    private readonly orgRole: RoleRef,\n    private readonly content: Map<ContentId, ContentEntry>,\n    private readonly owner: boolean,\n    private readonly token: boolean,\n  ) {}\n\n  has(permission: Permission, on?: ContentId): boolean {\n    if (this.org.has(permission)) {\n      return true;\n    }\n    return on !== undefined && (this.content.get(on)?.permissions.has(permission) ?? false);\n  }\n\n  require(permission: Permission, on?: ContentId): void {\n    if (!this.has(permission, on)) {\n      throw Object.assign(new ForbiddenError(`You need ${permission}`), {\n        permission,\n        ...(on !== undefined && { contentId: on }),\n      });\n    }\n  }\n\n  anywhere(permission: Permission): boolean {\n    if (this.org.has(permission)) {\n      return true;\n    }\n    for (const entry of this.content.values()) {\n      if (entry.permissions.has(permission)) {\n        return true;\n      }\n    }\n    return false;\n  }\n\n  where(permission: Permission): { org: boolean; content: ContentId[] } {\n    if (this.org.has(permission)) {\n      return { org: true, content: [] };\n    }\n    const content: ContentId[] = [];\n    for (const [id, entry] of this.content) {\n      if (entry.permissions.has(permission)) {\n        content.push(id);\n      }\n    }\n    return { org: false, content };\n  }\n\n  roleOn(on?: ContentId): RoleRef {\n    if (on !== undefined) {\n      const entry = this.content.get(on);\n      if (entry) {\n        return entry.role;\n      }\n    }\n    return this.orgRole;\n  }\n\n  isOwner(): boolean {\n    return this.owner;\n  }\n\n  isToken(): boolean {\n    return this.token;\n  }\n\n  orgPermissions(): Permission[] {\n    return ALL_PERMISSIONS.filter((permission) => this.org.has(permission));\n  }\n\n  contentPermissions(): Record<ContentId, Permission[]> {\n    const out: Record<ContentId, Permission[]> = {};\n    for (const [id, entry] of this.content) {\n      out[id] = ALL_PERMISSIONS.filter((permission) => entry.permissions.has(permission));\n    }\n    return out;\n  }\n\n  teamOn(on?: ContentId): boolean {\n    if (on !== undefined && this.content.get(on)?.role.team) {\n      return true;\n    }\n    return this.orgRole.team;\n  }\n}\n\nexport function resolvePermissions({\n  assignments,\n  roles,\n  tokenScopes,\n}: ResolveInput): ResolvedPermissions {\n  const scopes = tokenScopes ? withImplied(tokenScopes) : null;\n  const orgRow = assignments.find((row) => row.contentId === null);\n  const listed = orgRow ? roles.get(orgRow.roleKey) : undefined;\n  const orgRole = listed?.levels.includes('org') ? listed : undefined;\n  const orgSet = orgRole ? withImplied(orgRole.permissions) : new Set<Permission>();\n  const content = new Map<ContentId, ContentEntry>();\n  for (const row of assignments) {\n    if (row.contentId === null || row.contentType === null) {\n      continue;\n    }\n    const role = roles.get(row.roleKey);\n    if (!role || !role.levels.includes(row.contentType)) {\n      continue;\n    }\n    const type = row.contentType;\n    const own = role.permissions.filter((permission) => permissionAbout(permission) === type);\n    const expanded = [...withImplied(own)].filter(\n      (permission) => permissionAbout(permission) === type,\n    );\n    content.set(row.contentId, {\n      permissions: intersect(new Set(expanded), scopes),\n      role: refOf(role),\n    });\n  }\n  const owner = orgRow?.roleKey === OWNER_ROLE_KEY && orgRole !== undefined;\n  return new ResolvedPermissions(\n    intersect(orgSet, scopes),\n    orgRole\n      ? refOf(orgRole)\n      : roles.get(MEMBER_ROLE_KEY)\n        ? refOf(roles.get(MEMBER_ROLE_KEY)!)\n        : MEMBER_REF,\n    content,\n    owner && scopes === null,\n    scopes !== null,\n  );\n}\n\nexport function systemPermissions(): ResolvedPermissions {\n  return new ResolvedPermissions(\n    new Set(ALL_PERMISSIONS),\n    { key: 'system', name: 'System', team: false },\n    new Map(),\n    false,\n    false,\n  );\n}\n"],"mappings":";;;;AAwBA,MAAM,aAAsB;CAAE,KAAK;CAAiB,MAAM;CAAU,MAAM;AAAM;AAEhF,SAAS,MAAM,MAAwB;CACrC,OAAO;EAAE,KAAK,KAAK;EAAK,MAAM,KAAK;EAAM,MAAM,KAAK;CAAK;AAC3D;AAEA,SAAS,UAAU,KAAsB,QAAiD;CACxF,IAAI,CAAC,QACH,OAAO;CAET,OAAO,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,eAAe,OAAO,IAAI,UAAU,CAAC,CAAC;AACxE;AAEA,IAAa,sBAAb,MAAiE;CAE5C;CACA;CACA;CACA;CACA;CALnB,YACE,KACA,SACA,SACA,OACA,OACA;EALiB,KAAA,MAAA;EACA,KAAA,UAAA;EACA,KAAA,UAAA;EACA,KAAA,QAAA;EACA,KAAA,QAAA;CAChB;CAEH,IAAI,YAAwB,IAAyB;EACnD,IAAI,KAAK,IAAI,IAAI,UAAU,GACzB,OAAO;EAET,OAAO,OAAO,KAAA,MAAc,KAAK,QAAQ,IAAI,EAAE,CAAC,EAAE,YAAY,IAAI,UAAU,KAAK;CACnF;CAEA,QAAQ,YAAwB,IAAsB;EACpD,IAAI,CAAC,KAAK,IAAI,YAAY,EAAE,GAC1B,MAAM,OAAO,OAAO,IAAI,eAAe,YAAY,YAAY,GAAG;GAChE;GACA,GAAI,OAAO,KAAA,KAAa,EAAE,WAAW,GAAG;EAC1C,CAAC;CAEL;CAEA,SAAS,YAAiC;EACxC,IAAI,KAAK,IAAI,IAAI,UAAU,GACzB,OAAO;EAET,KAAK,MAAM,SAAS,KAAK,QAAQ,OAAO,GACtC,IAAI,MAAM,YAAY,IAAI,UAAU,GAClC,OAAO;EAGX,OAAO;CACT;CAEA,MAAM,YAAgE;EACpE,IAAI,KAAK,IAAI,IAAI,UAAU,GACzB,OAAO;GAAE,KAAK;GAAM,SAAS,CAAC;EAAE;EAElC,MAAM,UAAuB,CAAC;EAC9B,KAAK,MAAM,CAAC,IAAI,UAAU,KAAK,SAC7B,IAAI,MAAM,YAAY,IAAI,UAAU,GAClC,QAAQ,KAAK,EAAE;EAGnB,OAAO;GAAE,KAAK;GAAO;EAAQ;CAC/B;CAEA,OAAO,IAAyB;EAC9B,IAAI,OAAO,KAAA,GAAW;GACpB,MAAM,QAAQ,KAAK,QAAQ,IAAI,EAAE;GACjC,IAAI,OACF,OAAO,MAAM;EAEjB;EACA,OAAO,KAAK;CACd;CAEA,UAAmB;EACjB,OAAO,KAAK;CACd;CAEA,UAAmB;EACjB,OAAO,KAAK;CACd;CAEA,iBAA+B;EAC7B,OAAO,gBAAgB,QAAQ,eAAe,KAAK,IAAI,IAAI,UAAU,CAAC;CACxE;CAEA,qBAAsD;EACpD,MAAM,MAAuC,CAAC;EAC9C,KAAK,MAAM,CAAC,IAAI,UAAU,KAAK,SAC7B,IAAI,MAAM,gBAAgB,QAAQ,eAAe,MAAM,YAAY,IAAI,UAAU,CAAC;EAEpF,OAAO;CACT;CAEA,OAAO,IAAyB;EAC9B,IAAI,OAAO,KAAA,KAAa,KAAK,QAAQ,IAAI,EAAE,CAAC,EAAE,KAAK,MACjD,OAAO;EAET,OAAO,KAAK,QAAQ;CACtB;AACF;AAEA,SAAgB,mBAAmB,EACjC,aACA,OACA,eACoC;CACpC,MAAM,SAAS,cAAc,YAAY,WAAW,IAAI;CACxD,MAAM,SAAS,YAAY,MAAM,QAAQ,IAAI,cAAc,IAAI;CAC/D,MAAM,SAAS,SAAS,MAAM,IAAI,OAAO,OAAO,IAAI,KAAA;CACpD,MAAM,UAAU,QAAQ,OAAO,SAAS,KAAK,IAAI,SAAS,KAAA;CAC1D,MAAM,SAAS,UAAU,YAAY,QAAQ,WAAW,oBAAI,IAAI,IAAgB;CAChF,MAAM,0BAAU,IAAI,IAA6B;CACjD,KAAK,MAAM,OAAO,aAAa;EAC7B,IAAI,IAAI,cAAc,QAAQ,IAAI,gBAAgB,MAChD;EAEF,MAAM,OAAO,MAAM,IAAI,IAAI,OAAO;EAClC,IAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,SAAS,IAAI,WAAW,GAChD;EAEF,MAAM,OAAO,IAAI;EAEjB,MAAM,WAAW,CAAC,GAAG,YADT,KAAK,YAAY,QAAQ,eAAe,gBAAgB,UAAU,MAAM,IACjD,CAAC,CAAC,CAAC,CAAC,QACpC,eAAe,gBAAgB,UAAU,MAAM,IAClD;EACA,QAAQ,IAAI,IAAI,WAAW;GACzB,aAAa,UAAU,IAAI,IAAI,QAAQ,GAAG,MAAM;GAChD,MAAM,MAAM,IAAI;EAClB,CAAC;CACH;CACA,MAAM,QAAQ,QAAQ,YAAA,WAA8B,YAAY,KAAA;CAChE,OAAO,IAAI,oBACT,UAAU,QAAQ,MAAM,GACxB,UACI,MAAM,OAAO,IACb,MAAM,IAAA,QAAmB,IACvB,MAAM,MAAM,IAAI,eAAe,CAAE,IACjC,YACN,SACA,SAAS,WAAW,MACpB,WAAW,IACb;AACF;AAEA,SAAgB,oBAAyC;CACvD,OAAO,IAAI,oBACT,IAAI,IAAI,eAAe,GACvB;EAAE,KAAK;EAAU,MAAM;EAAU,MAAM;CAAM,mBAC7C,IAAI,IAAI,GACR,OACA,KACF;AACF"}