@headless-lms/core 0.5.0 → 0.6.0

package/dist/organizations/events.d.ts

@@ -9,6 +9,7 @@ declare const organizationEvents: {
     name: string;
     slug: string;
     ownerId: string;
+    metadata: Record<string, string>;
     createdAt: Date;
     updatedAt: Date;
   }, "organization.created", 1>, {
@@ -17,13 +18,14 @@ declare const organizationEvents: {
     name: string;
     slug: string;
     ownerId: string;
+    metadata: Record<string, string>;
     createdAt: unknown;
     updatedAt: unknown;
   }, z.ZodObject<{
     id: z.ZodString;
-    name: z.ZodString;
     createdAt: z.ZodCoercedDate<unknown>;
     updatedAt: z.ZodCoercedDate<unknown>;
+    name: z.ZodString;
     slug: z.ZodString;
     ownerId: z.ZodString;
   }, z.core.$strip>>;
@@ -33,6 +35,7 @@ declare const organizationEvents: {
     name: string;
     slug: string;
     ownerId: string;
+    metadata: Record<string, string>;
     createdAt: Date;
     updatedAt: Date;
   }, "organization.updated", 1>, {
@@ -41,13 +44,14 @@ declare const organizationEvents: {
     name: string;
     slug: string;
     ownerId: string;
+    metadata: Record<string, string>;
     createdAt: unknown;
     updatedAt: unknown;
   }, z.ZodObject<{
     id: z.ZodString;
-    name: z.ZodString;
     createdAt: z.ZodCoercedDate<unknown>;
     updatedAt: z.ZodCoercedDate<unknown>;
+    name: z.ZodString;
     slug: z.ZodString;
     ownerId: z.ZodString;
   }, z.core.$strip>>;
@@ -57,6 +61,7 @@ declare const organizationEvents: {
     name: string;
     slug: string;
     ownerId: string;
+    metadata: Record<string, string>;
     createdAt: Date;
     updatedAt: Date;
   }, "organization.deleted", 1>, {
@@ -65,13 +70,14 @@ declare const organizationEvents: {
     name: string;
     slug: string;
     ownerId: string;
+    metadata: Record<string, string>;
     createdAt: unknown;
     updatedAt: unknown;
   }, z.ZodObject<{
     id: z.ZodString;
-    name: z.ZodString;
     createdAt: z.ZodCoercedDate<unknown>;
     updatedAt: z.ZodCoercedDate<unknown>;
+    name: z.ZodString;
     slug: z.ZodString;
     ownerId: z.ZodString;
   }, z.core.$strip>>;
@@ -98,12 +104,12 @@ declare const organizationEvents: {
   }, z.ZodObject<{
     orgId: z.ZodString;
     id: z.ZodString;
-    createdAt: z.ZodCoercedDate<unknown>;
-    updatedAt: z.ZodCoercedDate<unknown>;
     status: z.ZodEnum<{
       active: "active";
       invited: "invited";
     }>;
+    createdAt: z.ZodCoercedDate<unknown>;
+    updatedAt: z.ZodCoercedDate<unknown>;
     userId: z.ZodString;
     orgRole: z.ZodObject<{
       key: z.ZodString;
@@ -132,12 +138,12 @@ declare const organizationEvents: {
   }, z.ZodObject<{
     orgId: z.ZodString;
     id: z.ZodString;
-    createdAt: z.ZodCoercedDate<unknown>;
-    updatedAt: z.ZodCoercedDate<unknown>;
     status: z.ZodEnum<{
       active: "active";
       invited: "invited";
     }>;
+    createdAt: z.ZodCoercedDate<unknown>;
+    updatedAt: z.ZodCoercedDate<unknown>;
     userId: z.ZodString;
     orgRole: z.ZodObject<{
       key: z.ZodString;
@@ -166,12 +172,12 @@ declare const organizationEvents: {
   }, z.ZodObject<{
     orgId: z.ZodString;
     id: z.ZodString;
-    createdAt: z.ZodCoercedDate<unknown>;
-    updatedAt: z.ZodCoercedDate<unknown>;
     status: z.ZodEnum<{
       active: "active";
       invited: "invited";
     }>;
+    createdAt: z.ZodCoercedDate<unknown>;
+    updatedAt: z.ZodCoercedDate<unknown>;
     userId: z.ZodString;
     orgRole: z.ZodObject<{
       key: z.ZodString;
@@ -202,18 +208,18 @@ declare const organizationEvents: {
   }, z.ZodObject<{
     orgId: z.ZodString;
     id: z.ZodString;
-    createdAt: z.ZodCoercedDate<unknown>;
-    updatedAt: z.ZodCoercedDate<unknown>;
     status: z.ZodEnum<{
       pending: "pending";
       canceled: "canceled";
       accepted: "accepted";
       rejected: "rejected";
     }>;
-    expiresAt: z.ZodNullable<z.ZodCoercedDate<unknown>>;
+    createdAt: z.ZodCoercedDate<unknown>;
+    updatedAt: z.ZodCoercedDate<unknown>;
     email: z.ZodEmail;
-    invitedBy: z.ZodString;
+    expiresAt: z.ZodNullable<z.ZodCoercedDate<unknown>>;
     roleKey: z.ZodString;
+    invitedBy: z.ZodString;
   }, z.core.$strip>>;
   inviteAccepted: RuntimeEventDefinition<VersionedDomainEvent<{
     id: string;
@@ -240,18 +246,18 @@ declare const organizationEvents: {
   }, z.ZodObject<{
     orgId: z.ZodString;
     id: z.ZodString;
-    createdAt: z.ZodCoercedDate<unknown>;
-    updatedAt: z.ZodCoercedDate<unknown>;
     status: z.ZodEnum<{
       pending: "pending";
       canceled: "canceled";
       accepted: "accepted";
       rejected: "rejected";
     }>;
-    expiresAt: z.ZodNullable<z.ZodCoercedDate<unknown>>;
+    createdAt: z.ZodCoercedDate<unknown>;
+    updatedAt: z.ZodCoercedDate<unknown>;
     email: z.ZodEmail;
-    invitedBy: z.ZodString;
+    expiresAt: z.ZodNullable<z.ZodCoercedDate<unknown>>;
     roleKey: z.ZodString;
+    invitedBy: z.ZodString;
   }, z.core.$strip>>;
   inviteCanceled: RuntimeEventDefinition<VersionedDomainEvent<{
     id: string;
@@ -293,12 +299,12 @@ declare const organizationEvents: {
   }, z.ZodObject<{
     orgId: z.ZodString;
     id: z.ZodString;
-    createdAt: z.ZodCoercedDate<unknown>;
-    updatedAt: z.ZodCoercedDate<unknown>;
     status: z.ZodEnum<{
       active: "active";
       invited: "invited";
     }>;
+    createdAt: z.ZodCoercedDate<unknown>;
+    updatedAt: z.ZodCoercedDate<unknown>;
     userId: z.ZodString;
   }, z.core.$strip>>;
   studentDeleted: RuntimeEventDefinition<VersionedDomainEvent<{
@@ -318,12 +324,12 @@ declare const organizationEvents: {
   }, z.ZodObject<{
     orgId: z.ZodString;
     id: z.ZodString;
-    createdAt: z.ZodCoercedDate<unknown>;
-    updatedAt: z.ZodCoercedDate<unknown>;
     status: z.ZodEnum<{
       active: "active";
       invited: "invited";
     }>;
+    createdAt: z.ZodCoercedDate<unknown>;
+    updatedAt: z.ZodCoercedDate<unknown>;
     userId: z.ZodString;
   }, z.core.$strip>>;
   roleUpdated: RuntimeEventDefinition<VersionedDomainEvent<{
@@ -512,12 +518,12 @@ declare const organizationEvents: {
   }, z.ZodObject<{
     orgId: z.ZodString;
     id: z.ZodString;
-    createdAt: z.ZodCoercedDate<unknown>;
-    updatedAt: z.ZodCoercedDate<unknown>;
     status: z.ZodEnum<{
       active: "active";
       invited: "invited";
     }>;
+    createdAt: z.ZodCoercedDate<unknown>;
+    updatedAt: z.ZodCoercedDate<unknown>;
     userId: z.ZodString;
   }, z.core.$strip>>;
 };

package/dist/organizations/index.d.ts

@@ -1,4 +1,4 @@
-import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, NewOrganizationInput, OrgUser, OrgUserStatus, Organization, UpdateOrgUserInput } from "../types/schemas/organizations.js";
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, NewOrganizationInput, OrgUser, OrgUserStatus, Organization, OrganizationMetadata, UpdateOrgUserInput } from "../types/schemas/organizations.js";
 import { InviteId, OrgUserId, OrganizationId } from "../types/organizations.js";
 import { AuthHeaders } from "../identity/ports.js";
 import { DEFAULT_ROLES, MEMBER_ROLE_KEY, OWNER_ROLE_KEY, RoleDefinition, RoleSetError, defaultHolders, validateRoleSet } from "./default-roles.js";
@@ -14,4 +14,4 @@ import { InviteUrls, OrganizationServiceImpl, OrganizationServiceParams } from "
 import { OrgNotificationCategories } from "./notification-categories.js";
 import { NotificationCatalog, NotificationCatalogParams, NotificationCatalogService } from "./notification-catalog.js";
 import { ActorShape, actorWith } from "./testing.js";
-export { ALL_PERMISSIONS, type AcceptInviteInput, type Accounts, type ActorFacts, type ActorShape, type AddOrgUserInput, type ApiKeyRole, type ApiKeys, type AssignmentRow, type AssignmentView, type AuthHeaders, type AuthOrganization, type CallerFacts, type CallerLimit, type CreateApiKeyInput, type CreateInviteInput, type CreateOrgUserInput, type CreateOrganizationInput, type CreateRoleInput, DEFAULT_ROLES, type GrantReader, type Invite, type InviteAccepted, type InviteCanceled, type InviteCreated, type InviteDetails, InviteError, type InviteId, type InviteUrls, type ItemRole, MEMBER_ROLE_KEY, type Member, type MemberStatus, type MembersQuery, type MembersRepository, type NewApiKey, type NewInviteRow, type NewOrganizationInput, type NewOrganizationRow, NotificationCatalog, type NotificationCatalogParams, type NotificationCatalogService, OWNER_ROLE_KEY, type OrgAdmin, OrgNotificationCategories, type OrgRole, type OrgUser, type OrgUserDeleted, type OrgUserId, type OrgUserLinked, type OrgUserStatus, type OrgUserUpdated, type Organization, type OrganizationCreated, type OrganizationDeleted, type OrganizationEvent, type OrganizationId, OrganizationRuleError, type OrganizationService, OrganizationServiceImpl, type OrganizationServiceParams, type OrganizationUpdated, type OrganizationsRepository, type OrganizationsUnitOfWork, type OrganizationsWriteScope, type OwnershipTransferred, PERMISSIONS, type Page, type PermissionDefinition, type PermissionGroup, type PermissionListEntry, type PlatformAccount, type PlatformOrganization, type PlatformOrganizationInput, type ResolveInput, type ResolvedCaller, ResolvedPermissions, type RoleAssigned, type RoleCatalog, type RoleCreated, type RoleDefinition, type RoleDeleted, RoleSetError, type RoleUnassigned, type RoleUpdated, type RoleView, type RolesRepository, type StoredApiKey, type StoredOrgRole, type StudentCreated, type StudentDeleted, type StudentLinked, type TeamRow, type TransferOwnershipInput, type UpdateOrgUserInput, type UpdateOrganizationInput, type UpdateRoleInput, type ViewerPermissions, actorWith, catalogOf, defaultHolders, fitsLevels, isPermission, isSystemRole, organizationEvents, permissionList, resolveOrgRoles, resolvePermissions, resolveRole, systemPermissions, validateRoleSet, withImplied };
+export { ALL_PERMISSIONS, type AcceptInviteInput, type Accounts, type ActorFacts, type ActorShape, type AddOrgUserInput, type ApiKeyRole, type ApiKeys, type AssignmentRow, type AssignmentView, type AuthHeaders, type AuthOrganization, type CallerFacts, type CallerLimit, type CreateApiKeyInput, type CreateInviteInput, type CreateOrgUserInput, type CreateOrganizationInput, type CreateRoleInput, DEFAULT_ROLES, type GrantReader, type Invite, type InviteAccepted, type InviteCanceled, type InviteCreated, type InviteDetails, InviteError, type InviteId, type InviteUrls, type ItemRole, MEMBER_ROLE_KEY, type Member, type MemberStatus, type MembersQuery, type MembersRepository, type NewApiKey, type NewInviteRow, type NewOrganizationInput, type NewOrganizationRow, NotificationCatalog, type NotificationCatalogParams, type NotificationCatalogService, OWNER_ROLE_KEY, type OrgAdmin, OrgNotificationCategories, type OrgRole, type OrgUser, type OrgUserDeleted, type OrgUserId, type OrgUserLinked, type OrgUserStatus, type OrgUserUpdated, type Organization, type OrganizationCreated, type OrganizationDeleted, type OrganizationEvent, type OrganizationId, type OrganizationMetadata, OrganizationRuleError, type OrganizationService, OrganizationServiceImpl, type OrganizationServiceParams, type OrganizationUpdated, type OrganizationsRepository, type OrganizationsUnitOfWork, type OrganizationsWriteScope, type OwnershipTransferred, PERMISSIONS, type Page, type PermissionDefinition, type PermissionGroup, type PermissionListEntry, type PlatformAccount, type PlatformOrganization, type PlatformOrganizationInput, type ResolveInput, type ResolvedCaller, ResolvedPermissions, type RoleAssigned, type RoleCatalog, type RoleCreated, type RoleDefinition, type RoleDeleted, RoleSetError, type RoleUnassigned, type RoleUpdated, type RoleView, type RolesRepository, type StoredApiKey, type StoredOrgRole, type StudentCreated, type StudentDeleted, type StudentLinked, type TeamRow, type TransferOwnershipInput, type UpdateOrgUserInput, type UpdateOrganizationInput, type UpdateRoleInput, type ViewerPermissions, actorWith, catalogOf, defaultHolders, fitsLevels, isPermission, isSystemRole, organizationEvents, permissionList, resolveOrgRoles, resolvePermissions, resolveRole, systemPermissions, validateRoleSet, withImplied };

package/dist/organizations/model.d.ts

@@ -1,3 +1,3 @@
-import { Invite, OrgUser, Organization } from "../types/schemas/organizations.js";
+import { Invite, OrgUser, Organization, OrganizationMetadata } from "../types/schemas/organizations.js";
 import "../types/index.js";
-export type { Invite, OrgUser, Organization };
+export type { Invite, OrgUser, Organization, OrganizationMetadata };

package/dist/organizations/notification-categories.js

@@ -1,5 +1,5 @@
-import { noopLogger } from "../shared/logger.js";
 import { NotFoundError } from "../shared/errors.js";
+import { noopLogger } from "../shared/logger.js";
 import "../shared/settings.js";
 import { assertValidCategoryList, offeringConfigured, storedCategoryList } from "../shared/notification-categories.js";
 //#region src/organizations/notification-categories.ts

package/dist/organizations/ports.d.ts

@@ -1,6 +1,6 @@
 import { ContentType } from "../types/schemas/content.js";
 import { ApiKeySummary, ConnectedApp, CreatedApiKey } from "../types/identity.js";
-import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, NewOrganizationInput, OrgUser, OrgUserProfile, Organization, Permission, RoleAssignment, UpdateOrgUserInput } from "../types/schemas/organizations.js";
+import { AcceptInviteInput, AddOrgUserInput, CreateInviteInput, CreateOrgUserInput, Invite, NewOrganizationInput, OrgUser, OrgUserProfile, Organization, OrganizationMetadata, Permission, RoleAssignment, UpdateOrgUserInput } from "../types/schemas/organizations.js";
 import "../types/index.js";
 import { Actor, EffectivePermissions } from "../shared/actor.js";
 import { OutboxAppender, UnitOfWork } from "../shared/ports.js";
@@ -35,10 +35,12 @@ type CallerLimit = {
 interface PlatformOrganizationInput {
   name: string;
   slug: string;
-  keyName?: string | undefined;
+  metadata?: OrganizationMetadata | undefined;
 }
 interface PlatformOrganization {
-  organization: AuthOrganization;
+  organization: AuthOrganization & {
+    metadata: OrganizationMetadata;
+  };
   apiKey: CreatedApiKey;
 }
 interface PlatformAccount {
@@ -170,6 +172,7 @@ interface OrganizationsRepository {
   listIds(): Promise<string[]>;
   findByExternalId(externalId: string): Promise<Organization | null>;
   findBySlug(slug: string): Promise<Organization | null>;
+  setMetadata(id: string, metadata: OrganizationMetadata): Promise<Organization>;
   upsertPendingInvite(orgId: string, input: NewInviteRow): Promise<Invite>;
   setInviteStatus(orgId: string, id: string, status: string): Promise<Invite | null>;
   setInviteRole(orgId: string, id: string, roleKey: string, invitedBy: string): Promise<Invite | null>;

package/dist/organizations/service.d.ts

@@ -25,7 +25,7 @@ type OrganizationServiceParams = {
   roles: RolesRepository;
   membersRepo: MembersRepository;
   people: IdentityService;
-  images: Pick<AssetFiles, 'syncPublicImage'>;
+  images: Pick<AssetFiles, 'syncPublicImages'>;
   uow: OrganizationsUnitOfWork;
   orgAdmin: () => OrgAdmin;
   sessions: () => SessionAdmin;

package/dist/organizations/service.js

@@ -1,7 +1,7 @@
 import { levelSchema } from "../types/schemas/organizations.js";
-import { noopLogger } from "../shared/logger.js";
-import { ForbiddenError, NotFoundError } from "../shared/errors.js";
 import { genId, prefixId } from "../shared/id.js";
+import { ForbiddenError, NotFoundError } from "../shared/errors.js";
+import { noopLogger } from "../shared/logger.js";
 import { InviteError, OrganizationRuleError } from "./members.js";
 import { organizationEvents } from "./events.js";
 import { generateInviteToken, hashInviteToken } from "../shared/invite-token.js";
@@ -1097,6 +1097,13 @@ var OrganizationServiceImpl = class {
 	}
 	async createApiKey(input, actor) {
 		actor.permissions.require("api_keys:write");
+		if (actor.permissions.isToken()) {
+			this.logger.warn("api key refused: caller is a key or an app token", {
+				orgId: actor.orgId,
+				actorId: actor.id
+			});
+			throw new ForbiddenError("Sign in to create an API key");
+		}
 		const roles = this.roleMap(await this.roles.storedRoles(actor.orgId));
 		const role = roles.get(input.role);
 		if (!role) throw new NotFoundError("Role", input.role);
@@ -1156,9 +1163,10 @@ var OrganizationServiceImpl = class {
 			name: input.name,
 			slug: input.slug
 		});
-		const org = await this.repo.findByExternalId(created.id);
-		if (!org) throw new NotFoundError("Organization", created.id);
-		const apiKey = await this.platformKey(org, ownerExternalId, input.keyName ?? "Platform");
+		const found = await this.repo.findByExternalId(created.id);
+		if (!found) throw new NotFoundError("Organization", created.id);
+		const org = await this.repo.setMetadata(found.id, input.metadata ?? {});
+		const apiKey = await this.platformKey(org, ownerExternalId, "Platform");
 		this.logger.info("platform organization created", {
 			orgId: org.id,
 			slug: org.slug
@@ -1168,6 +1176,7 @@ var OrganizationServiceImpl = class {
 				id: org.id,
 				name: org.name,
 				slug: org.slug,
+				metadata: org.metadata,
 				createdAt: org.createdAt
 			},
 			apiKey
@@ -1228,7 +1237,7 @@ var OrganizationServiceImpl = class {
 			steps.push(["membership", () => this.orgAdmin().removeMembership(orgExternalId, userExternalId)]);
 			steps.push(["api keys and tokens", () => this.apiKeys().revokeAllFor(orgExternalId, userExternalId)]);
 		}
-		steps.push(["profile photo", () => this.images.syncPublicImage(orgId, orgUserId, null)]);
+		steps.push(["profile photo", () => this.images.syncPublicImages(orgId, orgUserId, [])]);
 		if (person) steps.push(["pending invite", async () => {
 			const pending = await this.repo.findPendingInvite(orgId, person.email);
 			if (pending) await this.repo.setInviteStatus(orgId, pending.id, "canceled");
@@ -1385,7 +1394,8 @@ var OrganizationServiceImpl = class {
 				anywhere: (p) => fresh.anywhere(p) && actor.permissions.anywhere(p),
 				where: (p) => actor.permissions.where(p),
 				roleOn: (on) => fresh.roleOn(on),
-				isOwner: () => fresh.isOwner() && actor.permissions.isOwner()
+				isOwner: () => fresh.isOwner() && actor.permissions.isOwner(),
+				isToken: () => actor.permissions.isToken()
 			}
 		};
 	}