@hilbras/keystone 1.1.0

package/dist/repositories/index.d.ts

@@ -0,0 +1,10 @@
+export * from "./types.js";
+export { DrizzleUserRepository, DrizzleIdentityRepository } from "./user.js";
+export { DrizzleOrganizationRepository } from "./organization.js";
+export { DrizzleApplicationRepository } from "./application.js";
+export { DrizzleAuditRepository } from "./audit.js";
+export { DrizzlePermissionRepository } from "./permission.js";
+export { DrizzleApiKeyRepository, type ApiKeyRepository } from "./apiKey.js";
+export { DrizzleSamlConnectionRepository, type SamlConnectionRepository } from "./samlConnection.js";
+export { DrizzleOidcConnectionRepository, type OidcConnectionRepository } from "./oidcConnection.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/repositories/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/repositories/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAE,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,+BAA+B,EAAE,KAAK,wBAAwB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/repositories/index.js

@@ -0,0 +1,10 @@
+export * from "./types.js";
+export { DrizzleUserRepository, DrizzleIdentityRepository } from "./user.js";
+export { DrizzleOrganizationRepository } from "./organization.js";
+export { DrizzleApplicationRepository } from "./application.js";
+export { DrizzleAuditRepository } from "./audit.js";
+export { DrizzlePermissionRepository } from "./permission.js";
+export { DrizzleApiKeyRepository } from "./apiKey.js";
+export { DrizzleSamlConnectionRepository } from "./samlConnection.js";
+export { DrizzleOidcConnectionRepository } from "./oidcConnection.js";
+//# sourceMappingURL=index.js.map

package/dist/repositories/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/repositories/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,OAAO,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAyB,MAAM,aAAa,CAAC;AAC7E,OAAO,EAAE,+BAA+B,EAAiC,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,+BAA+B,EAAiC,MAAM,qBAAqB,CAAC"}

package/dist/repositories/oidcConnection.d.ts

@@ -0,0 +1,131 @@
+import { type OidcConnection } from "../db/schema.js";
+export type OidcConnectionListItem = {
+    id: string;
+    name: string;
+    issuer: string;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    userinfoEndpoint: string | null;
+    jwksUri: string | null;
+    clientId: string;
+    scopes: string[];
+    isActive: boolean;
+    createdAt: Date;
+};
+export interface OidcConnectionRepository {
+    listByOrgId(orgId: string): Promise<OidcConnectionListItem[]>;
+    findById(id: string): Promise<OidcConnection | undefined>;
+    findActiveById(id: string): Promise<OidcConnection | undefined>;
+    create(input: {
+        orgId: string;
+        name: string;
+        issuer: string;
+        authorizationEndpoint: string;
+        tokenEndpoint: string;
+        userinfoEndpoint?: string;
+        jwksUri?: string;
+        clientId: string;
+        clientSecret: string;
+        scopes?: string[];
+        attributeMapping?: Record<string, unknown>;
+        isActive?: boolean;
+    }): Promise<OidcConnection>;
+    deleteByIdAndOrgId(id: string, orgId: string): Promise<OidcConnection | undefined>;
+}
+export declare class DrizzleOidcConnectionRepository implements OidcConnectionRepository {
+    listByOrgId(orgId: string): Promise<{
+        id: string;
+        name: string;
+        issuer: string;
+        authorizationEndpoint: string;
+        tokenEndpoint: string;
+        userinfoEndpoint: string | null;
+        jwksUri: string | null;
+        clientId: string;
+        scopes: string[];
+        isActive: boolean;
+        createdAt: Date;
+    }[]>;
+    findById(id: string): Promise<{
+        id: string;
+        name: string;
+        createdAt: Date;
+        updatedAt: Date;
+        orgId: string;
+        clientId: string;
+        isActive: boolean;
+        scopes: string[];
+        attributeMapping: unknown;
+        issuer: string;
+        authorizationEndpoint: string;
+        tokenEndpoint: string;
+        userinfoEndpoint: string | null;
+        jwksUri: string | null;
+        clientSecret: string;
+    }>;
+    findActiveById(id: string): Promise<{
+        id: string;
+        name: string;
+        createdAt: Date;
+        updatedAt: Date;
+        orgId: string;
+        clientId: string;
+        isActive: boolean;
+        scopes: string[];
+        attributeMapping: unknown;
+        issuer: string;
+        authorizationEndpoint: string;
+        tokenEndpoint: string;
+        userinfoEndpoint: string | null;
+        jwksUri: string | null;
+        clientSecret: string;
+    }>;
+    create(input: {
+        orgId: string;
+        name: string;
+        issuer: string;
+        authorizationEndpoint: string;
+        tokenEndpoint: string;
+        userinfoEndpoint?: string;
+        jwksUri?: string;
+        clientId: string;
+        clientSecret: string;
+        scopes?: string[];
+        attributeMapping?: Record<string, unknown>;
+        isActive?: boolean;
+    }): Promise<{
+        id: string;
+        name: string;
+        createdAt: Date;
+        updatedAt: Date;
+        orgId: string;
+        clientId: string;
+        isActive: boolean;
+        scopes: string[];
+        attributeMapping: unknown;
+        issuer: string;
+        authorizationEndpoint: string;
+        tokenEndpoint: string;
+        userinfoEndpoint: string | null;
+        jwksUri: string | null;
+        clientSecret: string;
+    }>;
+    deleteByIdAndOrgId(id: string, orgId: string): Promise<{
+        id: string;
+        name: string;
+        createdAt: Date;
+        updatedAt: Date;
+        orgId: string;
+        clientId: string;
+        isActive: boolean;
+        scopes: string[];
+        attributeMapping: unknown;
+        issuer: string;
+        authorizationEndpoint: string;
+        tokenEndpoint: string;
+        userinfoEndpoint: string | null;
+        jwksUri: string | null;
+        clientSecret: string;
+    }>;
+}
+//# sourceMappingURL=oidcConnection.d.ts.map

package/dist/repositories/oidcConnection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcConnection.d.ts","sourceRoot":"","sources":["../../src/repositories/oidcConnection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEvE,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC1D,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,EAAE;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,qBAAqB,EAAE,MAAM,CAAC;QAC9B,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;CACpF;AAED,qBAAa,+BAAgC,YAAW,wBAAwB;IACxE,WAAW,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;;;;IAmBzB,QAAQ,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;;;;;;;IAKnB,cAAc,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;;;;;;;IAKzB,MAAM,CAAC,KAAK,EAAE;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,qBAAqB,EAAE,MAAM,CAAC;QAC9B,aAAa,EAAE,MAAM,CAAC;QACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;QAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB;;;;;;;;;;;;;;;;;IAqBK,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;;;;;;;;CAOnD"}

package/dist/repositories/oidcConnection.js

@@ -0,0 +1,59 @@
+import { eq, and } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { oidcConnections } from "../db/schema.js";
+export class DrizzleOidcConnectionRepository {
+    async listByOrgId(orgId) {
+        return db
+            .select({
+            id: oidcConnections.id,
+            name: oidcConnections.name,
+            issuer: oidcConnections.issuer,
+            authorizationEndpoint: oidcConnections.authorizationEndpoint,
+            tokenEndpoint: oidcConnections.tokenEndpoint,
+            userinfoEndpoint: oidcConnections.userinfoEndpoint,
+            jwksUri: oidcConnections.jwksUri,
+            clientId: oidcConnections.clientId,
+            scopes: oidcConnections.scopes,
+            isActive: oidcConnections.isActive,
+            createdAt: oidcConnections.createdAt,
+        })
+            .from(oidcConnections)
+            .where(eq(oidcConnections.orgId, orgId));
+    }
+    async findById(id) {
+        const [connection] = await db.select().from(oidcConnections).where(eq(oidcConnections.id, id)).limit(1);
+        return connection;
+    }
+    async findActiveById(id) {
+        const [connection] = await db.select().from(oidcConnections).where(and(eq(oidcConnections.id, id), eq(oidcConnections.isActive, true))).limit(1);
+        return connection;
+    }
+    async create(input) {
+        const [connection] = await db
+            .insert(oidcConnections)
+            .values({
+            orgId: input.orgId,
+            name: input.name,
+            issuer: input.issuer,
+            authorizationEndpoint: input.authorizationEndpoint,
+            tokenEndpoint: input.tokenEndpoint,
+            userinfoEndpoint: input.userinfoEndpoint,
+            jwksUri: input.jwksUri,
+            clientId: input.clientId,
+            clientSecret: input.clientSecret,
+            scopes: input.scopes ?? ["openid", "profile", "email"],
+            attributeMapping: input.attributeMapping ?? {},
+            isActive: input.isActive ?? true,
+        })
+            .returning();
+        return connection;
+    }
+    async deleteByIdAndOrgId(id, orgId) {
+        const [record] = await db
+            .delete(oidcConnections)
+            .where(and(eq(oidcConnections.id, id), eq(oidcConnections.orgId, orgId)))
+            .returning();
+        return record;
+    }
+}
+//# sourceMappingURL=oidcConnection.js.map

package/dist/repositories/oidcConnection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidcConnection.js","sourceRoot":"","sources":["../../src/repositories/oidcConnection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAuB,MAAM,iBAAiB,CAAC;AAqCvE,MAAM,OAAO,+BAA+B;IAC1C,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,EAAE;aACN,MAAM,CAAC;YACN,EAAE,EAAE,eAAe,CAAC,EAAE;YACtB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,MAAM,EAAE,eAAe,CAAC,MAAM;YAC9B,qBAAqB,EAAE,eAAe,CAAC,qBAAqB;YAC5D,aAAa,EAAE,eAAe,CAAC,aAAa;YAC5C,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;YAClD,OAAO,EAAE,eAAe,CAAC,OAAO;YAChC,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,MAAM,EAAE,eAAe,CAAC,MAAM;YAC9B,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,SAAS,EAAE,eAAe,CAAC,SAAS;SACrC,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxG,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjJ,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAaZ;QACC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;YAClD,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YACtD,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAE;YAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;SACjC,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU,EAAE,KAAa;QAChD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aACxE,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/repositories/organization.d.ts

@@ -0,0 +1,44 @@
+import { type Organization, type OrgMembership } from "../db/schema.js";
+import type { CreateOrganizationInput, OrganizationRepository } from "./types.js";
+export type { OrganizationRepository } from "./types.js";
+export declare class DrizzleOrganizationRepository implements OrganizationRepository {
+    private slugify;
+    create(input: CreateOrganizationInput): Promise<Organization>;
+    findById(id: string): Promise<Organization | undefined>;
+    findBySlug(slug: string): Promise<Organization | undefined>;
+    listAll(): Promise<Organization[]>;
+    update(id: string, input: {
+        name?: string;
+        branding?: Record<string, unknown>;
+    }): Promise<Organization | undefined>;
+    countMembers(orgId: string): Promise<number>;
+    listByUserId(userId: string): Promise<Organization[]>;
+    addMembership(input: {
+        orgId: string;
+        userId: string;
+        role: string;
+    }): Promise<OrgMembership>;
+    findMembership(orgId: string, userId: string): Promise<OrgMembership | undefined>;
+    updateMembershipRole(orgId: string, userId: string, role: string): Promise<OrgMembership | undefined>;
+    removeMembership(orgId: string, userId: string): Promise<boolean>;
+    countOwners(orgId: string): Promise<number>;
+    listMembers(orgId: string): Promise<{
+        membership: {
+            id: string;
+            createdAt: Date;
+            updatedAt: Date;
+            role: string;
+            userId: string;
+            orgId: string;
+        };
+        user: {
+            id: string;
+            name: string | null;
+            email: string;
+            username: string;
+            avatarUrl: string | null;
+        };
+    }[]>;
+    private ensureUniqueSlug;
+}
+//# sourceMappingURL=organization.d.ts.map

package/dist/repositories/organization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../src/repositories/organization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAwC,KAAK,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC9G,OAAO,KAAK,EAAE,uBAAuB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAElF,YAAY,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAEzD,qBAAa,6BAA8B,YAAW,sBAAsB;IAC1E,OAAO,CAAC,OAAO;IAST,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC;IAe7D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAKvD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAK3D,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAIlC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IAanH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ5C,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IASrD,aAAa,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAqB7F,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IASjF,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;IAS/B,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQjE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ3C,WAAW,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;;;;;;;;YAiBjB,gBAAgB;CAc/B"}

package/dist/repositories/organization.js

@@ -0,0 +1,145 @@
+import { eq, and, sql } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { organizations, orgMemberships, users } from "../db/schema.js";
+export class DrizzleOrganizationRepository {
+    slugify(name) {
+        return name
+            .toLowerCase()
+            .trim()
+            .replace(/[^a-z0-9]+/g, "-")
+            .replace(/^-+|-+$/g, "")
+            .slice(0, 64);
+    }
+    async create(input) {
+        const baseSlug = input.slug || this.slugify(input.name);
+        const slug = await this.ensureUniqueSlug(baseSlug);
+        const [org] = await db
+            .insert(organizations)
+            .values({
+            name: input.name,
+            slug,
+            plan: input.plan || "free",
+        })
+            .returning();
+        return org;
+    }
+    async findById(id) {
+        const [org] = await db.select().from(organizations).where(eq(organizations.id, id)).limit(1);
+        return org;
+    }
+    async findBySlug(slug) {
+        const [org] = await db.select().from(organizations).where(eq(organizations.slug, slug)).limit(1);
+        return org;
+    }
+    async listAll() {
+        return db.select().from(organizations).orderBy(organizations.createdAt);
+    }
+    async update(id, input) {
+        const [updated] = await db
+            .update(organizations)
+            .set({
+            ...(input.name !== undefined ? { name: input.name } : {}),
+            ...(input.branding !== undefined ? { branding: input.branding } : {}),
+            updatedAt: new Date(),
+        })
+            .where(eq(organizations.id, id))
+            .returning();
+        return updated;
+    }
+    async countMembers(orgId) {
+        const [countRow] = await db
+            .select({ count: sql `count(*)`.mapWith(Number) })
+            .from(orgMemberships)
+            .where(eq(orgMemberships.orgId, orgId));
+        return countRow?.count ?? 0;
+    }
+    async listByUserId(userId) {
+        const rows = await db
+            .select({ org: organizations })
+            .from(orgMemberships)
+            .where(eq(orgMemberships.userId, userId))
+            .innerJoin(organizations, eq(orgMemberships.orgId, organizations.id));
+        return rows.map((r) => r.org);
+    }
+    async addMembership(input) {
+        const [membership] = await db
+            .insert(orgMemberships)
+            .values({
+            orgId: input.orgId,
+            userId: input.userId,
+            role: input.role,
+        })
+            .onConflictDoNothing({ target: [orgMemberships.orgId, orgMemberships.userId] })
+            .returning();
+        if (membership)
+            return membership;
+        const [existing] = await db
+            .select()
+            .from(orgMemberships)
+            .where(and(eq(orgMemberships.orgId, input.orgId), eq(orgMemberships.userId, input.userId)))
+            .limit(1);
+        return existing;
+    }
+    async findMembership(orgId, userId) {
+        const [membership] = await db
+            .select()
+            .from(orgMemberships)
+            .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+            .limit(1);
+        return membership;
+    }
+    async updateMembershipRole(orgId, userId, role) {
+        const [updated] = await db
+            .update(orgMemberships)
+            .set({ role, updatedAt: sql `now()` })
+            .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+            .returning();
+        return updated;
+    }
+    async removeMembership(orgId, userId) {
+        const deleted = await db
+            .delete(orgMemberships)
+            .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+            .returning();
+        return deleted.length > 0;
+    }
+    async countOwners(orgId) {
+        const rows = await db
+            .select({ count: sql `count(*)`.mapWith(Number) })
+            .from(orgMemberships)
+            .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.role, "owner")));
+        return rows[0]?.count ?? 0;
+    }
+    async listMembers(orgId) {
+        return db
+            .select({
+            membership: orgMemberships,
+            user: {
+                id: users.id,
+                email: users.email,
+                username: users.username,
+                name: users.name,
+                avatarUrl: users.avatarUrl,
+            },
+        })
+            .from(orgMemberships)
+            .where(eq(orgMemberships.orgId, orgId))
+            .innerJoin(users, eq(orgMemberships.userId, users.id));
+    }
+    async ensureUniqueSlug(base) {
+        let slug = base || "org";
+        let counter = 2;
+        while (true) {
+            const existing = await db
+                .select({ id: organizations.id })
+                .from(organizations)
+                .where(eq(organizations.slug, slug))
+                .limit(1);
+            if (existing.length === 0)
+                return slug;
+            slug = `${base}-${counter}`;
+            counter++;
+        }
+    }
+}
+//# sourceMappingURL=organization.js.map

package/dist/repositories/organization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.js","sourceRoot":"","sources":["../../src/repositories/organization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,KAAK,EAAyC,MAAM,iBAAiB,CAAC;AAK9G,MAAM,OAAO,6BAA6B;IAChC,OAAO,CAAC,IAAY;QAC1B,OAAO,IAAI;aACR,WAAW,EAAE;aACb,IAAI,EAAE;aACN,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;aAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;aACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAA8B;QACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAEnD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,aAAa,CAAC;aACrB,MAAM,CAAC;YACN,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,IAAI;YACJ,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,MAAM;SAC3B,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjG,OAAO,GAAG,CAAC;IACb,CAAC;IAED,KAAK,CAAC,OAAO;QACX,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1E,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAA4D;QACnF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,aAAa,CAAC;aACrB,GAAG,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;aACD,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aAC/B,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;aACxD,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1C,OAAO,QAAQ,EAAE,KAAK,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;aAC9B,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACxC,SAAS,CAAC,aAAa,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAsD;QACxE,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC;aACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;aAC9E,SAAS,EAAE,CAAC;QAEf,IAAI,UAAU;YAAE,OAAO,UAAU,CAAC;QAElC,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;aAC1F,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,MAAc;QAChD,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,EAAE;aACR,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC9E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAa,EACb,MAAc,EACd,IAAY;QAEZ,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,cAAc,CAAC;aACtB,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aACpC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC9E,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,MAAc;QAClD,MAAM,OAAO,GAAG,MAAM,EAAE;aACrB,MAAM,CAAC,cAAc,CAAC;aACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aAC9E,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;aACxD,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,EAAE;aACN,MAAM,CAAC;YACN,UAAU,EAAE,cAAc;YAC1B,IAAI,EAAE;gBACJ,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B;SACF,CAAC;aACD,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;aACtC,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAY;QACzC,IAAI,IAAI,GAAG,IAAI,IAAI,KAAK,CAAC;QACzB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,EAAE;iBACtB,MAAM,CAAC,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE,CAAC;iBAChC,IAAI,CAAC,aAAa,CAAC;iBACnB,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;iBACnC,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvC,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF"}

package/dist/repositories/permission.d.ts

@@ -0,0 +1,24 @@
+import { type Permission } from "../db/schema.js";
+import type { PermissionRepository } from "./types.js";
+export declare class DrizzlePermissionRepository implements PermissionRepository {
+    ensureSeeded(): Promise<void>;
+    ensureRolePermissionsSeeded(): Promise<void>;
+    list(): Promise<Permission[]>;
+    listDistinctRoles(): Promise<string[]>;
+    create(input: {
+        resource: string;
+        action: string;
+        description?: string;
+    }): Promise<Permission>;
+    remove(id: string): Promise<Permission | undefined>;
+    listForRole(role: string): Promise<Permission[]>;
+    listKeysForRole(role: string): Promise<Set<string>>;
+    assignToRole(role: string, permissionId: string): Promise<void>;
+    removeFromRole(role: string, permissionId: string): Promise<void>;
+    hasPermission(role: string, resource: string, action: string): Promise<boolean>;
+    hasAnyPermission(role: string, required: {
+        resource: string;
+        action: string;
+    }[]): Promise<boolean>;
+}
+//# sourceMappingURL=permission.d.ts.map

package/dist/repositories/permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../../src/repositories/permission.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgD,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAChG,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAqDvD,qBAAa,2BAA4B,YAAW,oBAAoB;IAChE,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAa7B,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC;IAmB5C,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAI7B,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAQtC,MAAM,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAS9F,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAKnD,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAShD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAKnD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO/D,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjE,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAM/E,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAIzG"}

package/dist/repositories/permission.js

@@ -0,0 +1,133 @@
+import { eq, and } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { permissions, rolePermissions, orgMemberships } from "../db/schema.js";
+const DEFAULT_PERMISSIONS = [
+    { resource: "organization", action: "read" },
+    { resource: "organization", action: "update" },
+    { resource: "organization", action: "delete" },
+    { resource: "organization", action: "invite" },
+    { resource: "organization", action: "manage_members" },
+    { resource: "application", action: "read" },
+    { resource: "application", action: "create" },
+    { resource: "application", action: "update" },
+    { resource: "application", action: "delete" },
+    { resource: "service_account", action: "read" },
+    { resource: "service_account", action: "create" },
+    { resource: "service_account", action: "update" },
+    { resource: "service_account", action: "delete" },
+    { resource: "api_key", action: "read" },
+    { resource: "api_key", action: "create" },
+    { resource: "api_key", action: "revoke" },
+    { resource: "audit_log", action: "read" },
+];
+const DEFAULT_ROLE_PERMISSIONS = {
+    owner: DEFAULT_PERMISSIONS.map((p) => `${p.resource}:${p.action}`),
+    admin: [
+        "organization:read",
+        "organization:update",
+        "organization:invite",
+        "organization:manage_members",
+        "application:read",
+        "application:create",
+        "application:update",
+        "service_account:read",
+        "service_account:create",
+        "service_account:update",
+        "api_key:read",
+        "api_key:create",
+        "api_key:revoke",
+        "audit_log:read",
+    ],
+    member: [
+        "organization:read",
+        "application:read",
+        "service_account:read",
+        "api_key:read",
+    ],
+    viewer: ["organization:read", "application:read", "audit_log:read"],
+};
+function permissionKey(resource, action) {
+    return `${resource}:${action}`;
+}
+export class DrizzlePermissionRepository {
+    async ensureSeeded() {
+        const existing = await db.select().from(permissions);
+        const existingKeys = new Set(existing.map((p) => permissionKey(p.resource, p.action)));
+        const toInsert = DEFAULT_PERMISSIONS.filter((p) => !existingKeys.has(permissionKey(p.resource, p.action)));
+        if (toInsert.length > 0) {
+            await db.insert(permissions).values(toInsert);
+        }
+    }
+    async ensureRolePermissionsSeeded() {
+        await this.ensureSeeded();
+        const allPermissions = await db.select().from(permissions);
+        const permissionByKey = new Map(allPermissions.map((p) => [permissionKey(p.resource, p.action), p.id]));
+        for (const [role, perms] of Object.entries(DEFAULT_ROLE_PERMISSIONS)) {
+            const permissionIds = perms
+                .map((key) => permissionByKey.get(key))
+                .filter((id) => Boolean(id));
+            for (const permissionId of permissionIds) {
+                await db
+                    .insert(rolePermissions)
+                    .values({ role, permissionId })
+                    .onConflictDoNothing({ target: [rolePermissions.role, rolePermissions.permissionId] });
+            }
+        }
+    }
+    async list() {
+        return db.select().from(permissions).orderBy(permissions.resource, permissions.action);
+    }
+    async listDistinctRoles() {
+        const rows = await db.selectDistinct({ role: rolePermissions.role }).from(rolePermissions);
+        const roles = new Set(["owner", "admin", "member", ...rows.map((r) => r.role)]);
+        const memberships = await db.selectDistinct({ role: orgMemberships.role }).from(orgMemberships);
+        for (const m of memberships)
+            roles.add(m.role);
+        return [...roles].sort();
+    }
+    async create(input) {
+        const [created] = await db
+            .insert(permissions)
+            .values({ resource: input.resource, action: input.action, description: input.description ?? null })
+            .onConflictDoNothing({ target: [permissions.resource, permissions.action] })
+            .returning();
+        return created;
+    }
+    async remove(id) {
+        const [removed] = await db.delete(permissions).where(eq(permissions.id, id)).returning();
+        return removed;
+    }
+    async listForRole(role) {
+        const rows = await db
+            .select({ permission: permissions })
+            .from(rolePermissions)
+            .where(eq(rolePermissions.role, role))
+            .innerJoin(permissions, eq(rolePermissions.permissionId, permissions.id));
+        return rows.map((r) => r.permission);
+    }
+    async listKeysForRole(role) {
+        const perms = await this.listForRole(role);
+        return new Set(perms.map((p) => permissionKey(p.resource, p.action)));
+    }
+    async assignToRole(role, permissionId) {
+        await db
+            .insert(rolePermissions)
+            .values({ role, permissionId })
+            .onConflictDoNothing({ target: [rolePermissions.role, rolePermissions.permissionId] });
+    }
+    async removeFromRole(role, permissionId) {
+        await db
+            .delete(rolePermissions)
+            .where(and(eq(rolePermissions.role, role), eq(rolePermissions.permissionId, permissionId)));
+    }
+    async hasPermission(role, resource, action) {
+        const key = permissionKey(resource, action);
+        const keys = await this.listKeysForRole(role);
+        return keys.has(key);
+    }
+    async hasAnyPermission(role, required) {
+        const keys = await this.listKeysForRole(role);
+        return required.some((p) => keys.has(permissionKey(p.resource, p.action)));
+    }
+}
+//# sourceMappingURL=permission.js.map

package/dist/repositories/permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../../src/repositories/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAmB,MAAM,iBAAiB,CAAC;AAGhG,MAAM,mBAAmB,GAAG;IAC1B,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE;IAC5C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC9C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC9C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC9C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,EAAE;IACtD,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE;IAC3C,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC7C,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC7C,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC7C,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE;IAC/C,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjD,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;IACvC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;IACzC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;IACzC,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE;CAC1C,CAAC;AAEF,MAAM,wBAAwB,GAA6B;IACzD,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IAClE,KAAK,EAAE;QACL,mBAAmB;QACnB,qBAAqB;QACrB,qBAAqB;QACrB,6BAA6B;QAC7B,kBAAkB;QAClB,oBAAoB;QACpB,oBAAoB;QACpB,sBAAsB;QACtB,wBAAwB;QACxB,wBAAwB;QACxB,cAAc;QACd,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;KACjB;IACD,MAAM,EAAE;QACN,mBAAmB;QACnB,kBAAkB;QAClB,sBAAsB;QACtB,cAAc;KACf;IACD,MAAM,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,CAAC;CACpE,CAAC;AAEF,SAAS,aAAa,CAAC,QAAgB,EAAE,MAAc;IACrD,OAAO,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,2BAA2B;IACtC,KAAK,CAAC,YAAY;QAChB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAEvF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAC9D,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,2BAA2B;QAC/B,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAExG,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACrE,MAAM,aAAa,GAAG,KAAK;iBACxB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;iBACtC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAE7C,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBACzC,MAAM,EAAE;qBACL,MAAM,CAAC,eAAe,CAAC;qBACvB,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;qBAC9B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChG,KAAK,MAAM,CAAC,IAAI,WAAW;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiE;QAC5E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,WAAW,CAAC;aACnB,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;aAClG,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;aAC3E,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACzF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;aACnC,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aACrC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAY;QAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,YAAoB;QACnD,MAAM,EAAE;aACL,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;aAC9B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,YAAoB;QACrD,MAAM,EAAE;aACL,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QAChE,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,QAAgD;QACnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;CACF"}