@hilbras/keystone 1.5.0 → 1.9.0

package/dist/services/domain/identity.js

@@ -1,7 +1,9 @@
+import { LastOwnerInvariantError } from "../../repositories/types.js";
 import { createTokenSet } from "../tokens.js";
 import { emit } from "../events/bus.js";
 import { getFederationAuthorizeUrl as getFederationAuthorizeUrlService, completeFederationLogin as completeFederationLoginService } from "../federation.js";
 import { ok, err } from "../../lib/result.js";
+import { canManagePlatformRole, isPlatformRole } from "./authorization.js";
 export class IdentityDomainService {
     users;
     identities;
@@ -9,6 +11,18 @@ export class IdentityDomainService {
         this.users = users;
         this.identities = identities;
     }
+    async auditDenied(actorId, action, targetUserId, context) {
+        await emit({
+            type: "unauthorized_access",
+            payload: {
+                userId: actorId,
+                requestId: context?.requestId,
+                ip: context?.ip,
+                userAgent: context?.userAgent,
+                metadata: { action, targetUserId },
+            },
+        });
+    }
     async findUser(id) {
         const user = await this.users.findById(id);
         if (!user)
@@ -36,23 +50,179 @@ export class IdentityDomainService {
         });
         return ok(user);
     }
-    async updateUserProfile(userId, updates) {
+    async updateUserProfile(actorId, userId, updates, context) {
+        const actor = await this.users.findById(actorId);
+        if (!actor)
+            return err({ code: "USER_NOT_FOUND", message: "Actor not found", statusCode: 404 });
+        if (actor.role !== "owner") {
+            await this.auditDenied(actorId, "platform_user_update", userId, context);
+            return err({ code: "FORBIDDEN", message: "Only platform owners can update users", statusCode: 403 });
+        }
         const updated = await this.users.update(userId, updates);
         if (!updated)
             return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
+        await emit({
+            type: "platform_user_updated",
+            payload: {
+                userId: actorId,
+                requestId: context?.requestId,
+                ip: context?.ip,
+                userAgent: context?.userAgent,
+                metadata: { targetUserId: userId, updates: Object.keys(updates), action: "platform_user_update" },
+            },
+        });
         return ok(updated);
     }
-    async deactivate(userId) {
-        await this.users.deactivate(userId);
+    async updatePlatformRole(actorId, targetUserId, role, context) {
+        if (!isPlatformRole(role)) {
+            await this.auditDenied(actorId, "invalid_platform_role", targetUserId, context);
+            return err({ code: "INVALID_PLATFORM_ROLE", message: "Invalid platform role", statusCode: 400 });
+        }
+        const actor = await this.users.findById(actorId);
+        if (!actor)
+            return err({ code: "USER_NOT_FOUND", message: "Actor not found", statusCode: 404 });
+        if (!canManagePlatformRole(actor.role, role)) {
+            await this.auditDenied(actorId, "platform_role_change", targetUserId, context);
+            return err({ code: "FORBIDDEN", message: "Only platform owners can change platform roles", statusCode: 403 });
+        }
+        const target = await this.users.findById(targetUserId);
+        if (!target)
+            return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
+        let updated;
+        try {
+            updated = await this.users.updateRole(targetUserId, role);
+        }
+        catch (error) {
+            if (error instanceof LastOwnerInvariantError) {
+                await this.auditDenied(actorId, "last_platform_owner_protection", targetUserId, context);
+                return err({ code: "LAST_PLATFORM_OWNER", message: error.message, statusCode: 400 });
+            }
+            throw error;
+        }
+        if (!updated)
+            return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
+        await emit({
+            type: "platform_role_changed",
+            payload: {
+                userId: actorId,
+                orgId: target.defaultOrgId ?? undefined,
+                requestId: context?.requestId,
+                ip: context?.ip,
+                userAgent: context?.userAgent,
+                metadata: {
+                    targetUserId,
+                    previousRole: target.role,
+                    newRole: role,
+                    action: "platform_role_changed",
+                },
+            },
+        });
+        return ok(updated);
+    }
+    async deactivate(actorId, targetUserId, context) {
+        const actor = await this.users.findById(actorId);
+        if (!actor)
+            return err({ code: "USER_NOT_FOUND", message: "Actor not found", statusCode: 404 });
+        if (actor.role !== "owner") {
+            await this.auditDenied(actorId, "platform_user_deactivate", targetUserId, context);
+            return err({ code: "FORBIDDEN", message: "Only platform owners can deactivate users", statusCode: 403 });
+        }
+        if (actorId === targetUserId) {
+            await this.auditDenied(actorId, "self_deactivation", targetUserId, context);
+            return err({ code: "SELF_DEACTIVATION", message: "Cannot deactivate yourself", statusCode: 400 });
+        }
+        const target = await this.users.findById(targetUserId);
+        if (!target)
+            return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
+        try {
+            await this.users.deactivate(targetUserId);
+        }
+        catch (error) {
+            if (error instanceof LastOwnerInvariantError) {
+                await this.auditDenied(actorId, "last_platform_owner_protection", targetUserId, context);
+                return err({ code: "LAST_PLATFORM_OWNER", message: error.message, statusCode: 400 });
+            }
+            throw error;
+        }
+        await emit({
+            type: "platform_user_deactivated",
+            payload: {
+                userId: actorId,
+                requestId: context?.requestId,
+                ip: context?.ip,
+                userAgent: context?.userAgent,
+                metadata: { targetUserId, action: "platform_user_deactivated" },
+            },
+        });
         return ok(undefined);
     }
-    async listOrganizationUsers(orgId) {
-        return this.users.listByOrg(orgId);
+    async reviewAccount(actorId, targetUserId, active, context) {
+        const actor = await this.users.findById(actorId);
+        if (!actor)
+            return err({ code: "USER_NOT_FOUND", message: "Actor not found", statusCode: 404 });
+        if (actor.role !== "owner") {
+            await this.auditDenied(actorId, "platform_account_review", targetUserId, context);
+            return err({ code: "FORBIDDEN", message: "Only platform owners can review accounts", statusCode: 403 });
+        }
+        const target = await this.users.findById(targetUserId);
+        if (!target)
+            return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
+        try {
+            if (active) {
+                const updated = await this.users.update(targetUserId, {
+                    isActive: true,
+                    accountReviewRequired: false,
+                    emailVerified: true,
+                });
+                if (!updated)
+                    return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
+                await emit({
+                    type: "platform_account_reviewed",
+                    payload: {
+                        userId: actorId,
+                        requestId: context?.requestId,
+                        ip: context?.ip,
+                        userAgent: context?.userAgent,
+                        metadata: { targetUserId, active: true, action: "platform_account_review" },
+                    },
+                });
+                return ok(updated);
+            }
+            await this.users.deactivate(targetUserId);
+        }
+        catch (error) {
+            if (error instanceof LastOwnerInvariantError) {
+                await this.auditDenied(actorId, "last_platform_owner_protection", targetUserId, context);
+                return err({ code: "LAST_PLATFORM_OWNER", message: error.message, statusCode: 400 });
+            }
+            throw error;
+        }
+        const updated = await this.users.findById(targetUserId);
+        if (!updated)
+            return err({ code: "USER_NOT_FOUND", message: "User not found", statusCode: 404 });
+        await emit({
+            type: "platform_account_reviewed",
+            payload: {
+                userId: actorId,
+                requestId: context?.requestId,
+                ip: context?.ip,
+                userAgent: context?.userAgent,
+                metadata: { targetUserId, active: false, action: "platform_account_review" },
+            },
+        });
+        return ok(updated);
     }
     async touchLastSeen(userId) {
         await this.users.updateLastSeen(userId);
     }
-    async linkUserIdentity(userId, providerId, providerType, externalSub, email) {
+    async linkUserIdentity(actorId, userId, providerId, providerType, externalSub, email) {
+        const actor = await this.users.findById(actorId);
+        if (!actor)
+            return err({ code: "USER_NOT_FOUND", message: "Actor not found", statusCode: 404 });
+        if (actorId !== userId && actor.role !== "owner") {
+            await this.auditDenied(actorId, "federation_identity_link", userId);
+            return err({ code: "FORBIDDEN", message: "You cannot link an identity for another user", statusCode: 403 });
+        }
         await this.identities.link({ userId, providerId, providerType, externalSub, email });
         return ok(undefined);
     }
@@ -60,16 +230,23 @@ export class IdentityDomainService {
         const url = await getFederationAuthorizeUrlService(provider, state, redirectUri);
         return ok({ url });
     }
-    async completeFederationLogin(provider, code, redirectUri) {
-        const result = await completeFederationLoginService(provider, code, redirectUri);
+    async completeFederationLogin(provider, code, redirectUri, application) {
+        const result = await completeFederationLoginService(provider, code, redirectUri, application);
         await emit({
             type: "federation_login",
             payload: { provider, userId: result.user.id, email: result.user.email },
         });
         return ok(result);
     }
-    async issueLocalTokenSet(user, opts) {
-        return createTokenSet(user, undefined, undefined, opts, opts?.deviceFingerprint);
+    /**
+     * Issue a local token set on behalf of an already-verified factor.
+     *
+     * `mfaFactor` is required rather than optional: without it the token
+     * chokepoint rejects MFA-enabled users, and an omitted argument silently
+     * reintroduces the bypass this parameter exists to prevent.
+     */
+    async issueLocalTokenSet(user, mfaFactor, opts) {
+        return createTokenSet(user, undefined, undefined, { ...opts, mfaFactor }, opts?.deviceFingerprint);
     }
 }
 //# sourceMappingURL=identity.js.map

package/dist/services/domain/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/services/domain/identity.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,yBAAyB,IAAI,gCAAgC,EAAE,uBAAuB,IAAI,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAC5J,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAE3D,MAAM,OAAO,qBAAqB;IAEb;IACA;IAFnB,YACmB,KAAqB,EACrB,UAA8B;QAD9B,UAAK,GAAL,KAAK,CAAgB;QACrB,eAAU,GAAV,UAAU,CAAoB;IAC9C,CAAC;IAEJ,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9F,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9F,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAA0D;QAChF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,QAAQ;YAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;QAElC,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CACpD,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CACrG,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ;YAC5B,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,KAAK;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,MAAc,EACd,OAA0F;QAE1F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjG,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAAa;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,MAAc,EACd,UAAkB,EAClB,YAAoB,EACpB,WAAmB,EACnB,KAAc;QAEd,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACrF,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,QAAgB,EAAE,KAAa,EAAE,WAAmB;QAClF,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACjF,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,QAAgB,EAChB,IAAY,EACZ,WAAmB;QAEnB,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QACjF,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE;SACxE,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,IAAU,EACV,IAKC;QAED,OAAO,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACnF,CAAC;CACF"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/services/domain/identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAAgD,MAAM,6BAA6B,CAAC;AAEpH,OAAO,EAAE,cAAc,EAAqB,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,yBAAyB,IAAI,gCAAgC,EAAE,uBAAuB,IAAI,8BAA8B,EAAqC,MAAM,kBAAkB,CAAC;AAC/L,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAqB,MAAM,oBAAoB,CAAC;AAG9F,MAAM,OAAO,qBAAqB;IAEb,KAAK;IACL,UAAU;IAF7B,YACmB,KAAqB,EACrB,UAA8B;qBAD9B,KAAK;0BACL,UAAU;IAC1B,CAAC;IAEI,KAAK,CAAC,WAAW,CAAC,OAAe,EAAE,MAAc,EAAE,YAAqB,EAAE,OAAsB;QACtG,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,OAAO,EAAE,SAAS;gBAC7B,EAAE,EAAE,OAAO,EAAE,EAAE;gBACf,SAAS,EAAE,OAAO,EAAE,SAAS;gBAC7B,QAAQ,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9F,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9F,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAA0D;QAChF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,QAAQ;YAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC;QAElC,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,oBAAoB,CACpD,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CACrG,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ;YACR,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ;YAC5B,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,KAAK;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,OAAe,EACf,MAAc,EACd,OAA4E,EAC5E,OAAsB;QAEtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAChG,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,sBAAsB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YACzE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uCAAuC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjG,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,OAAO,EAAE,SAAS;gBAC7B,EAAE,EAAE,OAAO,EAAE,EAAE;gBACf,SAAS,EAAE,OAAO,EAAE,SAAS;gBAC7B,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE;aAClG;SACF,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,kBAAkB,CACtB,OAAe,EACf,YAAoB,EACpB,IAAkB,EAClB,OAAsB;QAEtB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAChF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAC/E,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gDAAgD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAChH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAChG,IAAI,OAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,gCAAgC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;gBACzF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAEjG,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE,MAAM,CAAC,YAAY,IAAI,SAAS;gBACvC,SAAS,EAAE,OAAO,EAAE,SAAS;gBAC7B,EAAE,EAAE,OAAO,EAAE,EAAE;gBACf,SAAS,EAAE,OAAO,EAAE,SAAS;gBAC7B,QAAQ,EAAE;oBACR,YAAY;oBACZ,YAAY,EAAE,MAAM,CAAC,IAAI;oBACzB,OAAO,EAAE,IAAI;oBACb,MAAM,EAAE,uBAAuB;iBAChC;aACF;SACF,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAe,EAAE,YAAoB,EAAE,OAAsB;QAC5E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAChG,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,0BAA0B,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YACnF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,2CAA2C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAC5E,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,4BAA4B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAChG,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,gCAAgC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;gBACzF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,OAAO,EAAE,SAAS;gBAC7B,EAAE,EAAE,OAAO,EAAE,EAAE;gBACf,SAAS,EAAE,OAAO,EAAE,SAAS;gBAC7B,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,2BAA2B,EAAE;aAChE;SACF,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,OAAe,EACf,YAAoB,EACpB,MAAe,EACf,OAAsB;QAEtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAChG,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,yBAAyB,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;YAClF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,0CAA0C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACvD,IAAI,CAAC,MAAM;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAEhG,IAAI,CAAC;YACH,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE;oBACpD,QAAQ,EAAE,IAAI;oBACd,qBAAqB,EAAE,KAAK;oBAC5B,aAAa,EAAE,IAAI;iBACpB,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO;oBAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;gBACjG,MAAM,IAAI,CAAC;oBACT,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EAAE;wBACP,MAAM,EAAE,OAAO;wBACf,SAAS,EAAE,OAAO,EAAE,SAAS;wBAC7B,EAAE,EAAE,OAAO,EAAE,EAAE;wBACf,SAAS,EAAE,OAAO,EAAE,SAAS;wBAC7B,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,yBAAyB,EAAE;qBAC5E;iBACF,CAAC,CAAC;gBACH,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,gCAAgC,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC;gBACzF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACjG,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE,OAAO,EAAE,SAAS;gBAC7B,EAAE,EAAE,OAAO,EAAE,EAAE;gBACf,SAAS,EAAE,OAAO,EAAE,SAAS;gBAC7B,QAAQ,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE;aAC7E;SACF,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc;QAChC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,gBAAgB,CACpB,OAAe,EACf,MAAc,EACd,UAAkB,EAClB,YAAoB,EACpB,WAAmB,EACnB,KAAc;QAEd,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAChG,IAAI,OAAO,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,0BAA0B,EAAE,MAAM,CAAC,CAAC;YACpE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,8CAA8C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACrF,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,yBAAyB,CAAC,QAAgB,EAAE,KAAa,EAAE,WAAmB;QAClF,MAAM,GAAG,GAAG,MAAM,gCAAgC,CAAC,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACjF,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,uBAAuB,CAC3B,QAAgB,EAChB,IAAY,EACZ,WAAmB,EACnB,WAA0C;QAE1C,MAAM,MAAM,GAAG,MAAM,8BAA8B,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAC9F,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE;SACxE,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,kBAAkB,CACtB,IAAU,EACV,SAAuB,EACvB,IAKC;QAED,OAAO,cAAc,CACnB,IAAI,EACJ,SAAS,EACT,SAAS,EACT,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EACtB,IAAI,EAAE,iBAAiB,CACxB,CAAC;IACJ,CAAC;CACF"}

package/dist/services/domain/organization.d.ts

@@ -1,17 +1,17 @@
 import type { Organization, Application, OrgMembership } from "../../db/schema.js";
-import type { OrganizationRepository, ApplicationRepository, UserRepository } from "../../repositories/types.js";
+import { type OrganizationRepository, type ApplicationRepository } from "../../repositories/types.js";
 import { type Result } from "../../lib/result.js";
-export type OrgRole = "owner" | "admin" | "member";
+import { type OrgRole } from "./authorization.js";
+export type { OrgRole } from "./authorization.js";
 export declare class OrganizationDomainService {
     private readonly organizations;
     private readonly applications;
-    private readonly users?;
-    constructor(organizations: OrganizationRepository, applications: ApplicationRepository, users?: UserRepository | undefined);
+    constructor(organizations: OrganizationRepository, applications: ApplicationRepository);
     createOrganization(input: {
         name: string;
         slug?: string;
         plan?: string;
-    }, userId?: string): Promise<Result<Organization>>;
+    }, userId: string): Promise<Result<Organization>>;
     getOrganization(id: string): Promise<Result<Organization>>;
     listUserOrganizations(userId: string): Promise<Organization[]>;
     addOrgMembership(input: {
@@ -21,13 +21,9 @@ export declare class OrganizationDomainService {
     }): Promise<Result<OrgMembership>>;
     getMembership(orgId: string, userId: string): Promise<Result<OrgMembership>>;
     updateMembershipRole(orgId: string, userId: string, role: OrgRole): Promise<Result<OrgMembership>>;
-    removeMembership(orgId: string, userId: string): Promise<Result<boolean>>;
     removeOrgMember(orgId: string, userId: string): Promise<Result<{
         success: boolean;
     }>>;
-    deactivateOrgUser(orgId: string, userId: string): Promise<Result<{
-        success: boolean;
-    }>>;
     listOrgMembers(orgId: string): Promise<{
         membership: OrgMembership;
         user: {
@@ -36,6 +32,7 @@ export declare class OrganizationDomainService {
             username: string;
             name: string | null;
             avatarUrl: string | null;
+            platformRole: string;
         };
     }[]>;
     createApplication(input: {

package/dist/services/domain/organization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../../src/services/domain/organization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAEjH,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE3D,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEnD,qBAAa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAFN,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,qBAAqB,EACnC,KAAK,CAAC,EAAE,cAAc,YAAA;IAGnC,kBAAkB,CACtB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACrD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAQ1B,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAM1D,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAI9D,gBAAgB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAKzG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAM5E,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAM3B,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAIzE,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAYrF,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAYvF,cAAc,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;IAI5B,iBAAiB,CAAC,KAAK,EAAE;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAMrD,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAInE,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,GACrL,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;CAMhC"}
+{"version":3,"file":"organization.d.ts","sourceRoot":"","sources":["../../../src/services/domain/organization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnF,OAAO,EAA2B,KAAK,sBAAsB,EAAE,KAAK,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAE/H,OAAO,EAAW,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAsB,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAEtE,YAAY,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,qBAAa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAF/B,YACmB,aAAa,EAAE,sBAAsB,EACrC,YAAY,EAAE,qBAAqB,EAClD;IAEE,kBAAkB,CACtB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACrD,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAoB/B;IAEK,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAI/D;IAEK,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAEnE;IAEK,gBAAgB,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAM9G;IAEK,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAIjF;IAEK,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAehC;IAEK,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC,CAW1F;IAEK,cAAc,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;SAEjC;IAEK,iBAAiB,CAAC,KAAK,EAAE;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAI1D;IAEK,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAExE;IAEK,iBAAiB,CACrB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,GACrL,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAK9B;CACF"}

package/dist/services/domain/organization.js

@@ -1,19 +1,33 @@
+import { LastOwnerInvariantError } from "../../repositories/types.js";
 import { emit } from "../events/bus.js";
 import { ok, err } from "../../lib/result.js";
+import { isOrganizationRole } from "./authorization.js";
 export class OrganizationDomainService {
     organizations;
     applications;
-    users;
-    constructor(organizations, applications, users) {
+    constructor(organizations, applications) {
         this.organizations = organizations;
         this.applications = applications;
-        this.users = users;
     }
     async createOrganization(input, userId) {
-        const org = await this.organizations.create(input);
-        if (userId) {
-            await this.organizations.addMembership({ orgId: org.id, userId, role: "owner" });
+        const org = await this.organizations.createWithOwner(input, userId);
+        const membership = await this.organizations.findMembership(org.id, userId);
+        if (!membership) {
+            return err({ code: "OWNER_MEMBERSHIP_FAILED", message: "Organization owner membership could not be created", statusCode: 500 });
         }
+        await emit({
+            type: "organization_member_invited",
+            payload: {
+                userId,
+                orgId: org.id,
+                metadata: {
+                    targetUserId: userId,
+                    previousRole: null,
+                    newRole: membership.role,
+                    action: "organization_created",
+                },
+            },
+        });
         return ok(org);
     }
     async getOrganization(id) {
@@ -26,6 +40,9 @@ export class OrganizationDomainService {
         return this.organizations.listByUserId(userId);
     }
     async addOrgMembership(input) {
+        if (!isOrganizationRole(input.role)) {
+            return err({ code: "INVALID_ORGANIZATION_ROLE", message: "Invalid organization role", statusCode: 400 });
+        }
         const membership = await this.organizations.addMembership(input);
         return ok(membership);
     }
@@ -36,34 +53,35 @@ export class OrganizationDomainService {
         return ok(membership);
     }
     async updateMembershipRole(orgId, userId, role) {
-        const updated = await this.organizations.updateMembershipRole(orgId, userId, role);
-        if (!updated)
-            return err({ code: "MEMBERSHIP_NOT_FOUND", message: "Membership not found", statusCode: 404 });
-        return ok(updated);
-    }
-    async removeMembership(orgId, userId) {
-        return ok(await this.organizations.removeMembership(orgId, userId));
-    }
-    async removeOrgMember(orgId, userId) {
-        const membership = await this.organizations.findMembership(orgId, userId);
-        if (!membership)
-            return err({ code: "MEMBERSHIP_NOT_FOUND", message: "Membership not found", statusCode: 404 });
-        if (membership.role === "owner" && (await this.organizations.countOwners(orgId)) <= 1) {
-            return err({ code: "LAST_OWNER", message: "Cannot remove the last owner", statusCode: 400 });
+        if (!isOrganizationRole(role)) {
+            return err({ code: "INVALID_ORGANIZATION_ROLE", message: "Invalid organization role", statusCode: 400 });
+        }
+        try {
+            const updated = await this.organizations.updateMembershipRole(orgId, userId, role);
+            if (!updated)
+                return err({ code: "MEMBERSHIP_NOT_FOUND", message: "Membership not found", statusCode: 404 });
+            return ok(updated);
+        }
+        catch (error) {
+            if (error instanceof LastOwnerInvariantError) {
+                return err({ code: "LAST_OWNER", message: error.message, statusCode: 400 });
+            }
+            throw error;
         }
-        await this.organizations.removeMembership(orgId, userId);
-        return ok({ success: true });
     }
-    async deactivateOrgUser(orgId, userId) {
-        const membership = await this.organizations.findMembership(orgId, userId);
-        if (!membership) {
-            return err({ code: "MEMBERSHIP_NOT_FOUND", message: "User is not a member of this organization", statusCode: 404 });
+    async removeOrgMember(orgId, userId) {
+        try {
+            const removed = await this.organizations.removeMembership(orgId, userId);
+            if (!removed)
+                return err({ code: "MEMBERSHIP_NOT_FOUND", message: "Membership not found", statusCode: 404 });
+            return ok({ success: true });
         }
-        if (this.users) {
-            await this.users.deactivate(userId);
+        catch (error) {
+            if (error instanceof LastOwnerInvariantError) {
+                return err({ code: "LAST_OWNER", message: error.message, statusCode: 400 });
+            }
+            throw error;
         }
-        await this.organizations.removeMembership(orgId, userId);
-        return ok({ success: true });
     }
     async listOrgMembers(orgId) {
         return this.organizations.listMembers(orgId);

package/dist/services/domain/organization.js.map

@@ -1 +1 @@
-{"version":3,"file":"organization.js","sourceRoot":"","sources":["../../../src/services/domain/organization.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAI3D,MAAM,OAAO,yBAAyB;IAEjB;IACA;IACA;IAHnB,YACmB,aAAqC,EACrC,YAAmC,EACnC,KAAsB;QAFtB,kBAAa,GAAb,aAAa,CAAwB;QACrC,iBAAY,GAAZ,YAAY,CAAuB;QACnC,UAAK,GAAL,KAAK,CAAiB;IACtC,CAAC;IAEJ,KAAK,CAAC,kBAAkB,CACtB,KAAqD,EACrD,MAAe;QAEf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAU;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,MAAc;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAuD;QAC5E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,MAAc;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAChH,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAa,EACb,MAAc,EACd,IAAa;QAEb,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7G,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,MAAc;QAClD,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,MAAc;QACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAEhH,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,8BAA8B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa,EAAE,MAAc;QACnD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,2CAA2C,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAKvB;QACC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5F,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,KAAa;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,KAAa,EACb,OAAsL;QAEtL,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;CACF"}
+{"version":3,"file":"organization.js","sourceRoot":"","sources":["../../../src/services/domain/organization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uBAAuB,EAA2D,MAAM,6BAA6B,CAAC;AAC/H,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,EAAE,EAAE,GAAG,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAgB,MAAM,oBAAoB,CAAC;AAItE,MAAM,OAAO,yBAAyB;IAEjB,aAAa;IACb,YAAY;IAF/B,YACmB,aAAqC,EACrC,YAAmC;6BADnC,aAAa;4BACb,YAAY;IAC5B,CAAC;IAEJ,KAAK,CAAC,kBAAkB,CACtB,KAAqD,EACrD,MAAc;QAEd,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,oDAAoD,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAClI,CAAC;QACD,MAAM,IAAI,CAAC;YACT,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE;gBACP,MAAM;gBACN,KAAK,EAAE,GAAG,CAAC,EAAE;gBACb,QAAQ,EAAE;oBACR,YAAY,EAAE,MAAM;oBACpB,YAAY,EAAE,IAAI;oBAClB,OAAO,EAAE,UAAU,CAAC,IAAI;oBACxB,MAAM,EAAE,sBAAsB;iBAC/B;aACF;SACF,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAU;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,GAAG;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACpG,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,MAAc;QACxC,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAuD;QAC5E,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,2BAA2B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QACjE,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,MAAc;QAC/C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAChH,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,oBAAoB,CACxB,KAAa,EACb,MAAc,EACd,IAAa;QAEb,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,2BAA2B,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QAC3G,CAAC;QAED,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YACnF,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7G,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa,EAAE,MAAc;QACjD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7G,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,OAAO,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAKvB;QACC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5F,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,4BAA4B,CAAC,KAAa;QAC9C,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,iBAAiB,CACrB,KAAa,EACb,KAAa,EACb,OAAsL;QAEtL,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO;YAAE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACvG,MAAM,IAAI,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnF,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;CACF"}

package/dist/services/emailVerification.d.ts

@@ -4,12 +4,12 @@ export declare function generateVerificationToken(): {
     tokenHash: string;
 };
 export declare function storeVerificationToken(userId: string, tokenHash: string): Promise<{
-    id: string;
     createdAt: Date;
-    userId: string;
     expiresAt: Date;
+    id: string;
     tokenHash: string;
     usedAt: Date | null;
+    userId: string;
 }>;
 export declare function consumeVerificationToken(token: string): Promise<User | undefined>;
 export declare function sendVerificationEmail(user: {

package/dist/services/enterpriseSso.d.ts

@@ -3,22 +3,26 @@ export interface EnterpriseUserClaims {
     email: string;
     name?: string;
     username?: string;
-    externalId?: string;
+    externalId: string;
 }
-export declare function provisionEnterpriseUser(orgId: string, claims: EnterpriseUserClaims, defaultRole?: "owner" | "admin" | "member"): Promise<{
+export interface EnterpriseConnectionContext {
+    id: string;
+    type: "saml" | "oidc";
+}
+export declare function provisionEnterpriseUser(orgId: string, claims: EnterpriseUserClaims, connection: EnterpriseConnectionContext, defaultRole?: "owner" | "admin" | "member"): Promise<{
     id: string;
-    name: string | null;
-    plan: string;
-    createdAt: Date;
-    updatedAt: Date;
     zitadelUserId: string | null;
     email: string;
     username: string;
+    name: string | null;
     avatarUrl: string | null;
     emailVerified: boolean;
     emailVerifiedToken: string | null;
     provider: string;
+    plan: string;
     role: string;
+    isActive: boolean;
+    accountReviewRequired: boolean;
     defaultOrgId: string | null;
     phoneNumber: string | null;
     phoneVerified: boolean;
@@ -27,8 +31,11 @@ export declare function provisionEnterpriseUser(orgId: string, claims: Enterpris
     totpSecret: string | null;
     totpEnabled: boolean;
     totpVerifiedAt: Date | null;
+    totpLastStep: number | null;
     failedLoginAttempts: number;
     lockedUntil: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
 }>;
 export declare function defaultRoleForOrg(_org: Organization): "owner" | "admin" | "member";
 //# sourceMappingURL=enterpriseSso.d.ts.map

package/dist/services/enterpriseSso.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enterpriseSso.d.ts","sourceRoot":"","sources":["../../src/services/enterpriseSso.ts"],"names":[],"mappings":"AAEA,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAG3E,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,oBAAoB,EAC5B,WAAW,GAAE,OAAO,GAAG,OAAO,GAAG,QAAmB;;;;;;;;;;;;;;;;;;;;;;;;GAqCrD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAGlF"}
+{"version":3,"file":"enterpriseSso.d.ts","sourceRoot":"","sources":["../../src/services/enterpriseSso.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2C,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAI7F,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC;CACvB;AAED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,oBAAoB,EAC5B,UAAU,EAAE,2BAA2B,EACvC,WAAW,GAAE,OAAO,GAAG,OAAO,GAAG,QAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgHrD;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,CAGlF"}

package/dist/services/enterpriseSso.js

@@ -1,11 +1,42 @@
-import { eq } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";
 import { db } from "../db/index.js";
-import { users, orgMemberships } from "../db/schema.js";
+import { users, orgMemberships, ssoIdentityLinks } from "../db/schema.js";
 import { slugifyUsername, ensureUniqueUsername } from "./users.js";
-export async function provisionEnterpriseUser(orgId, claims, defaultRole = "member") {
+import { emit } from "./events/bus.js";
+export async function provisionEnterpriseUser(orgId, claims, connection, defaultRole = "member") {
     const email = claims.email.toLowerCase().trim();
-    let [user] = await db.select().from(users).where(eq(users.email, email)).limit(1);
+    const externalId = claims.externalId.trim();
+    if (!["owner", "admin", "member"].includes(defaultRole)) {
+        throw new Error("Invalid organization role");
+    }
+    if (!email || !externalId) {
+        throw new Error("Enterprise SSO requires a verified email and external subject");
+    }
+    const [link] = await db
+        .select()
+        .from(ssoIdentityLinks)
+        .where(and(eq(ssoIdentityLinks.connectionType, connection.type), eq(ssoIdentityLinks.connectionId, connection.id), eq(ssoIdentityLinks.orgId, orgId), eq(ssoIdentityLinks.externalSub, externalId)))
+        .limit(1);
+    const [byEmail] = await db.select().from(users).where(eq(users.email, email)).limit(1);
+    if (byEmail && link && byEmail.id !== link.userId) {
+        throw new Error("Enterprise SSO subject is already linked to a different user");
+    }
+    if (byEmail?.role === "owner") {
+        throw new Error("Platform owners cannot authenticate through tenant SSO");
+    }
+    if (byEmail?.accountReviewRequired) {
+        throw new Error("User account requires platform review");
+    }
+    let user = byEmail;
+    if (link) {
+        if (!user) {
+            [user] = await db.select().from(users).where(eq(users.id, link.userId)).limit(1);
+        }
+    }
     if (!user) {
+        if (byEmail || link) {
+            throw new Error("Existing enterprise users require an explicit identity link");
+        }
         const baseUsername = claims.username || claims.email.split("@")[0];
         const username = await ensureUniqueUsername(slugifyUsername(baseUsername));
         [user] = await db
@@ -18,17 +49,55 @@ export async function provisionEnterpriseUser(orgId, claims, defaultRole = "memb
             emailVerified: true,
         })
             .returning();
+        await db.insert(ssoIdentityLinks).values({
+            connectionType: connection.type,
+            connectionId: connection.id,
+            orgId,
+            userId: user.id,
+            externalSub: externalId,
+        });
+    }
+    if (user?.role === "owner") {
+        throw new Error("Platform owners cannot authenticate through tenant SSO");
+    }
+    if (user?.accountReviewRequired) {
+        throw new Error("User account requires platform review");
+    }
+    if (byEmail && !link) {
+        throw new Error("Existing enterprise users require an explicit identity link");
+    }
+    if (!user.isActive) {
+        throw new Error("User account is deactivated");
     }
     const [existingMembership] = await db
         .select()
         .from(orgMemberships)
-        .where(eq(orgMemberships.userId, user.id))
+        .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, user.id)))
         .limit(1);
     if (!existingMembership) {
-        await db.insert(orgMemberships).values({
+        if (byEmail || link) {
+            throw new Error("Existing users must be explicitly invited before enterprise SSO login");
+        }
+        await db
+            .insert(orgMemberships)
+            .values({
             orgId,
             userId: user.id,
             role: defaultRole,
+        })
+            .onConflictDoNothing({ target: [orgMemberships.orgId, orgMemberships.userId] });
+        await emit({
+            type: "organization_member_invited",
+            payload: {
+                userId: user.id,
+                orgId,
+                metadata: {
+                    targetUserId: user.id,
+                    previousRole: null,
+                    newRole: defaultRole,
+                    action: "enterprise_sso_provisioned",
+                },
+            },
         });
     }
     return user;