@hilbras/keystone 1.5.0 → 1.9.0

package/src/repositories/user.ts

@@ -1,161 +0,0 @@
-import { eq, sql } from "drizzle-orm";
-import { db } from "../db/index.js";
-import { users, orgMemberships, userIdentities, identityProviders, type User } from "../db/schema.js";
-import type { CreateUserInput, UpdateUserInput, UserRepository } from "./types.js";
-
-export class DrizzleUserRepository implements UserRepository {
-  async findById(id: string): Promise<User | undefined> {
-    const [user] = await db.select().from(users).where(eq(users.id, id)).limit(1);
-    return user;
-  }
-
-  async findByEmail(email: string): Promise<User | undefined> {
-    const [user] = await db.select().from(users).where(eq(users.email, email.toLowerCase())).limit(1);
-    return user;
-  }
-
-  async create(input: CreateUserInput): Promise<User> {
-    const [user] = await db
-      .insert(users)
-      .values({
-        email: input.email.toLowerCase().trim(),
-        username: input.username,
-        name: input.name.trim() || input.username,
-        passwordHash: input.passwordHash ?? null,
-        provider: input.provider ?? "password",
-        emailVerified: input.emailVerified ?? true,
-        avatarUrl: input.avatarUrl ?? null,
-        zitadelUserId: input.zitadelUserId ?? null,
-        metadata: input.metadata ?? {},
-      })
-      .returning();
-    return user;
-  }
-
-  async update(id: string, input: UpdateUserInput): Promise<User | undefined> {
-    const [updated] = await db
-      .update(users)
-      .set({ ...input, updatedAt: sql`now()` })
-      .where(eq(users.id, id))
-      .returning();
-    return updated;
-  }
-
-  async deactivate(id: string): Promise<void> {
-    await db.update(users).set({ emailVerified: false, updatedAt: sql`now()` }).where(eq(users.id, id));
-  }
-
-  async listByOrg(orgId: string): Promise<User[]> {
-    const rows = await db
-      .select({ user: users })
-      .from(users)
-      .innerJoin(orgMemberships, eq(users.id, orgMemberships.userId))
-      .where(eq(orgMemberships.orgId, orgId));
-    return rows.map((r) => r.user);
-  }
-
-  async updateLastSeen(id: string): Promise<void> {
-    await db.update(users).set({ updatedAt: sql`now()` }).where(eq(users.id, id));
-  }
-
-  async recordFailedLogin(id: string): Promise<User | undefined> {
-    const [updated] = await db
-      .update(users)
-      .set({ failedLoginAttempts: sql`${users.failedLoginAttempts} + 1`, updatedAt: sql`now()` })
-      .where(eq(users.id, id))
-      .returning();
-    return updated;
-  }
-
-  async resetFailedLogins(id: string): Promise<void> {
-    await db
-      .update(users)
-      .set({ failedLoginAttempts: 0, lockedUntil: null, updatedAt: sql`now()` })
-      .where(eq(users.id, id));
-  }
-
-  async lockAccount(id: string, until: Date): Promise<void> {
-    await db.update(users).set({ lockedUntil: until, updatedAt: sql`now()` }).where(eq(users.id, id));
-  }
-
-  async ensureUniqueUsername(base: string, excludeId?: string): Promise<string> {
-    let username = base || "user";
-    let counter = 2;
-    while (true) {
-      const existing = await db
-        .select({ id: users.id })
-        .from(users)
-        .where(eq(users.username, username))
-        .limit(1);
-      if (existing.length === 0 || existing[0].id === excludeId) {
-        return username;
-      }
-      username = `${base}-${counter}`;
-      counter++;
-    }
-  }
-
-  async listAll(): Promise<User[]> {
-    return db.select().from(users);
-  }
-
-  async setTotpSecret(userId: string, totpSecret: string): Promise<void> {
-    await db.update(users).set({ totpSecret, totpEnabled: false }).where(eq(users.id, userId));
-  }
-
-  async enableTotp(userId: string): Promise<void> {
-    await db.update(users).set({ totpEnabled: true, totpVerifiedAt: new Date() }).where(eq(users.id, userId));
-  }
-
-  async disableTotp(userId: string): Promise<void> {
-    await db.update(users).set({ totpSecret: null, totpEnabled: false, totpVerifiedAt: null }).where(eq(users.id, userId));
-  }
-
-  async deleteById(userId: string): Promise<void> {
-    await db.delete(users).where(eq(users.id, userId));
-  }
-}
-
-export class DrizzleIdentityRepository {
-  async link(input: {
-    userId: string;
-    providerId: string;
-    providerType: string;
-    externalSub: string;
-    email?: string;
-    profile?: Record<string, unknown>;
-  }): Promise<void> {
-    await db
-      .insert(userIdentities)
-      .values({
-        userId: input.userId,
-        providerId: input.providerId,
-        providerType: input.providerType,
-        externalSub: input.externalSub,
-        email: input.email,
-        profile: input.profile ?? {},
-      })
-      .onConflictDoNothing({ target: [userIdentities.providerId, userIdentities.externalSub] });
-  }
-
-  async findLinkedByExternalSub(providerId: string, externalSub: string): Promise<User | undefined> {
-    const [existing] = await db
-      .select({ user: users })
-      .from(userIdentities)
-      .where(eq(userIdentities.externalSub, externalSub))
-      .innerJoin(users, eq(userIdentities.userId, users.id))
-      .limit(1);
-    return existing?.user;
-  }
-
-  async listByUserId(userId: string): Promise<{ identity: any; provider: { id: string; name: string; providerType: string } }[]> {
-    return db
-      .select({
-        identity: userIdentities,
-        provider: { id: identityProviders.id, name: identityProviders.name, providerType: identityProviders.providerType },
-      })
-      .from(userIdentities)
-      .where(eq(userIdentities.userId, userId))
-      .innerJoin(identityProviders, eq(userIdentities.providerId, identityProviders.id));
-  }
-}

package/src/routes/admin/billing.ts

@@ -1,48 +0,0 @@
-import { z } from "zod";
-import type { FastifyInstance } from "fastify";
-import { requireAuthAndRole } from "./helpers.js";
-import { getBillingSummary, setOrganizationPlan, provisionBillingCustomer, listPlans } from "../../services/billing.js";
-
-const UpdatePlanSchema = z.object({
-  plan: z.enum(["free", "starter", "growth", "enterprise"]),
-});
-
-export default async function billingRoutes(app: FastifyInstance) {
-  app.get("/billing/plans", { preHandler: [app.authenticate] }, async () => {
-    return { plans: listPlans() };
-  });
-
-  app.get(
-    "/organizations/:id/billing",
-    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "billing", action: "read" })] },
-    async (request) => {
-      const { id } = request.params as { id: string };
-      const summary = await getBillingSummary(id);
-      return summary;
-    }
-  );
-
-  app.patch(
-    "/organizations/:id/plan",
-    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "billing", action: "update" })] },
-    async (request) => {
-      const { id } = request.params as { id: string };
-      const body = UpdatePlanSchema.parse(request.body);
-      const result = await setOrganizationPlan(id, body.plan);
-      await request.audit("organization_plan_updated", { orgId: id, plan: body.plan });
-      return result;
-    }
-  );
-
-  app.post(
-    "/organizations/:id/billing/customer",
-    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "billing", action: "update" })] },
-    async (request, reply) => {
-      const { id } = request.params as { id: string };
-      const user = request.user!;
-      const result = await provisionBillingCustomer(id, user.email!);
-      await request.audit("billing_customer_provisioned", { orgId: id });
-      return reply.status(201).send(result);
-    }
-  );
-}

package/src/routes/admin/helpers.ts

@@ -1,50 +0,0 @@
-import { z } from "zod";
-import type { FastifyReply, FastifyRequest } from "fastify";
-import { getSdk } from "../../sdk/index.js";
-import type { OrgRole } from "../../services/domain/authorization.js";
-import { sendResultError } from "../helpers.js";
-
-export { sendResultError } from "../helpers.js";
-
-export function requireOwner() {
-  return async (request: FastifyRequest, reply: FastifyReply) => {
-    await request.server.authenticate(request, reply);
-    if (reply.sent) return;
-
-    if (request.user!.role !== "owner") {
-      return reply.status(403).send({ error: "Forbidden" });
-    }
-  };
-}
-
-export function requireAuthAndRole(allowedRoles: OrgRole[], permission?: { resource: string; action: string }) {
-  return async (request: FastifyRequest, reply: FastifyReply) => {
-    await request.server.authenticate(request, reply);
-    if (reply.sent) return;
-
-    const { id } = request.params as { id: string };
-    const sdk = getSdk();
-    const membershipResult = await sdk.authorization.requireOrgRole(request.user!.id, id, allowedRoles);
-    if (!membershipResult.success) return sendResultError(reply, membershipResult);
-    request.state.membership = membershipResult.data;
-
-    if (permission) {
-      const permResult = await sdk.authorization.requirePermission(membershipResult.data.role, permission.resource, permission.action);
-      if (!permResult.success) return sendResultError(reply, permResult);
-    }
-  };
-}
-
-export const ipEntry = z.string().max(64).regex(/^[0-9a-fA-F:.\/]+$/, "Invalid IP or CIDR entry");
-
-export const BrandingSchema = z
-  .object({
-    logoUrl: z.string().url().max(2048).optional(),
-    primaryColor: z.string().regex(/^#[0-9a-fA-F]{6}$/, "Use #rrggbb format").optional(),
-    accentColor: z.string().regex(/^#[0-9a-fA-F]{6}$/, "Use #rrggbb format").optional(),
-    companyName: z.string().max(255).optional(),
-    supportEmail: z.string().email().max(255).optional(),
-    loginTitle: z.string().max(255).optional(),
-    loginSubtitle: z.string().max(500).optional(),
-  })
-  .strict();

package/src/routes/admin/index.ts

@@ -1,16 +0,0 @@
-import type { FastifyInstance } from "fastify";
-import platformRoutes from "./platform.js";
-import webhooksRoutes from "./webhooks.js";
-import organizationsRoutes from "./organizations.js";
-import permissionsRoutes from "./permissions.js";
-import ssoRoutes from "./sso.js";
-import billingRoutes from "./billing.js";
-
-export default async function adminRoutes(app: FastifyInstance) {
-  await app.register(platformRoutes);
-  await app.register(webhooksRoutes);
-  await app.register(organizationsRoutes);
-  await app.register(permissionsRoutes);
-  await app.register(ssoRoutes);
-  await app.register(billingRoutes);
-}

package/src/routes/admin/organizations.ts

@@ -1,299 +0,0 @@
-import { z } from "zod";
-import type { FastifyInstance } from "fastify";
-import { getSdk } from "../../sdk/index.js";
-import { requireAuthAndRole, sendResultError, ipEntry, BrandingSchema } from "./helpers.js";
-import { updateMembershipRole, removeMembership, findMembership, countOwners } from "../../services/organizations.js";
-import { rateLimit } from "../../plugins/rateLimit.js";
-
-const CreateOrgSchema = z.object({
-  name: z.string().min(1).max(255),
-  slug: z.string().max(64).optional(),
-  plan: z.string().max(32).optional(),
-});
-
-const UpdateOrgSchema = z.object({
-  name: z.string().min(1).max(255).optional(),
-  branding: BrandingSchema.optional(),
-});
-
-const CreateAppSchema = z.object({
-  name: z.string().min(1).max(255),
-  redirectUris: z.array(z.string().url()).optional(),
-  allowedOrigins: z.array(z.string()).optional(),
-  allowedIps: z.array(ipEntry).optional(),
-  blockedIps: z.array(ipEntry).optional(),
-});
-
-const UpdateAppSchema = z.object({
-  name: z.string().min(1).max(255).optional(),
-  redirectUris: z.array(z.string().url()).optional(),
-  allowedOrigins: z.array(z.string()).optional(),
-  allowedIps: z.array(ipEntry).optional(),
-  blockedIps: z.array(ipEntry).optional(),
-  isActive: z.boolean().optional(),
-  branding: BrandingSchema.optional(),
-});
-
-const InviteSchema = z.object({
-  email: z.string().email(),
-  role: z.enum(["owner", "admin", "member"]).default("member"),
-});
-
-const UpdateMemberSchema = z.object({
-  role: z.enum(["owner", "admin", "member"]),
-});
-
-const UpdateUserSchema = z.object({
-  name: z.string().min(1).max(255).optional(),
-  username: z.string().min(3).max(32).optional(),
-  role: z.string().optional(),
-  emailVerified: z.boolean().optional(),
-});
-
-export default async function organizationsRoutes(app: FastifyInstance) {
-  const sdk = getSdk();
-
-  app.post(
-    "/organizations",
-    {
-      preHandler: [
-        app.authenticate,
-        rateLimit({
-          keyPrefix: "create-org",
-          maxAttempts: 5,
-          windowSeconds: 3600,
-        }),
-      ],
-    },
-    async (request, reply) => {
-      const body = CreateOrgSchema.parse(request.body);
-      const result = await sdk.organization.createOrganization(request.user!.id, body);
-      if (!result.success) return sendResultError(reply, result);
-      await request.audit("organization_created", { orgId: result.data.id });
-      return reply.status(201).send(result.data);
-    }
-  );
-
-  app.get("/organizations", { preHandler: [app.authenticate] }, async (request) => {
-    const orgs = await sdk.organization.listUserOrganizations(request.user!.id);
-    return { organizations: orgs };
-  });
-
-  app.get("/organizations/:id", { preHandler: [app.authenticate] }, async (request, reply) => {
-    const { id } = request.params as { id: string };
-    const result = await sdk.organization.getOrganization(request.user!.id, id);
-    if (!result.success) return sendResultError(reply, result);
-
-    const membership = await sdk.authorization.isOrgMember(request.user!.id, id);
-    request.state.membership = membership;
-
-    const memberCount = await app.container.organizationRepository.countMembers(id);
-
-    return { ...result.data, memberCount, membership };
-  });
-
-  app.post(
-    "/organizations/:id/applications",
-    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "application", action: "create" })] },
-    async (request, reply) => {
-      const { id } = request.params as { id: string };
-      const body = CreateAppSchema.parse(request.body);
-      const result = await sdk.organization.createApplication(request.user!.id, id, body);
-      if (!result.success) return sendResultError(reply, result);
-      return reply.status(201).send({ ...result.data, clientSecret: result.data.clientSecret });
-    }
-  );
-
-  app.get(
-    "/organizations/:id/applications",
-    { preHandler: [requireAuthAndRole(["owner", "admin", "member"], { resource: "application", action: "read" })] },
-    async (request, reply) => {
-      const { id } = request.params as { id: string };
-      const result = await sdk.organization.listOrganizationApplications(request.user!.id, id);
-      if (!result.success) return sendResultError(reply, result);
-      return { applications: result.data };
-    }
-  );
-
-  app.patch(
-    "/organizations/:id",
-    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "organization", action: "update" })] },
-    async (request, reply) => {
-      const { id } = request.params as { id: string };
-      const body = UpdateOrgSchema.parse(request.body);
-      if (body.name === undefined && body.branding === undefined) {
-        return reply.status(400).send({ error: "Nothing to update" });
-      }
-      const updated = await app.container.organizationRepository.update(id, {
-        name: body.name,
-        branding: body.branding,
-      });
-      if (!updated) return reply.status(404).send({ error: "Organization not found" });
-      await request.audit("organization_updated", { orgId: id, updates: Object.keys(body) });
-      return updated;
-    }
-  );
-
-  app.patch(
-    "/organizations/:id/applications/:appId",
-    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "application", action: "update" })] },
-    async (request, reply) => {
-      const { id, appId } = request.params as { id: string; appId: string };
-      const body = UpdateAppSchema.parse(request.body);
-      const result = await sdk.organization.updateApplication(request.user!.id, id, appId, body);
-      if (!result.success) return sendResultError(reply, result);
-      await request.audit("application_updated", { orgId: id, appId, updates: Object.keys(body) });
-      return result.data;
-    }
-  );
-
-  app.post(
-    "/organizations/:id/invites",
-    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "organization", action: "invite" })] },
-    async (request, reply) => {
-      const { id } = request.params as { id: string };
-      const body = InviteSchema.parse(request.body);
-      const result = await sdk.organization.inviteMember(request.user!.id, id, body);
-      if (!result.success) return sendResultError(reply, result);
-      await request.audit("organization_member_invited", {
-        orgId: id,
-        invitedUserId: result.data.user.id,
-        role: body.role,
-      });
-      return reply.status(201).send(result.data);
-    }
-  );
-
-  app.get(
-    "/organizations/:id/members",
-    { preHandler: [requireAuthAndRole(["owner", "admin", "member"], { resource: "organization", action: "read" })] },
-    async (request) => {
-      const { id } = request.params as { id: string };
-      const members = await getSdk().identity.listOrganizationUsers(id);
-      return { members };
-    }
-  );
-
-  app.patch(
-    "/organizations/:id/members/:userId",
-    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "organization", action: "manage_members" })] },
-    async (request, reply) => {
-      const { id, userId } = request.params as { id: string; userId: string };
-      const body = UpdateMemberSchema.parse(request.body);
-      const updated = await updateMembershipRole(id, userId, body.role);
-      if (!updated) return reply.status(404).send({ error: "Membership not found" });
-      await request.audit("organization_member_role_updated", { orgId: id, userId, role: body.role });
-      return updated;
-    }
-  );
-
-  app.delete(
-    "/organizations/:id/members/:userId",
-    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "organization", action: "manage_members" })] },
-    async (request, reply) => {
-      const { id, userId } = request.params as { id: string; userId: string };
-      const membership = await findMembership(id, userId);
-      if (!membership) return reply.status(404).send({ error: "Membership not found" });
-      if (membership.role === "owner" && (await countOwners(id)) <= 1) {
-        return reply.status(400).send({ error: "Cannot remove the last owner" });
-      }
-      await removeMembership(id, userId);
-      await request.audit("organization_member_removed", { orgId: id, userId });
-      return { success: true };
-    }
-  );
-
-  app.get(
-    "/organizations/:id/users",
-    { preHandler: [requireAuthAndRole(["owner", "admin", "member"], { resource: "organization", action: "read" })] },
-    async (request) => {
-      const { id } = request.params as { id: string };
-      const users = await sdk.identity.listOrganizationUsers(id);
-      return { users };
-    }
-  );
-
-  app.get(
-    "/organizations/:id/users/:userId",
-    { preHandler: [requireAuthAndRole(["owner", "admin", "member"], { resource: "organization", action: "read" })] },
-    async (request, reply) => {
-      const { id, userId } = request.params as { id: string; userId: string };
-      const membership = await sdk.authorization.isOrgMember(userId, id);
-      if (!membership) return reply.status(404).send({ error: "User is not a member of this organization" });
-      const users = await sdk.identity.listOrganizationUsers(id);
-      const user = users.find((u) => u.id === userId);
-      if (!user) return reply.status(404).send({ error: "User not found" });
-      return { user, membership };
-    }
-  );
-
-  app.patch(
-    "/organizations/:id/users/:userId",
-    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "organization", action: "manage_members" })] },
-    async (request, reply) => {
-      const { id, userId } = request.params as { id: string; userId: string };
-      const body = UpdateUserSchema.parse(request.body);
-      const membership = await sdk.authorization.isOrgMember(userId, id);
-      if (!membership) return reply.status(404).send({ error: "User is not a member of this organization" });
-      const result = await sdk.identity.updateUserProfile(userId, body);
-      if (!result.success) return sendResultError(reply, result);
-      await request.audit("organization_member_role_updated", { orgId: id, userId, updates: body });
-      return result.data;
-    }
-  );
-
-  app.delete(
-    "/organizations/:id/users/:userId",
-    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "organization", action: "manage_members" })] },
-    async (request, reply) => {
-      const { id, userId } = request.params as { id: string; userId: string };
-      const membership = await sdk.authorization.isOrgMember(userId, id);
-      if (!membership) return reply.status(404).send({ error: "User is not a member of this organization" });
-      const result = await sdk.identity.deactivate(userId);
-      if (!result.success) return sendResultError(reply, result);
-      await removeMembership(id, userId);
-      await request.audit("organization_member_removed", { orgId: id, userId });
-      return { success: true };
-    }
-  );
-
-  // Organization API keys.
-  app.get(
-    "/organizations/:id/api-keys",
-    { preHandler: [requireAuthAndRole(["owner", "admin", "member"], { resource: "api_key", action: "read" })] },
-    async (request) => {
-      const { id } = request.params as { id: string };
-      const keys = await app.container.apiKeyRepository.listByOrgId(id);
-      return { keys };
-    }
-  );
-
-  app.delete(
-    "/organizations/:id/api-keys/:keyId",
-    { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "api_key", action: "revoke" })] },
-    async (request, reply) => {
-      const { id, keyId } = request.params as { id: string; keyId: string };
-      const record = await app.container.apiKeyRepository.revokeByKeyIdAndOrgId(keyId, id);
-      if (!record) return reply.status(404).send({ error: "API key not found" });
-      await request.audit("api_key_revoked", { keyId: record.id, name: record.name, orgId: id });
-      return { success: true };
-    }
-  );
-
-  // Organization audit logs.
-  app.get(
-    "/organizations/:id/audit-logs",
-    { preHandler: [requireAuthAndRole(["owner", "admin", "member"], { resource: "audit_log", action: "read" })] },
-    async (request) => {
-      const { id } = request.params as { id: string };
-      const query = request.query as { limit?: string; offset?: string; event?: string };
-      const logs = await app.container.auditRepository.list({
-        orgId: id,
-        event: query.event,
-        limit: query.limit ? Number(query.limit) : 50,
-        offset: query.offset ? Number(query.offset) : 0,
-      });
-      return { logs };
-    }
-  );
-}

package/src/routes/admin/permissions.ts

@@ -1,80 +0,0 @@
-import { z } from "zod";
-import type { FastifyInstance } from "fastify";
-import { requireOwner } from "./helpers.js";
-
-const CreatePermissionSchema = z.object({
-  resource: z.string().min(1).max(64).regex(/^[a-z][a-z0-9_]*$/, "lowercase snake_case only"),
-  action: z.string().min(1).max(64).regex(/^[a-z][a-z0-9_]*$/, "lowercase snake_case only"),
-  description: z.string().max(255).optional(),
-});
-
-const RolePermissionSchema = z.object({
-  permissionId: z.string().uuid(),
-});
-
-export default async function permissionsRoutes(app: FastifyInstance) {
-  app.get("/permissions", { preHandler: [requireOwner()] }, async () => {
-    return { permissions: await app.container.permissionRepository.list() };
-  });
-
-  app.post("/permissions", { preHandler: [requireOwner()] }, async (request, reply) => {
-    const body = CreatePermissionSchema.parse(request.body);
-    const created = await app.container.permissionRepository.create(body);
-    if (!created) {
-      return reply.status(409).send({ error: `Permission ${body.resource}:${body.action} already exists` });
-    }
-    await request.audit("permission_created", {
-      permissionId: created.id,
-      resource: created.resource,
-      action: created.action,
-    });
-    return reply.status(201).send(created);
-  });
-
-  app.delete("/permissions/:id", { preHandler: [requireOwner()] }, async (request, reply) => {
-    const { id } = request.params as { id: string };
-    const removed = await app.container.permissionRepository.remove(id);
-    if (!removed) {
-      return reply.status(404).send({ error: "Permission not found" });
-    }
-    await request.audit("permission_deleted", {
-      permissionId: removed.id,
-      resource: removed.resource,
-      action: removed.action,
-    });
-    return { success: true };
-  });
-
-  app.get("/roles", { preHandler: [requireOwner()] }, async () => {
-    const roles = await app.container.permissionRepository.listDistinctRoles();
-    return { roles };
-  });
-
-  app.get("/roles/:role/permissions", { preHandler: [requireOwner()] }, async (request) => {
-    const { role } = request.params as { role: string };
-    return { role, permissions: await app.container.permissionRepository.listForRole(role) };
-  });
-
-  app.post(
-    "/roles/:role/permissions",
-    { preHandler: [requireOwner()] },
-    async (request, reply) => {
-      const { role } = request.params as { role: string };
-      const body = RolePermissionSchema.parse(request.body);
-      await app.container.permissionRepository.assignToRole(role, body.permissionId);
-      await request.audit("organization_member_role_updated", { role, permissionId: body.permissionId });
-      return reply.status(201).send({ success: true });
-    }
-  );
-
-  app.delete(
-    "/roles/:role/permissions/:permissionId",
-    { preHandler: [requireOwner()] },
-    async (request) => {
-      const { role, permissionId } = request.params as { role: string; permissionId: string };
-      await app.container.permissionRepository.removeFromRole(role, permissionId);
-      await request.audit("organization_member_role_updated", { role, permissionId });
-      return { success: true };
-    }
-  );
-}