@hilbras/keystone 1.6.0 → 2.5.0

package/dist/repositories/permission.js.map

@@ -1 +1 @@
-{"version":3,"file":"permission.js","sourceRoot":"","sources":["../../src/repositories/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAmB,MAAM,iBAAiB,CAAC;AAGhG,MAAM,mBAAmB,GAAG;IAC1B,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE;IAC5C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC9C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC9C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC9C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,EAAE;IACtD,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE;IAC3C,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC7C,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC7C,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC7C,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE;IAC/C,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjD,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;IACvC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;IACzC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;IACzC,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE;CAC1C,CAAC;AAEF,MAAM,wBAAwB,GAA6B;IACzD,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IAClE,KAAK,EAAE;QACL,mBAAmB;QACnB,qBAAqB;QACrB,qBAAqB;QACrB,6BAA6B;QAC7B,kBAAkB;QAClB,oBAAoB;QACpB,oBAAoB;QACpB,sBAAsB;QACtB,wBAAwB;QACxB,wBAAwB;QACxB,cAAc;QACd,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;KACjB;IACD,MAAM,EAAE;QACN,mBAAmB;QACnB,kBAAkB;QAClB,sBAAsB;QACtB,cAAc;KACf;IACD,MAAM,EAAE,CAAC,mBAAmB,EAAE,kBAAkB,EAAE,gBAAgB,CAAC;CACpE,CAAC;AAEF,SAAS,aAAa,CAAC,QAAgB,EAAE,MAAc;IACrD,OAAO,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,2BAA2B;IACtC,KAAK,CAAC,YAAY;QAChB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAEvF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAC9D,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,2BAA2B;QAC/B,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAExG,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACrE,MAAM,aAAa,GAAG,KAAK;iBACxB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;iBACtC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAE7C,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBACzC,MAAM,EAAE;qBACL,MAAM,CAAC,eAAe,CAAC;qBACvB,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;qBAC9B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxF,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChG,KAAK,MAAM,CAAC,IAAI,WAAW;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiE;QAC5E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,WAAW,CAAC;aACnB,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;aAClG,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;aAC3E,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACzF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;aACnC,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aACrC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAY;QAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,YAAoB;QACnD,MAAM,EAAE;aACL,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;aAC9B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,YAAoB;QACrD,MAAM,EAAE;aACL,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QAChE,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,QAAgD;QACnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;CACF"}
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../../src/repositories/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,cAAc,EAAmB,MAAM,iBAAiB,CAAC;AAGhG,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEjE,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,mBAAmB,GAAG;IAC1B,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE;IAC5C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC9C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC9C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC9C,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB,EAAE;IACtD,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE;IAC3C,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC7C,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC7C,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,EAAE;IAC7C,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE;IAC/C,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjD,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE;IACjD,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;IACvC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;IACzC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;IACzC,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE;IACzC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE;IAC9C,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE;IAChD,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE;IACvC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;CAC1C,CAAC;AAEF,MAAM,wBAAwB,GAA6B;IACzD,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IAClE,KAAK,EAAE;QACL,mBAAmB;QACnB,qBAAqB;QACrB,qBAAqB;QACrB,6BAA6B;QAC7B,kBAAkB;QAClB,oBAAoB;QACpB,oBAAoB;QACpB,sBAAsB;QACtB,wBAAwB;QACxB,wBAAwB;QACxB,cAAc;QACd,gBAAgB;QAChB,gBAAgB;QAChB,gBAAgB;QAChB,qBAAqB;QACrB,uBAAuB;QACvB,cAAc;QACd,gBAAgB;KACjB;IACD,MAAM,EAAE;QACN,mBAAmB;QACnB,kBAAkB;QAClB,sBAAsB;QACtB,cAAc;QACd,qBAAqB;KACtB;CACF,CAAC;AAEF,SAAS,aAAa,CAAC,QAAgB,EAAE,MAAc;IACrD,OAAO,GAAG,QAAQ,IAAI,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,OAAO,2BAA2B;IACtC,KAAK,CAAC,YAAY;QAChB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAEvF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAC9D,CAAC;QAEF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,2BAA2B;QAC/B,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1B,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAExG,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACrE,MAAM,aAAa,GAAG,KAAK;iBACxB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;iBACtC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAE7C,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;gBACzC,MAAM,EAAE;qBACL,MAAM,CAAC,eAAe,CAAC;qBACvB,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;qBAC9B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC5D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChG,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAiE;QAC5E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,WAAW,CAAC;aACnB,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;aAClG,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;aAC3E,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;QACzF,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;aACnC,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;aACrC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAY;QAChC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,YAAoB;QACnD,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,EAAE;aACL,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;aAC9B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,YAAoB;QACrD,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,EAAE;aACL,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,QAAgB,EAAE,MAAc;QAChE,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,IAAY,EAAE,QAAgD;QACnF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/dist/repositories/samlConnection.d.ts

@@ -11,8 +11,8 @@ export type SamlConnectionListItem = {
 };
 export interface SamlConnectionRepository {
     listByOrgId(orgId: string): Promise<SamlConnectionListItem[]>;
-    findById(id: string): Promise<SamlConnection | undefined>;
-    findActiveById(id: string): Promise<SamlConnection | undefined>;
+    findByIdAndOrgId(id: string, orgId: string): Promise<SamlConnection | undefined>;
+    findActiveByIdAndOrgId(id: string, orgId: string): Promise<SamlConnection | undefined>;
     create(input: {
         orgId: string;
         name: string;
@@ -37,33 +37,33 @@ export declare class DrizzleSamlConnectionRepository implements SamlConnectionRe
         isActive: boolean;
         createdAt: Date;
     }[]>;
-    findById(id: string): Promise<{
+    findByIdAndOrgId(id: string, orgId: string): Promise<{
         id: string;
-        name: string;
-        createdAt: Date;
-        updatedAt: Date;
         orgId: string;
-        isActive: boolean;
+        name: string;
         idpEntityId: string | null;
         idpSsoUrl: string | null;
         idpCertificate: string | null;
         spEntityId: string;
         spAcsUrl: string;
         attributeMapping: unknown;
-    }>;
-    findActiveById(id: string): Promise<{
-        id: string;
-        name: string;
+        isActive: boolean;
         createdAt: Date;
         updatedAt: Date;
+    }>;
+    findActiveByIdAndOrgId(id: string, orgId: string): Promise<{
+        id: string;
         orgId: string;
-        isActive: boolean;
+        name: string;
         idpEntityId: string | null;
         idpSsoUrl: string | null;
         idpCertificate: string | null;
         spEntityId: string;
         spAcsUrl: string;
         attributeMapping: unknown;
+        isActive: boolean;
+        createdAt: Date;
+        updatedAt: Date;
     }>;
     create(input: {
         orgId: string;
@@ -76,32 +76,32 @@ export declare class DrizzleSamlConnectionRepository implements SamlConnectionRe
         attributeMapping?: Record<string, unknown>;
         isActive?: boolean;
     }): Promise<{
-        id: string;
-        name: string;
+        attributeMapping: unknown;
         createdAt: Date;
-        updatedAt: Date;
-        orgId: string;
-        isActive: boolean;
+        id: string;
+        idpCertificate: string | null;
         idpEntityId: string | null;
         idpSsoUrl: string | null;
-        idpCertificate: string | null;
-        spEntityId: string;
+        isActive: boolean;
+        name: string;
+        orgId: string;
         spAcsUrl: string;
-        attributeMapping: unknown;
+        spEntityId: string;
+        updatedAt: Date;
     }>;
     deleteByIdAndOrgId(id: string, orgId: string): Promise<{
-        id: string;
-        name: string;
+        attributeMapping: unknown;
         createdAt: Date;
-        updatedAt: Date;
-        orgId: string;
-        isActive: boolean;
+        id: string;
+        idpCertificate: string | null;
         idpEntityId: string | null;
         idpSsoUrl: string | null;
-        idpCertificate: string | null;
-        spEntityId: string;
+        isActive: boolean;
+        name: string;
+        orgId: string;
         spAcsUrl: string;
-        attributeMapping: unknown;
+        spEntityId: string;
+        updatedAt: Date;
     }>;
 }
 //# sourceMappingURL=samlConnection.d.ts.map

package/dist/repositories/samlConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"samlConnection.d.ts","sourceRoot":"","sources":["../../src/repositories/samlConnection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEvE,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC1D,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,EAAE;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;CACpF;AAED,qBAAa,+BAAgC,YAAW,wBAAwB;IACxE,WAAW,CAAC,KAAK,EAAE,MAAM;;;;;;;;;;IAgBzB,QAAQ,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;;;;IAKnB,cAAc,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;;;;IAKzB,MAAM,CAAC,KAAK,EAAE;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB;;;;;;;;;;;;;;IAkBK,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;;;;;CAOnD"}
+{"version":3,"file":"samlConnection.d.ts","sourceRoot":"","sources":["../../src/repositories/samlConnection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEvE,MAAM,MAAM,sBAAsB,GAAG;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC;IAC9D,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACjF,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,EAAE;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5B,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;CACpF;AAED,qBAAa,+BAAgC,YAAW,wBAAwB;IACxE,WAAW,CAAC,KAAK,EAAE,MAAM;;;;;;;;;SAc9B;IAEK,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;;;;OAO/C;IAEK,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;;;;OAOrD;IAEK,MAAM,CAAC,KAAK,EAAE;QAClB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB;;;;;;;;;;;;;OAgBA;IAEK,kBAAkB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;;;;;;;;;OAMjD;CACF"}

package/dist/repositories/samlConnection.js

@@ -17,12 +17,20 @@ export class DrizzleSamlConnectionRepository {
             .from(samlConnections)
             .where(eq(samlConnections.orgId, orgId));
     }
-    async findById(id) {
-        const [connection] = await db.select().from(samlConnections).where(eq(samlConnections.id, id)).limit(1);
+    async findByIdAndOrgId(id, orgId) {
+        const [connection] = await db
+            .select()
+            .from(samlConnections)
+            .where(and(eq(samlConnections.id, id), eq(samlConnections.orgId, orgId)))
+            .limit(1);
         return connection;
     }
-    async findActiveById(id) {
-        const [connection] = await db.select().from(samlConnections).where(and(eq(samlConnections.id, id), eq(samlConnections.isActive, true))).limit(1);
+    async findActiveByIdAndOrgId(id, orgId) {
+        const [connection] = await db
+            .select()
+            .from(samlConnections)
+            .where(and(eq(samlConnections.id, id), eq(samlConnections.orgId, orgId), eq(samlConnections.isActive, true)))
+            .limit(1);
         return connection;
     }
     async create(input) {

package/dist/repositories/samlConnection.js.map

@@ -1 +1 @@
-{"version":3,"file":"samlConnection.js","sourceRoot":"","sources":["../../src/repositories/samlConnection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAuB,MAAM,iBAAiB,CAAC;AA+BvE,MAAM,OAAO,+BAA+B;IAC1C,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,EAAE;aACN,MAAM,CAAC;YACN,EAAE,EAAE,eAAe,CAAC,EAAE;YACtB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,WAAW,EAAE,eAAe,CAAC,WAAW;YACxC,SAAS,EAAE,eAAe,CAAC,SAAS;YACpC,UAAU,EAAE,eAAe,CAAC,UAAU;YACtC,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,SAAS,EAAE,eAAe,CAAC,SAAS;SACrC,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxG,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjJ,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAUZ;QACC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAE;YAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;SACjC,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU,EAAE,KAAa;QAChD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aACxE,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"samlConnection.js","sourceRoot":"","sources":["../../src/repositories/samlConnection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAuB,MAAM,iBAAiB,CAAC;AA+BvE,MAAM,OAAO,+BAA+B;IAC1C,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,OAAO,EAAE;aACN,MAAM,CAAC;YACN,EAAE,EAAE,eAAe,CAAC,EAAE;YACtB,IAAI,EAAE,eAAe,CAAC,IAAI;YAC1B,WAAW,EAAE,eAAe,CAAC,WAAW;YACxC,SAAS,EAAE,eAAe,CAAC,SAAS;YACpC,UAAU,EAAE,eAAe,CAAC,UAAU;YACtC,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,QAAQ,EAAE,eAAe,CAAC,QAAQ;YAClC,SAAS,EAAE,eAAe,CAAC,SAAS;SACrC,CAAC;aACD,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU,EAAE,KAAa;QAC9C,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aACxE,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,EAAU,EAAE,KAAa;QACpD,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;aAC5G,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAUZ;QACC,MAAM,CAAC,UAAU,CAAC,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAE;YAC9C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;SACjC,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,EAAU,EAAE,KAAa;QAChD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aACxE,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/repositories/scimConnection.d.ts

@@ -0,0 +1,38 @@
+import { type ScimConnection } from "../db/schema.js";
+import type { CreateScimConnectionInput, ScimConnectionRepository } from "./types.js";
+export type ScimConnectionPublic = Omit<ScimConnection, "tokenHash" | "previousTokenHash">;
+/**
+ * Per-organization SCIM credentials.
+ *
+ * The bearer token is never stored: only its SHA-256 digest, which is also what
+ * authentication looks up. That removes both the plaintext-at-rest problem and
+ * the timing side channel of comparing secrets in application code, because the
+ * comparison happens inside the database's index lookup.
+ */
+export declare class DrizzleScimConnectionRepository implements ScimConnectionRepository {
+    create(input: CreateScimConnectionInput): Promise<ScimConnection>;
+    findById(id: string): Promise<ScimConnection | undefined>;
+    findActiveByOrg(orgId: string): Promise<ScimConnection | undefined>;
+    listByOrg(orgId: string): Promise<ScimConnection[]>;
+    listAll(): Promise<ScimConnection[]>;
+    /**
+     * Resolve a presented token to its connection. Accepts the current token and,
+     * inside the rotation grace window, the previous one. Revoked and expired
+     * connections never resolve.
+     */
+    findByTokenHash(tokenHash: string, now?: Date): Promise<ScimConnection | undefined>;
+    /**
+     * Issue a new token. The previous one keeps working until
+     * `previousTokenValidUntil`, so a rotation does not drop in-flight IdM traffic.
+     */
+    rotate(id: string, input: {
+        tokenHash: string;
+        tokenHint: string;
+        graceSeconds: number;
+        now?: Date;
+    }): Promise<ScimConnection | undefined>;
+    revoke(id: string, now?: Date): Promise<ScimConnection | undefined>;
+    touch(id: string, now?: Date): Promise<void>;
+    deleteRevokedBefore(cutoff: Date): Promise<number>;
+}
+//# sourceMappingURL=scimConnection.d.ts.map

package/dist/repositories/scimConnection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scimConnection.d.ts","sourceRoot":"","sources":["../../src/repositories/scimConnection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,KAAK,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtF,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,cAAc,EAAE,WAAW,GAAG,mBAAmB,CAAC,CAAC;AAE3F;;;;;;;GAOG;AACH,qBAAa,+BAAgC,YAAW,wBAAwB;IACxE,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,cAAc,CAAC,CAetE;IAEK,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAO9D;IAEK,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAOxE;IAEK,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAMxD;IAEK,OAAO,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAEzC;IAED;;;;OAIG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,OAAa,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAkB9F;IAED;;;OAGG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,GAChF,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CA8BrC;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,OAAa,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAO9E;IAEK,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,OAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAKvD;IAEK,mBAAmB,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAMvD;CACF"}

package/dist/repositories/scimConnection.js

@@ -0,0 +1,123 @@
+import { and, eq, gt, isNull, lte, or, sql } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { scimConnections } from "../db/schema.js";
+/**
+ * Per-organization SCIM credentials.
+ *
+ * The bearer token is never stored: only its SHA-256 digest, which is also what
+ * authentication looks up. That removes both the plaintext-at-rest problem and
+ * the timing side channel of comparing secrets in application code, because the
+ * comparison happens inside the database's index lookup.
+ */
+export class DrizzleScimConnectionRepository {
+    async create(input) {
+        const [record] = await db
+            .insert(scimConnections)
+            .values({
+            orgId: input.orgId,
+            name: input.name,
+            tokenHash: input.tokenHash,
+            tokenHint: input.tokenHint,
+            previousTokenHash: input.previousTokenHash ?? null,
+            previousTokenValidUntil: input.previousTokenValidUntil ?? null,
+            createdByUserId: input.createdByUserId ?? null,
+            expiresAt: input.expiresAt ?? null,
+        })
+            .returning();
+        return record;
+    }
+    async findById(id) {
+        const [record] = await db
+            .select()
+            .from(scimConnections)
+            .where(eq(scimConnections.id, id))
+            .limit(1);
+        return record;
+    }
+    async findActiveByOrg(orgId) {
+        const [record] = await db
+            .select()
+            .from(scimConnections)
+            .where(and(eq(scimConnections.orgId, orgId), isNull(scimConnections.revokedAt)))
+            .limit(1);
+        return record;
+    }
+    async listByOrg(orgId) {
+        return db
+            .select()
+            .from(scimConnections)
+            .where(eq(scimConnections.orgId, orgId))
+            .orderBy(sql `${scimConnections.createdAt} desc`);
+    }
+    async listAll() {
+        return db.select().from(scimConnections).orderBy(sql `${scimConnections.createdAt} desc`);
+    }
+    /**
+     * Resolve a presented token to its connection. Accepts the current token and,
+     * inside the rotation grace window, the previous one. Revoked and expired
+     * connections never resolve.
+     */
+    async findByTokenHash(tokenHash, now = new Date()) {
+        const [record] = await db
+            .select()
+            .from(scimConnections)
+            .where(and(isNull(scimConnections.revokedAt), or(eq(scimConnections.tokenHash, tokenHash), and(eq(scimConnections.previousTokenHash, tokenHash), gt(scimConnections.previousTokenValidUntil, now)))))
+            .limit(1);
+        return record;
+    }
+    /**
+     * Issue a new token. The previous one keeps working until
+     * `previousTokenValidUntil`, so a rotation does not drop in-flight IdM traffic.
+     */
+    async rotate(id, input) {
+        const now = input.now ?? new Date();
+        const validUntil = new Date(now.getTime() + input.graceSeconds * 1000);
+        return db.transaction(async (tx) => {
+            const [current] = await tx
+                .select()
+                .from(scimConnections)
+                .where(and(eq(scimConnections.id, id), isNull(scimConnections.revokedAt)))
+                .limit(1);
+            if (!current)
+                return undefined;
+            // The token being replaced becomes the grace-period token; the new one
+            // becomes the only primary token. Reading first is required because a
+            // single UPDATE cannot reference the column it is replacing.
+            const [record] = await tx
+                .update(scimConnections)
+                .set({
+                previousTokenHash: current.tokenHash,
+                previousTokenValidUntil: validUntil,
+                tokenHash: input.tokenHash,
+                tokenHint: input.tokenHint,
+                lastRotatedAt: now,
+                updatedAt: now,
+            })
+                .where(and(eq(scimConnections.id, id), isNull(scimConnections.revokedAt)))
+                .returning();
+            return record;
+        });
+    }
+    async revoke(id, now = new Date()) {
+        const [record] = await db
+            .update(scimConnections)
+            .set({ revokedAt: now, previousTokenHash: null, previousTokenValidUntil: null, updatedAt: now })
+            .where(and(eq(scimConnections.id, id), isNull(scimConnections.revokedAt)))
+            .returning();
+        return record;
+    }
+    async touch(id, now = new Date()) {
+        await db
+            .update(scimConnections)
+            .set({ lastUsedAt: now })
+            .where(eq(scimConnections.id, id));
+    }
+    async deleteRevokedBefore(cutoff) {
+        const rows = await db
+            .delete(scimConnections)
+            .where(and(sql `revoked_at is not null`, lte(scimConnections.revokedAt, cutoff)))
+            .returning({ id: scimConnections.id });
+        return rows.length;
+    }
+}
+//# sourceMappingURL=scimConnection.js.map

package/dist/repositories/scimConnection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scimConnection.js","sourceRoot":"","sources":["../../src/repositories/scimConnection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,eAAe,EAAuB,MAAM,iBAAiB,CAAC;AAKvE;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IAC1C,KAAK,CAAC,MAAM,CAAC,KAAgC;QAC3C,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;YAClD,uBAAuB,EAAE,KAAK,CAAC,uBAAuB,IAAI,IAAI;YAC9D,eAAe,EAAE,KAAK,CAAC,eAAe,IAAI,IAAI;YAC9C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;SACnC,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACjC,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,KAAa;QACjC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aAC/E,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;aACvC,OAAO,CAAC,GAAG,CAAA,GAAG,eAAe,CAAC,SAAS,OAAO,CAAC,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,OAAO;QACX,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,GAAG,CAAA,GAAG,eAAe,CAAC,SAAS,OAAO,CAAC,CAAC;IAC3F,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;QACvD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CACJ,GAAG,CACD,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,EACjC,EAAE,CACA,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,CAAC,EACxC,GAAG,CACD,EAAE,CAAC,eAAe,CAAC,iBAAiB,EAAE,SAAS,CAAC,EAChD,EAAE,CAAC,eAAe,CAAC,uBAAuB,EAAE,GAAG,CAAC,CACjD,CACF,CACF,CACF;aACA,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CACV,EAAU,EACV,KAAiF;QAEjF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;QAEvE,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,EAAE;iBACR,IAAI,CAAC,eAAe,CAAC;iBACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;iBACzE,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC;YAE/B,uEAAuE;YACvE,sEAAsE;YACtE,6DAA6D;YAC7D,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;iBACtB,MAAM,CAAC,eAAe,CAAC;iBACvB,GAAG,CAAC;gBACH,iBAAiB,EAAE,OAAO,CAAC,SAAS;gBACpC,uBAAuB,EAAE,UAAU;gBACnC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,GAAG;gBAClB,SAAS,EAAE,GAAG;aACf,CAAC;iBACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;iBACzE,SAAS,EAAE,CAAC;YAEf,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;QACvC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;aAC/F,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;aACzE,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;QACtC,MAAM,EAAE;aACL,MAAM,CAAC,eAAe,CAAC;aACvB,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;aACxB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,MAAY;QACpC,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAA,wBAAwB,EAAE,GAAG,CAAC,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;aAC/E,SAAS,CAAC,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF"}

package/dist/repositories/scimGroup.d.ts

@@ -0,0 +1,36 @@
+import { type ScimGroup } from "../db/schema.js";
+import type { CreateScimGroupInput, ScimGroupRepository } from "./types.js";
+/**
+ * Organization-scoped SCIM groups.
+ *
+ * Every read and write takes `orgId` and filters on it, so a group id from
+ * another tenant resolves to "not found" rather than to that tenant's group.
+ */
+export declare class DrizzleScimGroupRepository implements ScimGroupRepository {
+    create(input: CreateScimGroupInput): Promise<ScimGroup>;
+    findByIdInOrg(orgId: string, groupId: string): Promise<ScimGroup | undefined>;
+    listByOrg(orgId: string): Promise<ScimGroup[]>;
+    updateInOrg(orgId: string, groupId: string, input: {
+        displayName?: string;
+        description?: string | null;
+        externalId?: string | null;
+    }): Promise<ScimGroup | undefined>;
+    deleteInOrg(orgId: string, groupId: string): Promise<boolean>;
+    /**
+     * Members of a group in `orgId`. The organization is verified by joining
+     * through the group row, so membership can never leak across tenants.
+     */
+    listMembers(orgId: string, groupId: string): Promise<{
+        userId: string;
+        email: string;
+        name: string | null;
+    }[]>;
+    /**
+     * Add a member, enforcing both halves in one statement: the group must belong
+     * to `orgId`, and the user must be a member of `orgId`. Callers cannot bypass
+     * the tenancy check by passing a foreign group or user id.
+     */
+    addMember(orgId: string, groupId: string, userId: string): Promise<boolean>;
+    removeMember(orgId: string, groupId: string, userId: string): Promise<boolean>;
+}
+//# sourceMappingURL=scimGroup.d.ts.map

package/dist/repositories/scimGroup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scimGroup.d.ts","sourceRoot":"","sources":["../../src/repositories/scimGroup.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAE5E;;;;;GAKG;AACH,qBAAa,0BAA2B,YAAW,mBAAmB;IAC9D,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,CAW5D;IAEK,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAOlF;IAEK,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAMnD;IAEK,WAAW,CACf,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACvF,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAYhC;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAMlE;IAED;;;OAGG;IACG,WAAW,CACf,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC,CAgBnE;IAED;;;;OAIG;IACG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBhF;IAEK,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASnF;CACF"}

package/dist/repositories/scimGroup.js

@@ -0,0 +1,113 @@
+import { and, eq, sql } from "drizzle-orm";
+import { db } from "../db/index.js";
+import { scimGroupMembers, scimGroups, orgMemberships, users, } from "../db/schema.js";
+/**
+ * Organization-scoped SCIM groups.
+ *
+ * Every read and write takes `orgId` and filters on it, so a group id from
+ * another tenant resolves to "not found" rather than to that tenant's group.
+ */
+export class DrizzleScimGroupRepository {
+    async create(input) {
+        const [record] = await db
+            .insert(scimGroups)
+            .values({
+            orgId: input.orgId,
+            displayName: input.displayName,
+            description: input.description ?? null,
+            externalId: input.externalId ?? null,
+        })
+            .returning();
+        return record;
+    }
+    async findByIdInOrg(orgId, groupId) {
+        const [record] = await db
+            .select()
+            .from(scimGroups)
+            .where(and(eq(scimGroups.id, groupId), eq(scimGroups.orgId, orgId)))
+            .limit(1);
+        return record;
+    }
+    async listByOrg(orgId) {
+        return db
+            .select()
+            .from(scimGroups)
+            .where(eq(scimGroups.orgId, orgId))
+            .orderBy(sql `${scimGroups.displayName} asc`);
+    }
+    async updateInOrg(orgId, groupId, input) {
+        const [record] = await db
+            .update(scimGroups)
+            .set({
+            ...(input.displayName !== undefined ? { displayName: input.displayName } : {}),
+            ...(input.description !== undefined ? { description: input.description } : {}),
+            ...(input.externalId !== undefined ? { externalId: input.externalId } : {}),
+            updatedAt: sql `now()`,
+        })
+            .where(and(eq(scimGroups.id, groupId), eq(scimGroups.orgId, orgId)))
+            .returning();
+        return record;
+    }
+    async deleteInOrg(orgId, groupId) {
+        const rows = await db
+            .delete(scimGroups)
+            .where(and(eq(scimGroups.id, groupId), eq(scimGroups.orgId, orgId)))
+            .returning({ id: scimGroups.id });
+        return rows.length === 1;
+    }
+    /**
+     * Members of a group in `orgId`. The organization is verified by joining
+     * through the group row, so membership can never leak across tenants.
+     */
+    async listMembers(orgId, groupId) {
+        return db
+            .select({ userId: scimGroupMembers.userId, email: users.email, name: users.name })
+            .from(scimGroupMembers)
+            .innerJoin(scimGroups, eq(scimGroupMembers.groupId, scimGroups.id))
+            .innerJoin(users, eq(scimGroupMembers.userId, users.id))
+            // Only users who are *currently* members: a removed member's email and
+            // name must stop being readable by the organization that removed them.
+            .innerJoin(orgMemberships, and(eq(orgMemberships.userId, scimGroupMembers.userId), eq(orgMemberships.orgId, orgId)))
+            .where(and(eq(scimGroups.id, groupId), eq(scimGroups.orgId, orgId)));
+    }
+    /**
+     * Add a member, enforcing both halves in one statement: the group must belong
+     * to `orgId`, and the user must be a member of `orgId`. Callers cannot bypass
+     * the tenancy check by passing a foreign group or user id.
+     */
+    async addMember(orgId, groupId, userId) {
+        return db.transaction(async (tx) => {
+            const [group] = await tx
+                .select({ id: scimGroups.id })
+                .from(scimGroups)
+                .where(and(eq(scimGroups.id, groupId), eq(scimGroups.orgId, orgId)))
+                .limit(1);
+            if (!group)
+                return false;
+            const [member] = await tx
+                .select({ id: orgMemberships.id })
+                .from(orgMemberships)
+                .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)))
+                .limit(1);
+            if (!member)
+                return false;
+            const rows = await tx
+                .insert(scimGroupMembers)
+                .values({ groupId, userId })
+                .onConflictDoNothing({ target: [scimGroupMembers.groupId, scimGroupMembers.userId] })
+                .returning({ id: scimGroupMembers.id });
+            return rows.length === 1;
+        });
+    }
+    async removeMember(orgId, groupId, userId) {
+        const group = await this.findByIdInOrg(orgId, groupId);
+        if (!group)
+            return false;
+        const rows = await db
+            .delete(scimGroupMembers)
+            .where(and(eq(scimGroupMembers.groupId, groupId), eq(scimGroupMembers.userId, userId)))
+            .returning({ id: scimGroupMembers.id });
+        return rows.length === 1;
+    }
+}
+//# sourceMappingURL=scimGroup.js.map

package/dist/repositories/scimGroup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scimGroup.js","sourceRoot":"","sources":["../../src/repositories/scimGroup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,KAAK,GAEN,MAAM,iBAAiB,CAAC;AAGzB;;;;;GAKG;AACH,MAAM,OAAO,0BAA0B;IACrC,KAAK,CAAC,MAAM,CAAC,KAA2B;QACtC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,UAAU,CAAC;aAClB,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACtC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;SACrC,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,OAAe;QAChD,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aACnE,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,OAAO,EAAE;aACN,MAAM,EAAE;aACR,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;aAClC,OAAO,CAAC,GAAG,CAAA,GAAG,UAAU,CAAC,WAAW,MAAM,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,WAAW,CACf,KAAa,EACb,OAAe,EACf,KAAwF;QAExF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,UAAU,CAAC;aAClB,GAAG,CAAC;YACH,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,SAAS,EAAE,GAAG,CAAA,OAAO;SACtB,CAAC;aACD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aACnE,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,OAAe;QAC9C,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,UAAU,CAAC;aAClB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;aACnE,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CACf,KAAa,EACb,OAAe;QAEf,OAAO,EAAE;aACN,MAAM,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;aACjF,IAAI,CAAC,gBAAgB,CAAC;aACtB,SAAS,CAAC,UAAU,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;aAClE,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACxD,uEAAuE;YACvE,uEAAuE;aACtE,SAAS,CACR,cAAc,EACd,GAAG,CACD,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAClD,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAChC,CACF;aACA,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,SAAS,CAAC,KAAa,EAAE,OAAe,EAAE,MAAc;QAC5D,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;iBACrB,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;iBAC7B,IAAI,CAAC,UAAU,CAAC;iBAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;iBACnE,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,KAAK;gBAAE,OAAO,KAAK,CAAC;YAEzB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;iBACtB,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;iBACjC,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;iBAC9E,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;YAE1B,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,MAAM,CAAC,gBAAgB,CAAC;iBACxB,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;iBAC3B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;iBACpF,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;YAE1C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,OAAe,EAAE,MAAc;QAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEzB,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,gBAAgB,CAAC;aACxB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;aACtF,SAAS,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC;IAC3B,CAAC;CACF"}

package/dist/repositories/session.d.ts

@@ -8,19 +8,19 @@ export interface CreateSessionInput {
 }
 export declare class SessionRepository {
     create(input: CreateSessionInput): Promise<{
-        id: string;
         createdAt: Date;
-        userId: string;
-        refreshTokenId: string;
         deviceFingerprint: string | null;
+        expiresAt: Date;
+        id: string;
         ipAddress: string | null;
-        userAgent: string | null;
         lastSeenAt: Date;
-        expiresAt: Date;
+        refreshTokenId: string;
+        revokedAt: Date | null;
+        userAgent: string | null;
+        userId: string;
     }>;
     listByUser(userId: string): Promise<{
         id: string;
-        createdAt: Date;
         userId: string;
         refreshTokenId: string;
         deviceFingerprint: string | null;
@@ -28,10 +28,11 @@ export declare class SessionRepository {
         userAgent: string | null;
         lastSeenAt: Date;
         expiresAt: Date;
+        revokedAt: Date | null;
+        createdAt: Date;
     }[]>;
     findByRefreshTokenId(refreshTokenId: string): Promise<{
         id: string;
-        createdAt: Date;
         userId: string;
         refreshTokenId: string;
         deviceFingerprint: string | null;
@@ -39,10 +40,11 @@ export declare class SessionRepository {
         userAgent: string | null;
         lastSeenAt: Date;
         expiresAt: Date;
+        revokedAt: Date | null;
+        createdAt: Date;
     }>;
     findById(id: string): Promise<{
         id: string;
-        createdAt: Date;
         userId: string;
         refreshTokenId: string;
         deviceFingerprint: string | null;
@@ -50,6 +52,8 @@ export declare class SessionRepository {
         userAgent: string | null;
         lastSeenAt: Date;
         expiresAt: Date;
+        revokedAt: Date | null;
+        createdAt: Date;
     }>;
     updateLastSeen(id: string): Promise<void>;
     deleteById(id: string, userId: string): Promise<boolean>;
@@ -57,17 +61,24 @@ export declare class SessionRepository {
     deleteExpired(): Promise<void>;
     deleteAllForUser(userId: string, exceptRefreshTokenId?: string): Promise<void>;
     revokeRefreshToken(tokenId: string): Promise<void>;
+    /**
+     * Mark every active session for a user as ended. Used when a security-relevant
+     * account change (such as enabling MFA) must invalidate existing sessions.
+     */
+    revokeAllForUser(userId: string): Promise<number>;
     findRefreshTokenByHash(tokenHash: string): Promise<{
         id: string;
-        createdAt: Date;
         userId: string;
-        deviceFingerprint: string | null;
-        ipAddress: string | null;
-        userAgent: string | null;
-        expiresAt: Date;
         appId: string | null;
         tokenHash: string;
+        expiresAt: Date;
         revokedAt: Date | null;
+        createdAt: Date;
+        ipAddress: string | null;
+        userAgent: string | null;
+        deviceFingerprint: string | null;
+        mfaFactor: string | null;
+        scopes: string[];
     }>;
 }
 //# sourceMappingURL=session.d.ts.map

package/dist/repositories/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/repositories/session.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,qBAAa,iBAAiB;IACtB,MAAM,CAAC,KAAK,EAAE,kBAAkB;;;;;;;;;;;IAYhC,UAAU,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;IAMzB,oBAAoB,CAAC,cAAc,EAAE,MAAM;;;;;;;;;;;IAO3C,QAAQ,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;IAOnB,cAAc,CAAC,EAAE,EAAE,MAAM;IAMzB,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAMrC,sBAAsB,CAAC,cAAc,EAAE,MAAM;IAK7C,aAAa;IAKb,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,MAAM;IAS9D,kBAAkB,CAAC,OAAO,EAAE,MAAM;IAIlC,sBAAsB,CAAC,SAAS,EAAE,MAAM;;;;;;;;;;;;CAI/C"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/repositories/session.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,qBAAa,iBAAiB;IACtB,MAAM,CAAC,KAAK,EAAE,kBAAkB;;;;;;;;;;;OAUrC;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM;;;;;;;;;;;SAI9B;IAEK,oBAAoB,CAAC,cAAc,EAAE,MAAM;;;;;;;;;;;OAKhD;IAEK,QAAQ,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;OAKxB;IAEK,cAAc,CAAC,EAAE,EAAE,MAAM,iBAI9B;IAEK,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAI1C;IAEK,sBAAsB,CAAC,cAAc,EAAE,MAAM,iBAGlD;IAEK,aAAa,kBAGlB;IAEK,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,oBAAoB,CAAC,EAAE,MAAM,iBAOnE;IAEK,kBAAkB,CAAC,OAAO,EAAE,MAAM,iBAEvC;IAED;;;OAGG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOtD;IAEK,sBAAsB,CAAC,SAAS,EAAE,MAAM;;;;;;;;;;;;;OAG7C;CACF"}