@jini-ai/user-management 0.2.0

package/dist/server/repo.memory.js

@@ -0,0 +1,230 @@
+/**
+ * @file In-memory adapters for the `user-management` repo ports.
+ *
+ * Purpose:
+ * Test/dev implementations of the nine identity repo ports. Mirrors the exact
+ * style of `src/features/post/repo.memory.ts` / `src/members/repo.memory.ts`:
+ * constructor takes seed rows, methods filter/mutate an internal array. No
+ * business rules live here — that belongs to `authorize.ts`/`auth-service.ts`/
+ * `seed.ts`.
+ *
+ * Architectural role:
+ * The only adapter this pass — a SQLite adapter is a later step (see
+ * `ports.ts` header and `server/deps.ts` comments), matching the disclosed
+ * precedent of members/navigation/integrations/analytics.
+ */
+/** Snapshot seam used only by the memory transaction adapter; no business rules live here. */
+export class InMemoryIdentityRows {
+    rows;
+    constructor(required, optional = {}) {
+        this.rows = [...(optional.initialRows ?? [])];
+    }
+    /** Detached state so rollback also restores in-place changes such as session revocation. */
+    snapshotRows(required) {
+        return structuredClone(this.rows);
+    }
+    /** Restore a detached snapshot after the transaction rejects. */
+    restoreRows(required) {
+        this.rows = required.rows;
+    }
+}
+export class InMemoryPrincipalRepo extends InMemoryIdentityRows {
+    constructor(_required, { initialRows = [] } = {}) {
+        super(_required, { initialRows });
+    }
+    async findById(required) {
+        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.id === required.id) ?? null);
+    }
+    async list(required) {
+        return this.rows.filter((row) => row.workspaceId === required.workspaceId);
+    }
+    async save(record) {
+        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
+        if (index === -1) {
+            this.rows.push(record);
+            return;
+        }
+        this.rows[index] = record;
+    }
+}
+export class InMemoryUserRepo extends InMemoryIdentityRows {
+    constructor(_required, { initialRows = [] } = {}) {
+        super(_required, { initialRows });
+    }
+    async findByPrincipalId(required) {
+        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.principalId === required.principalId) ?? null);
+    }
+    async findByUsername(required) {
+        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.username === required.username) ?? null);
+    }
+    async list(required) {
+        return this.rows.filter((row) => row.workspaceId === required.workspaceId);
+    }
+    async save(record) {
+        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.principalId === record.principalId);
+        if (index === -1) {
+            this.rows.push(record);
+            return;
+        }
+        this.rows[index] = record;
+    }
+}
+export class InMemorySessionRepo extends InMemoryIdentityRows {
+    constructor(_required, { initialRows = [] } = {}) {
+        super(_required, { initialRows });
+    }
+    async findById(required) {
+        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.id === required.id) ?? null);
+    }
+    async findByTokenHash(required) {
+        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.tokenHash === required.tokenHash) ?? null);
+    }
+    async save(record) {
+        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
+        if (index === -1) {
+            this.rows.push(record);
+            return;
+        }
+        this.rows[index] = record;
+    }
+    async revoke(required) {
+        const row = this.rows.find((candidate) => candidate.workspaceId === required.workspaceId && candidate.id === required.id);
+        if (row)
+            row.revokedAt = required.revokedAt;
+    }
+    async listByPrincipalId(required) {
+        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.principalId === required.principalId);
+    }
+}
+export class InMemoryRoleRepo extends InMemoryIdentityRows {
+    constructor(_required, { initialRows = [] } = {}) {
+        super(_required, { initialRows });
+    }
+    async findById(required) {
+        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.id === required.id) ?? null);
+    }
+    async findByName(required) {
+        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.name === required.name) ??
+            null);
+    }
+    async list(required) {
+        return this.rows.filter((row) => row.workspaceId === required.workspaceId);
+    }
+    async save(record) {
+        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
+        if (index === -1) {
+            this.rows.push(record);
+            return;
+        }
+        this.rows[index] = record;
+    }
+    async delete(required) {
+        this.rows = this.rows.filter((row) => !(row.workspaceId === required.workspaceId && row.id === required.id));
+    }
+}
+export class InMemoryPolicyRepo extends InMemoryIdentityRows {
+    constructor(_required, { initialRows = [] } = {}) {
+        super(_required, { initialRows });
+    }
+    async findById(required) {
+        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.id === required.id) ?? null);
+    }
+    async findByName(required) {
+        return (this.rows.find((row) => row.workspaceId === required.workspaceId && row.name === required.name) ??
+            null);
+    }
+    async list(required) {
+        return this.rows.filter((row) => row.workspaceId === required.workspaceId);
+    }
+    async save(record) {
+        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
+        if (index === -1) {
+            this.rows.push(record);
+            return;
+        }
+        this.rows[index] = record;
+    }
+    async delete(required) {
+        this.rows = this.rows.filter((row) => !(row.workspaceId === required.workspaceId && row.id === required.id));
+    }
+}
+export class InMemoryPolicyPermissionRepo extends InMemoryIdentityRows {
+    constructor(_required, { initialRows = [] } = {}) {
+        super(_required, { initialRows });
+    }
+    async listByPolicyId(required) {
+        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.policyId === required.policyId);
+    }
+    async save(record) {
+        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
+        if (index === -1) {
+            this.rows.push(record);
+            return;
+        }
+        this.rows[index] = record;
+    }
+    async deleteByPolicyId(required) {
+        this.rows = this.rows.filter((row) => !(row.workspaceId === required.workspaceId && row.policyId === required.policyId));
+    }
+    async delete(required) {
+        this.rows = this.rows.filter((row) => !(row.workspaceId === required.workspaceId && row.id === required.id));
+    }
+}
+export class InMemoryRolePolicyRepo extends InMemoryIdentityRows {
+    constructor(_required, { initialRows = [] } = {}) {
+        super(_required, { initialRows });
+    }
+    async listByRoleId(required) {
+        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.roleId === required.roleId);
+    }
+    async listByPolicyId(required) {
+        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.policyId === required.policyId);
+    }
+    async save(record) {
+        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
+        if (index === -1) {
+            this.rows.push(record);
+            return;
+        }
+        this.rows[index] = record;
+    }
+}
+export class InMemoryPrincipalRoleRepo extends InMemoryIdentityRows {
+    constructor(_required, { initialRows = [] } = {}) {
+        super(_required, { initialRows });
+    }
+    async listByPrincipalId(required) {
+        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.principalId === required.principalId);
+    }
+    async listByRoleId(required) {
+        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.roleId === required.roleId);
+    }
+    async save(record) {
+        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
+        if (index === -1) {
+            this.rows.push(record);
+            return;
+        }
+        this.rows[index] = record;
+    }
+}
+export class InMemoryPrincipalPolicyRepo extends InMemoryIdentityRows {
+    constructor(_required, { initialRows = [] } = {}) {
+        super(_required, { initialRows });
+    }
+    async listByPrincipalId(required) {
+        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.principalId === required.principalId);
+    }
+    async listByPolicyId(required) {
+        return this.rows.filter((row) => row.workspaceId === required.workspaceId && row.policyId === required.policyId);
+    }
+    async save(record) {
+        const index = this.rows.findIndex((row) => row.workspaceId === record.workspaceId && row.id === record.id);
+        if (index === -1) {
+            this.rows.push(record);
+            return;
+        }
+        this.rows[index] = record;
+    }
+}
+//# sourceMappingURL=repo.memory.js.map

package/dist/server/seed.d.ts

@@ -0,0 +1,56 @@
+import type { Clock, IdGenerator, UUID } from "@jini-ai/core/primitives";
+import type { IdentityRepos, PasswordHasherPort } from "../core/ports.js";
+export interface SeedIdentityDeps {
+    repos: IdentityRepos;
+    hasher: PasswordHasherPort;
+    clock: Clock;
+    idGen: IdGenerator;
+}
+export interface SeedIdentityInput {
+    workspaceId: UUID;
+    /** The host explicitly chooses the first operator username. */
+    ownerUsername: string;
+    /**
+     * Required, and deliberately without a default.
+     *
+     * This function mints the first credential that can administer a workspace. A library-supplied
+     * fallback would mean every host that forgot to pass one shipped the *same* owner password, and
+     * the omission would look like working code rather than a misconfiguration. Where the value comes
+     * from — an environment variable, an operator prompt, a secret store, a generated string — is a
+     * decision only the host can make, because only the host knows its deployment model. Making this
+     * required turns "forgot to decide" into a compile error instead of a shared default credential.
+     */
+    ownerPassword: string;
+}
+export interface SeedIdentityOptions {
+    ownerEmail?: string | undefined;
+}
+export interface SeedIdentityResult {
+    ownerPrincipalId: UUID;
+    systemPrincipalId: UUID;
+}
+/**
+ * Seed first-boot identity data.
+ *
+ * Idempotent in two distinct senses, and both are load-bearing:
+ * - A seed that RAN TO COMPLETION is a no-op — the owner-username lookup below early-returns after
+ *   a single confirming read (`ensureOwnerRoleBinding`) and writes nothing. (This path does not
+ *   reconcile a built-in policy whose permission list has since grown; that is the host's job — see
+ *   the host's `applyBuiltinRoleGrants` / `migrateDeprecatedPermissionGrants`, chained onto
+ *   `identityReady`.)
+ * - "Ran to completion" is judged on the owner user AND its role link, not the user alone. The link
+ *   is the seed's last write, so the user is not on its own evidence the seed finished — see
+ *   `ensureOwnerRoleBinding` for what an interrupt between those two writes costs.
+ * - A seed that was INTERRUPTED is resumed, not replayed: every step converges onto the rows a
+ *   previous attempt already wrote and fills in only what is missing. See the block comment above
+ *   `ensureBuiltinRole` for why this function must survive being killed halfway.
+ *
+ * @complexity O(1) — fixed small number of inserts (4 roles/policies, ~2
+ * dozen policy_permissions, 3 principals, 1 user, 1 role assignment).
+ * @overallScore 100
+ */
+export declare function seedIdentity(required: {
+    deps: SeedIdentityDeps;
+    input: SeedIdentityInput;
+}, optional?: SeedIdentityOptions): Promise<SeedIdentityResult>;
+//# sourceMappingURL=seed.d.ts.map