@ketvietlab/ketsuite 0.1.1

package/dist/modules/user/routes.js

@@ -0,0 +1,244 @@
+// Logging in and out.
+//
+// These are routes rather than server functions on purpose. A function receives
+// `Ctx`, which is data and nothing else — no request, no response, no cookie. That
+// boundary is what keeps handlers testable and HTTP out of the data layer, and
+// logging in is exactly the operation that needs the other side of it.
+//
+// So the split is: `user.authenticate` decides whether the password is right and
+// what the account may see, and this decides what to do about it.
+import { json, page, sha256, text, withHeaders } from '@ketvietlab/ketjs';
+import { loginScreen } from './login.js';
+import { authTokenScreen } from '../../ui/auth.js';
+const read = async (req) => {
+    const chunks = [];
+    for await (const c of req)
+        chunks.push(c);
+    return Buffer.concat(chunks).toString('utf8');
+};
+/**
+ * A browser posts a form; everything else posts JSON. Accepting both is what lets
+ * the same route serve a sign-in page and an API without either pretending to be
+ * the other.
+ */
+const body = async (req) => {
+    const raw = await read(req);
+    if (!raw)
+        return {};
+    const type = String(req.headers['content-type'] ?? '');
+    if (type.includes('form-urlencoded'))
+        return Object.fromEntries(new URLSearchParams(raw));
+    try {
+        const parsed = JSON.parse(raw);
+        return Object.fromEntries(Object.entries(parsed).map(([k, v]) => [k, String(v ?? '')]));
+    }
+    catch {
+        return {};
+    }
+};
+const wantsHtml = (req) => String(req.headers.accept ?? '').includes('text/html');
+/**
+ * A cross-site POST cannot be allowed to log someone in.
+ *
+ * SameSite protects the session cookie once it exists, but not the request that
+ * creates it — an attacker who can make your browser sign in as *their* account
+ * then watches what you do in it. Browsers send Origin on any cross-site POST;
+ * anything else (curl, a server, an SDK) sends none, so absence is not suspicious
+ * and presence has to match.
+ */
+const crossSite = (req) => {
+    const origin = req.headers.origin;
+    if (!origin)
+        return false;
+    try {
+        return new URL(origin).host !== String(req.headers.host ?? '');
+    }
+    catch {
+        return true;
+    }
+};
+/** Where to land after signing in. Only ever a path on this site. */
+const hasUnsafePathCharacter = (value) => value.includes('\\') ||
+    [...value].some((character) => {
+        const code = character.charCodeAt(0);
+        return code <= 0x1f || code === 0x7f;
+    });
+const safeNext = (value) => {
+    if (!value?.startsWith('/') ||
+        value.startsWith('//') ||
+        hasUnsafePathCharacter(value) ||
+        /%5c/i.test(value))
+        return '/admin';
+    const parsed = new URL(value, 'http://ket.local');
+    return parsed.origin === 'http://ket.local' ? `${parsed.pathname}${parsed.search}${parsed.hash}` : '/admin';
+};
+const seeOther = (to, cookie) => withHeaders(text('', { status: 303 }), { location: to, ...(cookie ? { 'set-cookie': cookie } : {}) });
+const needSessions = () => text('this deployment has not turned sessions on', { status: 501 });
+const networkFingerprint = (req) => sha256(`${req.socket.remoteAddress ?? 'unknown'}\n${String(req.headers['user-agent'] ?? '')}`);
+export const routes = {
+    // The three a stranger has to be able to reach. /whoami answering 401 is the
+    // answer, not a refusal.
+    '/login': {
+        anonymous: true,
+        handler: (ctx) => async (url, req) => {
+            const sessions = await ctx.sessionsOf(url, req);
+            if (!sessions)
+                return needSessions();
+            const locale = ctx.localeOf(url, req);
+            const _ = ctx.translate(locale);
+            const locales = Object.keys(ctx.manifest.messages ?? {});
+            const styles = await ctx.styles(req);
+            const form = async (o) => {
+                const providers = ctx.manifest.functions['oauth.publicProviders']
+                    ? (await ctx.call('oauth.publicProviders', {}, url, req)).map((provider) => {
+                        const target = new URL(`/auth/oauth/${encodeURIComponent(provider.code)}/start`, 'http://ket.local');
+                        if (o.next)
+                            target.searchParams.set('next', safeNext(o.next));
+                        if (locale)
+                            target.searchParams.set('lang', locale);
+                        return { ...provider, href: `${target.pathname}${target.search}` };
+                    })
+                    : [];
+                return page({
+                    status: o.failed ? 401 : 200,
+                    body: ctx.document({
+                        lang: locale,
+                        title: _('user.login.title'),
+                        // Every installed module's stylesheets, exactly as the backend screens
+                        // get them. Passing nothing here shipped a sign-in page with no CSS at
+                        // all: the markup was right and the page looked broken.
+                        head: styles,
+                        body: loginScreen(_, { ...o, providers, locales, locale }),
+                    }),
+                });
+            };
+            if (req.method === 'GET') {
+                // Already signed in: sending someone to a login form they do not need is
+                // how they end up signing in twice and wondering which one took.
+                if (await sessions.of(req))
+                    return seeOther(safeNext(url.searchParams.get('next') ?? undefined));
+                const requestedNext = url.searchParams.get('next') ?? undefined;
+                return wantsHtml(req)
+                    ? form({
+                        next: requestedNext ? safeNext(requestedNext) : undefined,
+                        oauthFailed: url.searchParams.has('oauth_error'),
+                    })
+                    : text('POST a JSON body with login and password', { status: 405 });
+            }
+            if (req.method !== 'POST')
+                return text('POST a JSON body with login and password', { status: 405 });
+            if (crossSite(req))
+                return json({ ok: false }, { status: 403 });
+            const { login, password, next } = await body(req);
+            const html = wantsHtml(req);
+            const verdict = (await ctx.call('user.authenticate', {
+                login: login ?? '',
+                password: password ?? '',
+                networkFingerprint: networkFingerprint(req),
+            }, url, req));
+            // One answer for a wrong password, an unknown login and an account with no
+            // company: three different reasons, and telling them apart is how someone
+            // learns which of the three they hit.
+            const companies = verdict.companies ?? [];
+            if (!verdict.ok || !verdict.userId || !companies.length) {
+                return html ? form({ next, failed: true }) : json({ ok: false }, { status: 401 });
+            }
+            const { record, cookie } = await sessions.start({
+                userId: verdict.userId,
+                companies,
+                company: verdict.defaultCompanyId ?? null,
+                branches: verdict.branches ?? [],
+                branch: verdict.defaultBranchId ?? null,
+                securityVersion: verdict.securityVersion ?? 0,
+            });
+            return html
+                ? seeOther(safeNext(next), cookie)
+                : withHeaders(json({
+                    ok: true,
+                    userId: record.userId,
+                    company: record.company,
+                    companies: record.companies,
+                    branch: record.branch,
+                    branches: record.branches,
+                }), { 'set-cookie': cookie });
+        },
+    },
+    '/logout': {
+        anonymous: true,
+        handler: (ctx) => async (url, req) => {
+            const sessions = await ctx.sessionsOf(url, req);
+            if (!sessions)
+                return needSessions();
+            if (req.method !== 'POST')
+                return text('POST', { status: 405 });
+            if (crossSite(req))
+                return json({ ok: false }, { status: 403 });
+            const record = await sessions.of(req);
+            if (record)
+                await ctx.call('user.recordSecurityEvent', { event: 'session.logout', userId: record.userId, networkFingerprint: networkFingerprint(req) }, url, req);
+            await sessions.end(req);
+            // Clearing the cookie as well as the record: leaving the browser holding an
+            // id that no longer resolves means every later request pays a lookup to
+            // learn so.
+            return wantsHtml(req)
+                ? seeOther('/login', sessions.clearCookie())
+                : withHeaders(json({ ok: true }), { 'set-cookie': sessions.clearCookie() });
+        },
+    },
+    '/whoami': {
+        anonymous: true,
+        handler: (ctx) => async (url, req) => {
+            const sessions = await ctx.sessionsOf(url, req);
+            if (!sessions)
+                return needSessions();
+            // /whoami is anonymous at the routing layer so it can answer 401. Explicitly
+            // resolve the live scope first; otherwise reading the store directly would
+            // bypass membership and active-state revocation for this one route.
+            await ctx.scopeOf(url, req);
+            const record = await sessions.of(req);
+            if (!record)
+                return json({ ok: false }, { status: 401 });
+            return json({
+                ok: true,
+                userId: record.userId,
+                company: record.company,
+                companies: record.companies,
+                branch: record.branch,
+                branches: record.branches,
+            });
+        },
+    },
+    ...Object.fromEntries(['invitation', 'reset'].map((kind) => [
+        `/auth/${kind}`,
+        {
+            anonymous: true,
+            handler: (ctx) => async (url, req) => {
+                const locale = ctx.localeOf(url, req);
+                const _ = ctx.translate(locale);
+                const render = async (token, errors, complete = false) => page({
+                    body: ctx.document({
+                        lang: locale,
+                        title: _(`user.token.${kind}Title`),
+                        head: await ctx.styles(req),
+                        body: authTokenScreen(_, { kind, token, errors, complete }),
+                    }),
+                });
+                if (req.method === 'GET')
+                    return render(url.searchParams.get('token') ?? '');
+                if (req.method !== 'POST')
+                    return text('GET or POST', { status: 405 });
+                if (crossSite(req))
+                    return text('Forbidden', { status: 403 });
+                const form = await body(req);
+                if (form.password !== form.confirmPassword)
+                    return render(form.token ?? '', [_('user.token.mismatch')]);
+                const result = (await ctx.call('user.consumeAuthToken', { token: form.token ?? '', kind, realm: 'backend', password: form.password ?? '' }, url, req));
+                if (!result.ok || !result.userId)
+                    return render(form.token ?? '', (result.errors ?? []).map((error) => _(error.code ?? 'user.error.tokenInvalid')));
+                await (await ctx.sessionsOf(url, req))?.endUser(result.userId);
+                return render('', undefined, true);
+            },
+        },
+    ])),
+};
+//# sourceMappingURL=routes.js.map

package/dist/modules/user/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/user/routes.ts"],"names":[],"mappings":"AAAA,sBAAsB;AACtB,EAAE;AACF,gFAAgF;AAChF,mFAAmF;AACnF,+EAA+E;AAC/E,uEAAuE;AACvE,EAAE;AACF,iFAAiF;AACjF,kEAAkE;AAElE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAEzE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAmB,CAAA;AAanD,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAmB,EAAE;IAC/C,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG;QAAE,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAA;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAC/C,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,IAAI,GAAG,KAAK,EAAE,GAAQ,EAAmC,EAAE;IAC/D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAA;IAC3B,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAA;IACnB,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAA;IACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAA;IACzF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAA;QACzD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC,CAAA;AAED,MAAM,SAAS,GAAG,CAAC,GAAQ,EAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAE/F;;;;;;;;GAQG;AACH,MAAM,SAAS,GAAG,CAAC,GAAQ,EAAW,EAAE;IACtC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAA4B,CAAA;IACvD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC,CAAA;AAED,qEAAqE;AACrE,MAAM,sBAAsB,GAAG,CAAC,KAAa,EAAW,EAAE,CACxD,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;IACpB,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QAC5B,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QACpC,OAAO,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,CAAA;IACtC,CAAC,CAAC,CAAA;AACJ,MAAM,QAAQ,GAAG,CAAC,KAAyB,EAAU,EAAE;IACrD,IACE,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC;QACvB,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QACtB,sBAAsB,CAAC,KAAK,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAElB,OAAO,QAAQ,CAAA;IACjB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAA;IACjD,OAAO,MAAM,CAAC,MAAM,KAAK,kBAAkB,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC7G,CAAC,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,MAAe,EAAE,EAAE,CAC/C,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;AAEvG,MAAM,YAAY,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AAC9F,MAAM,kBAAkB,GAAG,CAAC,GAAQ,EAAU,EAAE,CAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,KAAK,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;AAEhG,MAAM,CAAC,MAAM,MAAM,GAA+B;IAChD,6EAA6E;IAC7E,yBAAyB;IACzB,QAAQ,EAAE;QACR,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,CAAC,GAAiB,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACjD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC/C,IAAI,CAAC,QAAQ;gBAAE,OAAO,YAAY,EAAE,CAAA;YACpC,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YACrC,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;YACxD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAEpC,MAAM,IAAI,GAAG,KAAK,EAAE,CAA6D,EAAE,EAAE;gBACnF,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,uBAAuB,CAAC;oBAC/D,CAAC,CACG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAIvD,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;wBACjB,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,eAAe,kBAAkB,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EACxD,kBAAkB,CACnB,CAAA;wBACD,IAAI,CAAC,CAAC,IAAI;4BAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;wBAC7D,IAAI,MAAM;4BAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;wBACnD,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,CAAA;oBACpE,CAAC,CAAC;oBACJ,CAAC,CAAC,EAAE,CAAA;gBACN,OAAO,IAAI,CAAC;oBACV,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;oBAC5B,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC;wBACjB,IAAI,EAAE,MAAM;wBACZ,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC;wBAC5B,uEAAuE;wBACvE,uEAAuE;wBACvE,wDAAwD;wBACxD,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,WAAW,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;qBAC3D,CAAC;iBACH,CAAC,CAAA;YACJ,CAAC,CAAA;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBACzB,yEAAyE;gBACzE,iEAAiE;gBACjE,IAAI,MAAM,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC;oBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAC,CAAA;gBAChG,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAA;gBAC/D,OAAO,SAAS,CAAC,GAAG,CAAC;oBACnB,CAAC,CAAC,IAAI,CAAC;wBACH,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS;wBACzD,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC;qBACjD,CAAC;oBACJ,CAAC,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACvE,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC,0CAA0C,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACnG,IAAI,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAE/D,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAA;YACjD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;YAE3B,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAC7B,mBAAmB,EACnB;gBACE,KAAK,EAAE,KAAK,IAAI,EAAE;gBAClB,QAAQ,EAAE,QAAQ,IAAI,EAAE;gBACxB,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC;aAC5C,EACD,GAAG,EACH,GAAG,CACJ,CAAY,CAAA;YAEb,2EAA2E;YAC3E,0EAA0E;YAC1E,sCAAsC;YACtC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAA;YACzC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;gBACxD,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACnF,CAAC;YAED,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC;gBAC9C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS;gBACT,OAAO,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;gBACzC,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;gBAChC,MAAM,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;gBACvC,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC;aAC9C,CAAC,CAAA;YACF,OAAO,IAAI;gBACT,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;gBAClC,CAAC,CAAC,WAAW,CACT,IAAI,CAAC;oBACH,EAAE,EAAE,IAAI;oBACR,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B,CAAC,EACF,EAAE,YAAY,EAAE,MAAM,EAAE,CACzB,CAAA;QACP,CAAC;KACF;IAED,SAAS,EAAE;QACT,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,CAAC,GAAiB,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACjD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC/C,IAAI,CAAC,QAAQ;gBAAE,OAAO,YAAY,EAAE,CAAA;YACpC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/D,IAAI,SAAS,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC/D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,MAAM;gBACR,MAAM,GAAG,CAAC,IAAI,CACZ,0BAA0B,EAC1B,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAC/F,GAAG,EACH,GAAG,CACJ,CAAA;YACH,MAAM,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACvB,4EAA4E;YAC5E,wEAAwE;YACxE,YAAY;YACZ,OAAO,SAAS,CAAC,GAAG,CAAC;gBACnB,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC5C,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QAC/E,CAAC;KACF;IAED,SAAS,EAAE;QACT,SAAS,EAAE,IAAI;QACf,OAAO,EAAE,CAAC,GAAiB,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACjD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC/C,IAAI,CAAC,QAAQ;gBAAE,OAAO,YAAY,EAAE,CAAA;YACpC,6EAA6E;YAC7E,2EAA2E;YAC3E,oEAAoE;YACpE,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;YAC3B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,CAAC,GAAG,CAAC,CAAA;YACrC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YACxD,OAAO,IAAI,CAAC;gBACV,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAA;QACJ,CAAC;KACF;IACD,GAAG,MAAM,CAAC,WAAW,CAClB,CAAC,YAAY,EAAE,OAAO,CAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,SAAS,IAAI,EAAE;QACf;YACE,SAAS,EAAE,IAAI;YACf,OAAO,EACL,CAAC,GAAiB,EAAS,EAAE,CAC7B,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;gBACjB,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;gBACrC,MAAM,CAAC,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;gBAC/B,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAE,MAAiB,EAAE,QAAQ,GAAG,KAAK,EAAE,EAAE,CAC1E,IAAI,CAAC;oBACH,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC;wBACjB,IAAI,EAAE,MAAM;wBACZ,KAAK,EAAE,CAAC,CAAC,cAAc,IAAI,OAAO,CAAC;wBACnC,IAAI,EAAE,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC;wBAC3B,IAAI,EAAE,eAAe,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;qBAC5D,CAAC;iBACH,CAAC,CAAA;gBACJ,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK;oBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;oBAAE,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBACtE,IAAI,SAAS,CAAC,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;gBAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAA;gBAC5B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,eAAe;oBACxC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAA;gBAC7D,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAC5B,uBAAuB,EACvB,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,EAClF,GAAG,EACH,GAAG,CACJ,CAAyE,CAAA;gBAC1E,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;oBAC9B,OAAO,MAAM,CACX,IAAI,CAAC,KAAK,IAAI,EAAE,EAChB,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,yBAAyB,CAAC,CAAC,CACjF,CAAA;gBACH,MAAM,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;gBAC9D,OAAO,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;YACpC,CAAC;SACJ;KACF,CAAC,CACH;CACF,CAAA"}

package/dist/modules/user/session-context.d.ts

@@ -0,0 +1,10 @@
+import type { SessionContext, SessionResolveContext } from '@ketvietlab/ketjs';
+/**
+ * Rebuild the session's scope from live rows on every request.
+ *
+ * The cookie is a cache of the user's last selection, never the authority for
+ * membership or active state. Revoking a company/branch or archiving either one
+ * therefore takes effect on the next request on every pod.
+ */
+export declare const resolveUserSession: ({ adapter, manifest, record, }: SessionResolveContext) => Promise<SessionContext | null>;
+//# sourceMappingURL=session-context.d.ts.map

package/dist/modules/user/session-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-context.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/user/session-context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAE9E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,mCAI5B,qBAAqB,KAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAyBvD,CAAA"}

package/dist/modules/user/session-context.js

@@ -0,0 +1,31 @@
+import { callFn } from '@ketvietlab/ketjs';
+/**
+ * Rebuild the session's scope from live rows on every request.
+ *
+ * The cookie is a cache of the user's last selection, never the authority for
+ * membership or active state. Revoking a company/branch or archiving either one
+ * therefore takes effect on the next request on every pod.
+ */
+export const resolveUserSession = async ({ adapter, manifest, record, }) => {
+    const result = await callFn('user.resolveSessionContext', {
+        userId: record.userId,
+        companyId: record.company,
+        branchId: record.branch,
+        companies: record.companies,
+        branches: record.branches,
+        securityVersion: record.securityVersion,
+    }, {
+        adapter,
+        manifest,
+        actor: record.userId,
+        scope: {
+            company: record.company,
+            companies: record.companies,
+            branch: record.branch,
+            branches: record.branches,
+        },
+    });
+    const value = result.value;
+    return value.ok && value.context ? value.context : null;
+};
+//# sourceMappingURL=session-context.js.map

package/dist/modules/user/session-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-context.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/user/session-context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAG1C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EAAE,EACvC,OAAO,EACP,QAAQ,EACR,MAAM,GACgB,EAAkC,EAAE;IAC1D,MAAM,MAAM,GAAG,MAAM,MAAM,CACzB,4BAA4B,EAC5B;QACE,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,OAAO;QACzB,QAAQ,EAAE,MAAM,CAAC,MAAM;QACvB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,eAAe,EAAE,MAAM,CAAC,eAAe;KACxC,EACD;QACE,OAAO;QACP,QAAQ;QACR,KAAK,EAAE,MAAM,CAAC,MAAM;QACpB,KAAK,EAAE;YACL,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B;KACF,CACF,CAAA;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAmD,CAAA;IACxE,OAAO,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AACzD,CAAC,CAAA"}

package/dist/modules/user_backend/index.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("@ketvietlab/ketjs").KetModule;
+export default _default;
+export { routes } from './routes.ts';
+export { presetsScreen, profileScreen, roleScreen, rolesScreen, userFormScreen, usersScreen, } from './screens.tsx';
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/user_backend/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/user_backend/index.ts"],"names":[],"mappings":";;AAuBA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EACL,aAAa,EACb,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,WAAW,GACZ,MAAM,eAAe,CAAA"}

package/dist/modules/user_backend/index.js

@@ -0,0 +1,24 @@
+import { defineModule } from '@ketvietlab/ketjs';
+import { menus } from './menus.js';
+import { messages } from './messages.js';
+import { routes } from './routes.js';
+export default defineModule({
+    name: 'user_backend',
+    version: '0.1.0',
+    depends: ['user', 'company', 'backend'],
+    install: 'auto',
+    app: true,
+    title: 'Người dùng và phân quyền',
+    summary: 'Quản lý tài khoản, vai trò, session và vòng đời truy cập.',
+    category: 'Hệ thống',
+    routes,
+    menus,
+    messages,
+    joints: {
+        'user.external-identities': { props: { userId: 'id' } },
+        'profile.external-identities': { props: { userId: 'id' } },
+    },
+});
+export { routes } from './routes.js';
+export { presetsScreen, profileScreen, roleScreen, rolesScreen, userFormScreen, usersScreen, } from './screens.js';
+//# sourceMappingURL=index.js.map

package/dist/modules/user_backend/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/user_backend/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAClC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,eAAe,YAAY,CAAC;IAC1B,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,OAAO;IAChB,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC;IACvC,OAAO,EAAE,MAAM;IACf,GAAG,EAAE,IAAI;IACT,KAAK,EAAE,0BAA0B;IACjC,OAAO,EAAE,2DAA2D;IACpE,QAAQ,EAAE,UAAU;IACpB,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM,EAAE;QACN,0BAA0B,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACvD,6BAA6B,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;KAC3D;CACF,CAAC,CAAA;AAEF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EACL,aAAa,EACb,aAAa,EACb,UAAU,EACV,WAAW,EACX,cAAc,EACd,WAAW,GACZ,MAAM,cAAe,CAAA"}

package/dist/modules/user_backend/menus.d.ts

@@ -0,0 +1,3 @@
+import type { MenuDef } from '@ketvietlab/ketjs';
+export declare const menus: Record<string, MenuDef>;
+//# sourceMappingURL=menus.d.ts.map

package/dist/modules/user_backend/menus.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"menus.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/user_backend/menus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAEhD,eAAO,MAAM,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAsBzC,CAAA"}

package/dist/modules/user_backend/menus.js

@@ -0,0 +1,24 @@
+export const menus = {
+    'admin.users': {
+        parent: 'admin.config',
+        label: 'menu.users',
+        path: '/admin/users',
+        needs: 'user.listUsers',
+        sequence: 25,
+    },
+    'admin.roles': {
+        parent: 'admin.config',
+        label: 'menu.roles',
+        path: '/admin/roles',
+        needs: 'user.listRoles',
+        sequence: 26,
+    },
+    'admin.permission-presets': {
+        parent: 'admin.config',
+        label: 'menu.presets',
+        path: '/admin/permission-presets',
+        needs: 'user.applyPreset',
+        sequence: 27,
+    },
+};
+//# sourceMappingURL=menus.js.map

package/dist/modules/user_backend/menus.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"menus.js","sourceRoot":"","sources":["../../../../../../../packages/ketsuite/src/modules/user_backend/menus.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,KAAK,GAA4B;IAC5C,aAAa,EAAE;QACb,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,EAAE;KACb;IACD,aAAa,EAAE;QACb,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,YAAY;QACnB,IAAI,EAAE,cAAc;QACpB,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,EAAE;KACb;IACD,0BAA0B,EAAE;QAC1B,MAAM,EAAE,cAAc;QACtB,KAAK,EAAE,cAAc;QACrB,IAAI,EAAE,2BAA2B;QACjC,KAAK,EAAE,kBAAkB;QACzB,QAAQ,EAAE,EAAE;KACb;CACF,CAAA"}

package/dist/modules/user_backend/messages.d.ts

@@ -0,0 +1,189 @@
+export declare const messages: {
+    vi: {
+        'app.title': string;
+        'app.summary': string;
+        'app.category': string;
+        'menu.users': string;
+        'menu.roles': string;
+        'menu.presets': string;
+        'users.title': string;
+        'users.create': string;
+        'users.empty': string;
+        'users.emptyHint': string;
+        'action.createUser': string;
+        'action.createRole': string;
+        'action.presets': string;
+        'action.save': string;
+        'action.cancel': string;
+        'action.saveCompanies': string;
+        'action.saveBranches': string;
+        'action.saveRoles': string;
+        'action.savePermissions': string;
+        'action.invitation': string;
+        'action.reset': string;
+        'action.applyPreset': string;
+        'filter.includeArchived': string;
+        'filter.activeOnly': string;
+        'field.name': string;
+        'field.login': string;
+        'field.email': string;
+        'field.partnerId': string;
+        'field.accessKind': string;
+        'field.credential': string;
+        'field.initialPassword': string;
+        'field.initialPasswordHint': string;
+        'field.superuser': string;
+        'field.state': string;
+        'field.description': string;
+        'access.internal': string;
+        'access.portal': string;
+        'access.public': string;
+        'state.active': string;
+        'state.archived': string;
+        'state.passwordReady': string;
+        'state.invitationPending': string;
+        'identity.title': string;
+        'identity.createHint': string;
+        'access.title': string;
+        'access.hint': string;
+        'security.title': string;
+        'security.hint': string;
+        'token.onceTitle': string;
+        'token.onceHint': string;
+        'token.link': string;
+        'token.copyNow': string;
+        'sessions.title': string;
+        'sessions.empty': string;
+        'sessions.emptyHint': string;
+        'sessions.created': string;
+        'sessions.context': string;
+        'sessions.current': string;
+        'sessions.revoke': string;
+        'roles.title': string;
+        'roles.create': string;
+        'roles.empty': string;
+        'roles.emptyHint': string;
+        'roles.identity': string;
+        'roles.permissionHint': string;
+        'task.read': string;
+        'task.operate': string;
+        'task.manage': string;
+        'presets.title': string;
+        'presets.apply': string;
+        'presets.hint': string;
+        'presets.module': string;
+        'presets.level': string;
+        'presets.user': string;
+        'presets.manager': string;
+        'presets.done': string;
+        'profile.title': string;
+        'profile.account': string;
+        'profile.timezone': string;
+        'profile.saveTimezone': string;
+        'profile.password': string;
+        'profile.currentPassword': string;
+        'profile.newPassword': string;
+        'profile.changePassword': string;
+        'error.notFound': string;
+        'error.roleNotFound': string;
+        'error.companyRequired': string;
+        'error.rootMissing': string;
+        'error.branchDefaultRequired': string;
+        'error.sessionsUnavailable': string;
+        'error.unauthorized': string;
+    };
+    en: {
+        'app.title': string;
+        'app.summary': string;
+        'app.category': string;
+        'menu.users': string;
+        'menu.roles': string;
+        'menu.presets': string;
+        'users.title': string;
+        'users.create': string;
+        'users.empty': string;
+        'users.emptyHint': string;
+        'action.createUser': string;
+        'action.createRole': string;
+        'action.presets': string;
+        'action.save': string;
+        'action.cancel': string;
+        'action.saveCompanies': string;
+        'action.saveBranches': string;
+        'action.saveRoles': string;
+        'action.savePermissions': string;
+        'action.invitation': string;
+        'action.reset': string;
+        'action.applyPreset': string;
+        'filter.includeArchived': string;
+        'filter.activeOnly': string;
+        'field.name': string;
+        'field.login': string;
+        'field.email': string;
+        'field.partnerId': string;
+        'field.accessKind': string;
+        'field.credential': string;
+        'field.initialPassword': string;
+        'field.initialPasswordHint': string;
+        'field.superuser': string;
+        'field.state': string;
+        'field.description': string;
+        'access.internal': string;
+        'access.portal': string;
+        'access.public': string;
+        'state.active': string;
+        'state.archived': string;
+        'state.passwordReady': string;
+        'state.invitationPending': string;
+        'identity.title': string;
+        'identity.createHint': string;
+        'access.title': string;
+        'access.hint': string;
+        'security.title': string;
+        'security.hint': string;
+        'token.onceTitle': string;
+        'token.onceHint': string;
+        'token.link': string;
+        'token.copyNow': string;
+        'sessions.title': string;
+        'sessions.empty': string;
+        'sessions.emptyHint': string;
+        'sessions.created': string;
+        'sessions.context': string;
+        'sessions.current': string;
+        'sessions.revoke': string;
+        'roles.title': string;
+        'roles.create': string;
+        'roles.empty': string;
+        'roles.emptyHint': string;
+        'roles.identity': string;
+        'roles.permissionHint': string;
+        'task.read': string;
+        'task.operate': string;
+        'task.manage': string;
+        'presets.title': string;
+        'presets.apply': string;
+        'presets.hint': string;
+        'presets.module': string;
+        'presets.level': string;
+        'presets.user': string;
+        'presets.manager': string;
+        'presets.done': string;
+        'profile.title': string;
+        'profile.account': string;
+        'profile.timezone': string;
+        'profile.saveTimezone': string;
+        'profile.password': string;
+        'profile.currentPassword': string;
+        'profile.newPassword': string;
+        'profile.changePassword': string;
+        'error.notFound': string;
+        'error.roleNotFound': string;
+        'error.companyRequired': string;
+        'error.rootMissing': string;
+        'error.branchDefaultRequired': string;
+        'error.sessionsUnavailable': string;
+        'error.unauthorized': string;
+    };
+};
+//# sourceMappingURL=messages.d.ts.map

package/dist/modules/user_backend/messages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"messages.d.ts","sourceRoot":"","sources":["../../../../../../packages/ketsuite/src/modules/user_backend/messages.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,QAAQ;IACnB,EAAE;QACA,WAAW;QACX,aAAa;QACb,cAAc;QACd,YAAY;QACZ,YAAY;QACZ,cAAc;QACd,aAAa;QACb,cAAc;QACd,aAAa;QACb,iBAAiB;QACjB,mBAAmB;QACnB,mBAAmB;QACnB,gBAAgB;QAChB,aAAa;QACb,eAAe;QACf,sBAAsB;QACtB,qBAAqB;QACrB,kBAAkB;QAClB,wBAAwB;QACxB,mBAAmB;QACnB,cAAc;QACd,oBAAoB;QACpB,wBAAwB;QACxB,mBAAmB;QACnB,YAAY;QACZ,aAAa;QACb,aAAa;QACb,iBAAiB;QACjB,kBAAkB;QAClB,kBAAkB;QAClB,uBAAuB;QACvB,2BAA2B;QAC3B,iBAAiB;QACjB,aAAa;QACb,mBAAmB;QACnB,iBAAiB;QACjB,eAAe;QACf,eAAe;QACf,cAAc;QACd,gBAAgB;QAChB,qBAAqB;QACrB,yBAAyB;QACzB,gBAAgB;QAChB,qBAAqB;QAErB,cAAc;QACd,aAAa;QACb,gBAAgB;QAChB,eAAe;QACf,iBAAiB;QACjB,gBAAgB;QAChB,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,gBAAgB;QAChB,oBAAoB;QACpB,kBAAkB;QAClB,kBAAkB;QAClB,kBAAkB;QAClB,iBAAiB;QACjB,aAAa;QACb,cAAc;QACd,aAAa;QACb,iBAAiB;QACjB,gBAAgB;QAChB,sBAAsB;QACtB,WAAW;QACX,cAAc;QACd,aAAa;QACb,eAAe;QACf,eAAe;QACf,cAAc;QACd,gBAAgB;QAChB,eAAe;QACf,cAAc;QACd,iBAAiB;QACjB,cAAc;QACd,eAAe;QACf,iBAAiB;QACjB,kBAAkB;QAClB,sBAAsB;QACtB,kBAAkB;QAClB,yBAAyB;QACzB,qBAAqB;QACrB,wBAAwB;QACxB,gBAAgB;QAChB,oBAAoB;QACpB,uBAAuB;QACvB,mBAAmB;QACnB,6BAA6B;QAC7B,2BAA2B;QAC3B,oBAAoB;;IAEtB,EAAE;QACA,WAAW;QACX,aAAa;QACb,cAAc;QACd,YAAY;QACZ,YAAY;QACZ,cAAc;QACd,aAAa;QACb,cAAc;QACd,aAAa;QACb,iBAAiB;QACjB,mBAAmB;QACnB,mBAAmB;QACnB,gBAAgB;QAChB,aAAa;QACb,eAAe;QACf,sBAAsB;QACtB,qBAAqB;QACrB,kBAAkB;QAClB,wBAAwB;QACxB,mBAAmB;QACnB,cAAc;QACd,oBAAoB;QACpB,wBAAwB;QACxB,mBAAmB;QACnB,YAAY;QACZ,aAAa;QACb,aAAa;QACb,iBAAiB;QACjB,kBAAkB;QAClB,kBAAkB;QAClB,uBAAuB;QACvB,2BAA2B;QAC3B,iBAAiB;QACjB,aAAa;QACb,mBAAmB;QACnB,iBAAiB;QACjB,eAAe;QACf,eAAe;QACf,cAAc;QACd,gBAAgB;QAChB,qBAAqB;QACrB,yBAAyB;QACzB,gBAAgB;QAChB,qBAAqB;QAErB,cAAc;QACd,aAAa;QACb,gBAAgB;QAChB,eAAe;QACf,iBAAiB;QACjB,gBAAgB;QAEhB,YAAY;QACZ,eAAe;QACf,gBAAgB;QAChB,gBAAgB;QAChB,oBAAoB;QACpB,kBAAkB;QAClB,kBAAkB;QAClB,kBAAkB;QAClB,iBAAiB;QACjB,aAAa;QACb,cAAc;QACd,aAAa;QACb,iBAAiB;QACjB,gBAAgB;QAChB,sBAAsB;QAEtB,WAAW;QACX,cAAc;QACd,aAAa;QACb,eAAe;QACf,eAAe;QACf,cAAc;QAEd,gBAAgB;QAChB,eAAe;QACf,cAAc;QACd,iBAAiB;QACjB,cAAc;QACd,eAAe;QACf,iBAAiB;QACjB,kBAAkB;QAClB,sBAAsB;QACtB,kBAAkB;QAClB,yBAAyB;QACzB,qBAAqB;QACrB,wBAAwB;QACxB,gBAAgB;QAChB,oBAAoB;QACpB,uBAAuB;QACvB,mBAAmB;QACnB,6BAA6B;QAC7B,2BAA2B;QAC3B,oBAAoB;;CAEvB,CAAA"}