@lenne.tech/nest-server 11.20.1 → 11.21.0

package/dist/core/modules/tenant/core-tenant.enums.d.ts

@@ -0,0 +1,13 @@
+export declare const TENANT_MEMBER_MODEL_TOKEN = "TenantMember";
+export declare enum TenantMemberStatus {
+    ACTIVE = "ACTIVE",
+    INVITED = "INVITED",
+    SUSPENDED = "SUSPENDED"
+}
+export declare const DEFAULT_ROLE_HIERARCHY: Record<string, number>;
+export declare function createHierarchyRoles<T extends Record<string, number>>(hierarchy: T): {
+    [K in keyof T as Uppercase<string & K>]: string & K;
+};
+export declare const DefaultHR: {
+    [x: Uppercase<string>]: string;
+};

package/dist/core/modules/tenant/core-tenant.enums.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DefaultHR = exports.DEFAULT_ROLE_HIERARCHY = exports.TenantMemberStatus = exports.TENANT_MEMBER_MODEL_TOKEN = void 0;
+exports.createHierarchyRoles = createHierarchyRoles;
+exports.TENANT_MEMBER_MODEL_TOKEN = 'TenantMember';
+var TenantMemberStatus;
+(function (TenantMemberStatus) {
+    TenantMemberStatus["ACTIVE"] = "ACTIVE";
+    TenantMemberStatus["INVITED"] = "INVITED";
+    TenantMemberStatus["SUSPENDED"] = "SUSPENDED";
+})(TenantMemberStatus || (exports.TenantMemberStatus = TenantMemberStatus = {}));
+exports.DEFAULT_ROLE_HIERARCHY = {
+    member: 1,
+    manager: 2,
+    owner: 3,
+};
+function createHierarchyRoles(hierarchy) {
+    const result = {};
+    for (const key of Object.keys(hierarchy)) {
+        result[key.toUpperCase()] = key;
+    }
+    return result;
+}
+exports.DefaultHR = createHierarchyRoles(exports.DEFAULT_ROLE_HIERARCHY);
+//# sourceMappingURL=core-tenant.enums.js.map

package/dist/core/modules/tenant/core-tenant.enums.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-tenant.enums.js","sourceRoot":"","sources":["../../../../src/core/modules/tenant/core-tenant.enums.ts"],"names":[],"mappings":";;;AAuDA,oDAQC;AA3DY,QAAA,yBAAyB,GAAG,cAAc,CAAC;AAKxD,IAAY,kBAKX;AALD,WAAY,kBAAkB;IAC5B,uCAAiB,CAAA;IAEjB,yCAAmB,CAAA;IACnB,6CAAuB,CAAA;AACzB,CAAC,EALW,kBAAkB,kCAAlB,kBAAkB,QAK7B;AAmBY,QAAA,sBAAsB,GAA2B;IAC5D,MAAM,EAAE,CAAC;IACT,OAAO,EAAE,CAAC;IACV,KAAK,EAAE,CAAC;CACT,CAAC;AAkBF,SAAgB,oBAAoB,CAClC,SAAY;IAEZ,MAAM,MAAM,GAAG,EAAS,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAaY,QAAA,SAAS,GAAG,oBAAoB,CAAC,8BAAsB,CAAC,CAAC"}

package/dist/core/modules/tenant/core-tenant.guard.d.ts

@@ -0,0 +1,13 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { Model } from 'mongoose';
+import { CoreTenantMemberModel } from './core-tenant-member.model';
+export declare class CoreTenantGuard implements CanActivate {
+    private readonly reflector;
+    private readonly memberModel;
+    private readonly logger;
+    constructor(reflector: Reflector, memberModel: Model<CoreTenantMemberModel>);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+    private resolveUserTenantIds;
+    private getRequest;
+}

package/dist/core/modules/tenant/core-tenant.guard.js

@@ -0,0 +1,162 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var CoreTenantGuard_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreTenantGuard = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const graphql_1 = require("@nestjs/graphql");
+const mongoose_1 = require("@nestjs/mongoose");
+const mongoose_2 = require("mongoose");
+const role_enum_1 = require("../../common/enums/role.enum");
+const config_service_1 = require("../../common/services/config.service");
+const core_tenant_decorators_1 = require("./core-tenant.decorators");
+const core_tenant_enums_1 = require("./core-tenant.enums");
+const core_tenant_helpers_1 = require("./core-tenant.helpers");
+let CoreTenantGuard = CoreTenantGuard_1 = class CoreTenantGuard {
+    reflector;
+    memberModel;
+    logger = new common_1.Logger(CoreTenantGuard_1.name);
+    constructor(reflector, memberModel) {
+        this.reflector = reflector;
+        this.memberModel = memberModel;
+    }
+    async canActivate(context) {
+        const config = config_service_1.ConfigService.configFastButReadOnly?.multiTenancy;
+        if (!config || config.enabled === false) {
+            return true;
+        }
+        const request = this.getRequest(context);
+        if (!request) {
+            return true;
+        }
+        const headerName = (config.headerName ?? 'x-tenant-id').toLowerCase();
+        const rawHeader = request.headers?.[headerName];
+        const headerTenantId = rawHeader && typeof rawHeader === 'string' && rawHeader.length <= 128 ? rawHeader.trim() : undefined;
+        const rolesMetadata = this.reflector.getAll('roles', [context.getHandler(), context.getClass()]);
+        const roles = (0, core_tenant_helpers_1.mergeRolesMetadata)(rolesMetadata);
+        const checkableRoles = roles.filter((r) => !(0, core_tenant_helpers_1.isSystemRole)(r));
+        const minRequiredLevel = (0, core_tenant_helpers_1.getMinRequiredLevel)(checkableRoles);
+        const user = request.user;
+        const adminBypass = config.adminBypass !== false;
+        const isAdmin = adminBypass && user?.roles?.includes(role_enum_1.RoleEnum.ADMIN);
+        const skipTenantCheck = this.reflector.getAllAndOverride(core_tenant_decorators_1.SKIP_TENANT_CHECK_KEY, [
+            context.getHandler(),
+            context.getClass(),
+        ]);
+        if (skipTenantCheck) {
+            if (checkableRoles.length > 0 && user) {
+                if (!isAdmin && !(0, core_tenant_helpers_1.checkRoleAccess)(checkableRoles, user.roles, undefined)) {
+                    throw new common_1.ForbiddenException('Insufficient role');
+                }
+            }
+            return true;
+        }
+        if (headerTenantId) {
+            if (isAdmin) {
+                request.tenantId = headerTenantId;
+                request.isAdminBypass = true;
+                const requiredRole = checkableRoles.length > 0 ? checkableRoles.join(',') : 'none';
+                this.logger.log(`Admin bypass: user ${user.id} accessing tenant ${headerTenantId} (required: ${requiredRole})`);
+                return true;
+            }
+            if (!user) {
+                throw new common_1.ForbiddenException('Authentication required for tenant access');
+            }
+            const membership = await this.memberModel
+                .findOne({
+                status: core_tenant_enums_1.TenantMemberStatus.ACTIVE,
+                tenant: headerTenantId,
+                user: user.id,
+            })
+                .lean()
+                .exec();
+            if (!membership) {
+                throw new common_1.ForbiddenException('Not a member of this tenant');
+            }
+            const memberRole = membership.role;
+            if (checkableRoles.length > 0) {
+                if (!(0, core_tenant_helpers_1.checkRoleAccess)(checkableRoles, undefined, memberRole)) {
+                    throw new common_1.ForbiddenException('Insufficient tenant role');
+                }
+            }
+            request.tenantId = headerTenantId;
+            request.tenantRole = memberRole;
+            return true;
+        }
+        if (isAdmin) {
+            request.isAdminBypass = true;
+            return true;
+        }
+        if (checkableRoles.length > 0) {
+            if (!user) {
+                throw new common_1.ForbiddenException('Authentication required');
+            }
+            if (!(0, core_tenant_helpers_1.checkRoleAccess)(checkableRoles, user.roles, undefined)) {
+                throw new common_1.ForbiddenException('Insufficient role');
+            }
+            await this.resolveUserTenantIds(request, minRequiredLevel);
+            return true;
+        }
+        if (user) {
+            await this.resolveUserTenantIds(request);
+        }
+        return true;
+    }
+    async resolveUserTenantIds(request, minLevel) {
+        if (request.tenantIds) {
+            return;
+        }
+        const memberships = await this.memberModel
+            .find({
+            status: core_tenant_enums_1.TenantMemberStatus.ACTIVE,
+            user: request.user.id,
+        })
+            .select('tenant role')
+            .lean()
+            .exec();
+        if (minLevel !== undefined) {
+            const hierarchy = (0, core_tenant_helpers_1.getRoleHierarchy)();
+            request.tenantIds = memberships
+                .filter((m) => {
+                const level = hierarchy[m.role] ?? 0;
+                return level >= minLevel;
+            })
+                .map((m) => m.tenant);
+        }
+        else {
+            request.tenantIds = memberships.map((m) => m.tenant);
+        }
+    }
+    getRequest(context) {
+        if (context.getType() === 'graphql') {
+            const ctx = graphql_1.GqlExecutionContext.create(context);
+            return ctx.getContext()?.req;
+        }
+        try {
+            return context.switchToHttp().getRequest();
+        }
+        catch {
+            return null;
+        }
+    }
+};
+exports.CoreTenantGuard = CoreTenantGuard;
+exports.CoreTenantGuard = CoreTenantGuard = CoreTenantGuard_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, mongoose_1.InjectModel)(core_tenant_enums_1.TENANT_MEMBER_MODEL_TOKEN)),
+    __metadata("design:paramtypes", [core_1.Reflector,
+        mongoose_2.Model])
+], CoreTenantGuard);
+//# sourceMappingURL=core-tenant.guard.js.map

package/dist/core/modules/tenant/core-tenant.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-tenant.guard.js","sourceRoot":"","sources":["../../../../src/core/modules/tenant/core-tenant.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAuG;AACvG,uCAAyC;AACzC,6CAAsE;AACtE,+CAA+C;AAC/C,uCAAiC;AAEjC,4DAAwD;AACxD,yEAAqE;AAErE,qEAAiE;AACjE,2DAAoF;AACpF,+DAM+B;AA2CxB,IAAM,eAAe,uBAArB,MAAM,eAAe;IAIP;IACwC;IAJ1C,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;IAE3D,YACmB,SAAoB,EACoB,WAAyC;QADjF,cAAS,GAAT,SAAS,CAAW;QACoB,gBAAW,GAAX,WAAW,CAA8B;IACjG,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,MAAM,GAAG,8BAAa,CAAC,qBAAqB,EAAE,YAAY,CAAC;QACjE,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;QACtE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,UAAU,CAAuB,CAAC;QACtE,MAAM,cAAc,GAClB,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAGvG,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAa,OAAO,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC7G,MAAM,KAAK,GAAG,IAAA,wCAAkB,EAAC,aAAa,CAAC,CAAC;QAChD,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,kCAAY,EAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,gBAAgB,GAAG,IAAA,yCAAmB,EAAC,cAAc,CAAC,CAAC;QAE7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC;QACjD,MAAM,OAAO,GAAG,WAAW,IAAI,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,oBAAQ,CAAC,KAAK,CAAC,CAAC;QAGrE,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAU,8CAAqB,EAAE;YACvF,OAAO,CAAC,UAAU,EAAE;YACpB,OAAO,CAAC,QAAQ,EAAE;SACnB,CAAC,CAAC;QACH,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;gBACtC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAA,qCAAe,EAAC,cAAc,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;oBACxE,MAAM,IAAI,2BAAkB,CAAC,mBAAmB,CAAC,CAAC;gBACpD,CAAC;YACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,IAAI,cAAc,EAAE,CAAC;YAGnB,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,QAAQ,GAAG,cAAc,CAAC;gBAClC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;gBAC7B,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;gBACnF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,EAAE,qBAAqB,cAAc,eAAe,YAAY,GAAG,CAAC,CAAC;gBAChH,OAAO,IAAI,CAAC;YACd,CAAC;YAGD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,2BAAkB,CAAC,2CAA2C,CAAC,CAAC;YAC5E,CAAC;YAGD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW;iBACtC,OAAO,CAAC;gBACP,MAAM,EAAE,sCAAkB,CAAC,MAAM;gBACjC,MAAM,EAAE,cAAc;gBACtB,IAAI,EAAE,IAAI,CAAC,EAAE;aACd,CAAC;iBACD,IAAI,EAAE;iBACN,IAAI,EAAE,CAAC;YAEV,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,2BAAkB,CAAC,6BAA6B,CAAC,CAAC;YAC9D,CAAC;YAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAc,CAAC;YAG7C,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAA,qCAAe,EAAC,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;oBAC5D,MAAM,IAAI,2BAAkB,CAAC,0BAA0B,CAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YAID,OAAO,CAAC,QAAQ,GAAG,cAAc,CAAC;YAClC,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QAKD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAGD,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAE9B,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,2BAAkB,CAAC,yBAAyB,CAAC,CAAC;YAC1D,CAAC;YAGD,IAAI,CAAC,IAAA,qCAAe,EAAC,cAAc,EAAE,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,2BAAkB,CAAC,mBAAmB,CAAC,CAAC;YACpD,CAAC;YAGD,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QAID,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC3C,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IASO,KAAK,CAAC,oBAAoB,CAAC,OAAY,EAAE,QAAiB;QAEhE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW;aACvC,IAAI,CAAC;YACJ,MAAM,EAAE,sCAAkB,CAAC,MAAM;YACjC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;SACtB,CAAC;aACD,MAAM,CAAC,aAAa,CAAC;aACrB,IAAI,EAAE;aACN,IAAI,EAAE,CAAC;QAEV,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,IAAA,sCAAgB,GAAE,CAAC;YACrC,OAAO,CAAC,SAAS,GAAG,WAAW;iBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBACZ,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAc,CAAC,IAAI,CAAC,CAAC;gBAC/C,OAAO,KAAK,IAAI,QAAQ,CAAC;YAC3B,CAAC,CAAC;iBACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAKO,UAAU,CAAC,OAAyB;QAC1C,IAAI,OAAO,CAAC,OAAO,EAAkB,KAAK,SAAS,EAAE,CAAC;YACpD,MAAM,GAAG,GAAG,6BAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO,GAAG,CAAC,UAAU,EAAE,EAAE,GAAG,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAA;AAnLY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,sBAAW,EAAC,6CAAyB,CAAC,CAAA;qCADX,gBAAS;QACiC,gBAAK;GALlE,eAAe,CAmL3B"}

package/dist/core/modules/tenant/core-tenant.helpers.d.ts

@@ -0,0 +1,7 @@
+export declare function mergeRolesMetadata(meta: (string[] | undefined)[]): string[];
+export declare function getRoleHierarchy(): Record<string, number>;
+export declare function isSystemRole(role: string): boolean;
+export declare function isMultiTenancyActive(): boolean;
+export declare function isHierarchyRole(role: string): boolean;
+export declare function getMinRequiredLevel(roles: string[]): number | undefined;
+export declare function checkRoleAccess(requiredRoles: string[], userRoles?: string[], tenantRole?: string): boolean;

package/dist/core/modules/tenant/core-tenant.helpers.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeRolesMetadata = mergeRolesMetadata;
+exports.getRoleHierarchy = getRoleHierarchy;
+exports.isSystemRole = isSystemRole;
+exports.isMultiTenancyActive = isMultiTenancyActive;
+exports.isHierarchyRole = isHierarchyRole;
+exports.getMinRequiredLevel = getMinRequiredLevel;
+exports.checkRoleAccess = checkRoleAccess;
+const config_service_1 = require("../../common/services/config.service");
+const core_tenant_enums_1 = require("./core-tenant.enums");
+const SYSTEM_ROLE_PREFIX = 's_';
+function mergeRolesMetadata(meta) {
+    return meta[0] ? (meta[1] ? [...meta[0], ...meta[1]] : meta[0]) : meta[1] || [];
+}
+function getRoleHierarchy() {
+    return config_service_1.ConfigService.configFastButReadOnly?.multiTenancy?.roleHierarchy ?? core_tenant_enums_1.DEFAULT_ROLE_HIERARCHY;
+}
+function isSystemRole(role) {
+    return role.startsWith(SYSTEM_ROLE_PREFIX);
+}
+function isMultiTenancyActive() {
+    const config = config_service_1.ConfigService.configFastButReadOnly?.multiTenancy;
+    return !!config && config.enabled !== false;
+}
+function isHierarchyRole(role) {
+    if (!isMultiTenancyActive())
+        return false;
+    const hierarchy = getRoleHierarchy();
+    return role in hierarchy;
+}
+function getMinRequiredLevel(roles) {
+    const hierarchy = getRoleHierarchy();
+    const levels = roles.filter((r) => r in hierarchy).map((r) => hierarchy[r]);
+    if (levels.length === 0)
+        return undefined;
+    return Math.min(...levels);
+}
+function checkRoleAccess(requiredRoles, userRoles, tenantRole) {
+    const availableRoles = tenantRole ? [tenantRole] : (userRoles ?? []);
+    if (availableRoles.length === 0)
+        return false;
+    const multiTenancyActive = isMultiTenancyActive();
+    const hierarchy = multiTenancyActive ? getRoleHierarchy() : {};
+    const hierarchyRequired = requiredRoles.filter((r) => r in hierarchy);
+    const nonHierarchyRequired = requiredRoles.filter((r) => !(r in hierarchy));
+    if (hierarchyRequired.length === 0 && nonHierarchyRequired.length === 0)
+        return true;
+    if (hierarchyRequired.length > 0) {
+        const minRequired = Math.min(...hierarchyRequired.map((r) => hierarchy[r]));
+        if (availableRoles.some((r) => r in hierarchy && hierarchy[r] >= minRequired))
+            return true;
+    }
+    if (nonHierarchyRequired.length > 0) {
+        if (nonHierarchyRequired.some((r) => availableRoles.includes(r)))
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=core-tenant.helpers.js.map

package/dist/core/modules/tenant/core-tenant.helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-tenant.helpers.js","sourceRoot":"","sources":["../../../../src/core/modules/tenant/core-tenant.helpers.ts"],"names":[],"mappings":";;AAWA,gDAEC;AAKD,4CAEC;AAMD,oCAEC;AAKD,oDAGC;AAMD,0CAIC;AAOD,kDAKC;AAkBD,0CA0BC;AAtGD,yEAAqE;AACrE,2DAA6D;AAE7D,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAQhC,SAAgB,kBAAkB,CAAC,IAA8B;IAC/D,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAClF,CAAC;AAKD,SAAgB,gBAAgB;IAC9B,OAAO,8BAAa,CAAC,qBAAqB,EAAE,YAAY,EAAE,aAAa,IAAI,0CAAsB,CAAC;AACpG,CAAC;AAMD,SAAgB,YAAY,CAAC,IAAY;IACvC,OAAO,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAC7C,CAAC;AAKD,SAAgB,oBAAoB;IAClC,MAAM,MAAM,GAAG,8BAAa,CAAC,qBAAqB,EAAE,YAAY,CAAC;IACjE,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC;AAC9C,CAAC;AAMD,SAAgB,eAAe,CAAC,IAAY;IAC1C,IAAI,CAAC,oBAAoB,EAAE;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,OAAO,IAAI,IAAI,SAAS,CAAC;AAC3B,CAAC;AAOD,SAAgB,mBAAmB,CAAC,KAAe;IACjD,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;AAC7B,CAAC;AAkBD,SAAgB,eAAe,CAAC,aAAuB,EAAE,SAAoB,EAAE,UAAmB;IAChG,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACrE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAG9C,MAAM,kBAAkB,GAAG,oBAAoB,EAAE,CAAC;IAClD,MAAM,SAAS,GAAG,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;IACtE,MAAM,oBAAoB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC;IAE5E,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAKrF,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC;IAC7F,CAAC;IAGD,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAChF,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/core/modules/tenant/core-tenant.module.d.ts

@@ -0,0 +1,12 @@
+import { CanActivate, DynamicModule, Type } from '@nestjs/common';
+import { CoreTenantMemberModel } from './core-tenant-member.model';
+import { CoreTenantService } from './core-tenant.service';
+export interface CoreTenantModuleOptions {
+    memberModel?: Type<CoreTenantMemberModel>;
+    guard?: Type<CanActivate>;
+    service?: Type<CoreTenantService>;
+    modelName?: string;
+}
+export declare class CoreTenantModule {
+    static forRoot(options?: CoreTenantModuleOptions): DynamicModule;
+}

package/dist/core/modules/tenant/core-tenant.module.js

@@ -0,0 +1,58 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var CoreTenantModule_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreTenantModule = void 0;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const mongoose_1 = require("@nestjs/mongoose");
+const core_tenant_member_model_1 = require("./core-tenant-member.model");
+const core_tenant_enums_1 = require("./core-tenant.enums");
+const core_tenant_guard_1 = require("./core-tenant.guard");
+const core_tenant_service_1 = require("./core-tenant.service");
+let CoreTenantModule = CoreTenantModule_1 = class CoreTenantModule {
+    static forRoot(options = {}) {
+        const MemberModel = options.memberModel || core_tenant_member_model_1.CoreTenantMemberModel;
+        const Guard = options.guard || core_tenant_guard_1.CoreTenantGuard;
+        const Service = options.service || core_tenant_service_1.CoreTenantService;
+        const modelName = options.modelName || core_tenant_enums_1.TENANT_MEMBER_MODEL_TOKEN;
+        const memberSchema = mongoose_1.SchemaFactory.createForClass(MemberModel);
+        memberSchema.index({ user: 1, tenant: 1 }, { unique: true });
+        memberSchema.index({ user: 1, tenant: 1, status: 1 });
+        const providers = [
+            {
+                provide: core_tenant_service_1.CoreTenantService,
+                useClass: Service,
+            },
+            {
+                provide: core_1.APP_GUARD,
+                useClass: Guard,
+            },
+        ];
+        if (modelName !== core_tenant_enums_1.TENANT_MEMBER_MODEL_TOKEN) {
+            providers.push({
+                provide: (0, mongoose_1.getModelToken)(core_tenant_enums_1.TENANT_MEMBER_MODEL_TOKEN),
+                useFactory: (model) => model,
+                inject: [(0, mongoose_1.getModelToken)(modelName)],
+            });
+        }
+        return {
+            exports: [core_tenant_service_1.CoreTenantService],
+            global: true,
+            imports: [mongoose_1.MongooseModule.forFeature([{ name: modelName, schema: memberSchema }])],
+            module: CoreTenantModule_1,
+            providers,
+        };
+    }
+};
+exports.CoreTenantModule = CoreTenantModule;
+exports.CoreTenantModule = CoreTenantModule = CoreTenantModule_1 = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({})
+], CoreTenantModule);
+//# sourceMappingURL=core-tenant.module.js.map

package/dist/core/modules/tenant/core-tenant.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-tenant.module.js","sourceRoot":"","sources":["../../../../src/core/modules/tenant/core-tenant.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAkF;AAClF,uCAAyC;AACzC,+CAAgF;AAGhF,yEAAmE;AACnE,2DAAgE;AAChE,2DAAsD;AACtD,+DAA0D;AAkDnD,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,UAAmC,EAAE;QAClD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,gDAAqB,CAAC;QACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,mCAAe,CAAC;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,uCAAiB,CAAC;QACrD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,6CAAyB,CAAC;QAEjE,MAAM,YAAY,GAAG,wBAAa,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QAG/D,YAAY,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAE7D,YAAY,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAEtD,MAAM,SAAS,GAAU;YACvB;gBACE,OAAO,EAAE,uCAAiB;gBAC1B,QAAQ,EAAE,OAAO;aAClB;YACD;gBACE,OAAO,EAAE,gBAAS;gBAClB,QAAQ,EAAE,KAAK;aAChB;SACF,CAAC;QAIF,IAAI,SAAS,KAAK,6CAAyB,EAAE,CAAC;YAC5C,SAAS,CAAC,IAAI,CAAC;gBACb,OAAO,EAAE,IAAA,wBAAa,EAAC,6CAAyB,CAAC;gBACjD,UAAU,EAAE,CAAC,KAAiB,EAAE,EAAE,CAAC,KAAK;gBACxC,MAAM,EAAE,CAAC,IAAA,wBAAa,EAAC,SAAS,CAAC,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAED,OAAO;YACL,OAAO,EAAE,CAAC,uCAAiB,CAAC;YAC5B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,CAAC,yBAAc,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;YACjF,MAAM,EAAE,kBAAgB;YACxB,SAAS;SACV,CAAC;IACJ,CAAC;CACF,CAAA;AA3CY,4CAAgB;2BAAhB,gBAAgB;IAF5B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,gBAAgB,CA2C5B"}

package/dist/core/modules/tenant/core-tenant.service.d.ts

@@ -0,0 +1,17 @@
+import { Logger } from '@nestjs/common';
+import { Model } from 'mongoose';
+import { CoreTenantMemberModel } from './core-tenant-member.model';
+export declare class CoreTenantService {
+    protected readonly memberModel: Model<CoreTenantMemberModel>;
+    protected readonly logger: Logger;
+    constructor(memberModel: Model<CoreTenantMemberModel>);
+    protected getHierarchy(): Record<string, number>;
+    protected getDefaultRole(): string;
+    protected getHighestRole(): string;
+    findMemberships(userId: string): Promise<CoreTenantMemberModel[]>;
+    getMembership(tenantId: string, userId: string): Promise<CoreTenantMemberModel | null>;
+    addMember(tenantId: string, userId: string, role?: string, invitedById?: string): Promise<CoreTenantMemberModel>;
+    removeMember(tenantId: string, userId: string): Promise<CoreTenantMemberModel>;
+    updateMemberRole(tenantId: string, userId: string, role: string): Promise<CoreTenantMemberModel>;
+    assertNotLastOwner(tenantId: string, userId: string): Promise<void>;
+}

package/dist/core/modules/tenant/core-tenant.service.js

@@ -0,0 +1,160 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var CoreTenantService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CoreTenantService = void 0;
+const common_1 = require("@nestjs/common");
+const mongoose_1 = require("@nestjs/mongoose");
+const mongoose_2 = require("mongoose");
+const config_service_1 = require("../../common/services/config.service");
+const request_context_service_1 = require("../../common/services/request-context.service");
+const core_tenant_enums_1 = require("./core-tenant.enums");
+let CoreTenantService = CoreTenantService_1 = class CoreTenantService {
+    memberModel;
+    logger = new common_1.Logger(CoreTenantService_1.name);
+    constructor(memberModel) {
+        this.memberModel = memberModel;
+    }
+    getHierarchy() {
+        return config_service_1.ConfigService.configFastButReadOnly?.multiTenancy?.roleHierarchy ?? core_tenant_enums_1.DEFAULT_ROLE_HIERARCHY;
+    }
+    getDefaultRole() {
+        const hierarchy = this.getHierarchy();
+        const entries = Object.entries(hierarchy);
+        if (entries.length === 0)
+            return 'member';
+        return entries.reduce((a, b) => (a[1] <= b[1] ? a : b))[0];
+    }
+    getHighestRole() {
+        const hierarchy = this.getHierarchy();
+        const entries = Object.entries(hierarchy);
+        if (entries.length === 0)
+            return 'owner';
+        return entries.reduce((a, b) => (a[1] >= b[1] ? a : b))[0];
+    }
+    async findMemberships(userId) {
+        return this.memberModel.find({ status: core_tenant_enums_1.TenantMemberStatus.ACTIVE, user: userId }).lean().exec();
+    }
+    async getMembership(tenantId, userId) {
+        return this.memberModel
+            .findOne({ tenant: tenantId, user: userId })
+            .lean()
+            .exec();
+    }
+    async addMember(tenantId, userId, role, invitedById) {
+        if (!tenantId?.trim()) {
+            throw new common_1.BadRequestException('tenantId must not be empty');
+        }
+        if (!userId?.trim()) {
+            throw new common_1.BadRequestException('userId must not be empty');
+        }
+        const effectiveRole = role ?? this.getDefaultRole();
+        const existing = await this.getMembership(tenantId, userId);
+        if (existing) {
+            if (existing.status === core_tenant_enums_1.TenantMemberStatus.ACTIVE) {
+                throw new common_1.BadRequestException('User is already an active member of this tenant');
+            }
+            return request_context_service_1.RequestContext.runWithBypassTenantGuard(async () => {
+                return this.memberModel
+                    .findOneAndUpdate({ tenant: tenantId, user: userId }, {
+                    invitedBy: invitedById,
+                    joinedAt: new Date(),
+                    role: effectiveRole,
+                    status: core_tenant_enums_1.TenantMemberStatus.ACTIVE,
+                }, { new: true })
+                    .lean()
+                    .exec();
+            });
+        }
+        return request_context_service_1.RequestContext.runWithBypassTenantGuard(async () => {
+            const doc = await this.memberModel.create({
+                invitedBy: invitedById,
+                joinedAt: new Date(),
+                role: effectiveRole,
+                status: core_tenant_enums_1.TenantMemberStatus.ACTIVE,
+                tenant: tenantId,
+                user: userId,
+            });
+            return doc.toObject();
+        });
+    }
+    async removeMember(tenantId, userId) {
+        if (!tenantId?.trim()) {
+            throw new common_1.BadRequestException('tenantId must not be empty');
+        }
+        if (!userId?.trim()) {
+            throw new common_1.BadRequestException('userId must not be empty');
+        }
+        await this.assertNotLastOwner(tenantId, userId);
+        return request_context_service_1.RequestContext.runWithBypassTenantGuard(async () => {
+            const result = await this.memberModel
+                .findOneAndUpdate({ status: core_tenant_enums_1.TenantMemberStatus.ACTIVE, tenant: tenantId, user: userId }, { status: core_tenant_enums_1.TenantMemberStatus.SUSPENDED }, { new: true })
+                .lean()
+                .exec();
+            if (!result) {
+                throw new common_1.NotFoundException('Membership not found');
+            }
+            return result;
+        });
+    }
+    async updateMemberRole(tenantId, userId, role) {
+        if (!tenantId?.trim()) {
+            throw new common_1.BadRequestException('tenantId must not be empty');
+        }
+        if (!userId?.trim()) {
+            throw new common_1.BadRequestException('userId must not be empty');
+        }
+        if (!role?.trim()) {
+            throw new common_1.BadRequestException('role must not be empty');
+        }
+        const highestRole = this.getHighestRole();
+        const existing = await this.getMembership(tenantId, userId);
+        if (existing?.role === highestRole && role !== highestRole) {
+            await this.assertNotLastOwner(tenantId, userId);
+        }
+        return request_context_service_1.RequestContext.runWithBypassTenantGuard(async () => {
+            const result = await this.memberModel
+                .findOneAndUpdate({ status: core_tenant_enums_1.TenantMemberStatus.ACTIVE, tenant: tenantId, user: userId }, { role }, { new: true })
+                .lean()
+                .exec();
+            if (!result) {
+                throw new common_1.NotFoundException('Active membership not found');
+            }
+            return result;
+        });
+    }
+    async assertNotLastOwner(tenantId, userId) {
+        const highestRole = this.getHighestRole();
+        return request_context_service_1.RequestContext.runWithBypassTenantGuard(async () => {
+            const ownerCount = await this.memberModel.countDocuments({
+                role: highestRole,
+                status: core_tenant_enums_1.TenantMemberStatus.ACTIVE,
+                tenant: tenantId,
+            });
+            if (ownerCount <= 1) {
+                const membership = await this.getMembership(tenantId, userId);
+                if (membership?.role === highestRole) {
+                    throw new common_1.BadRequestException('Cannot remove or demote the last owner of a tenant');
+                }
+            }
+        });
+    }
+};
+exports.CoreTenantService = CoreTenantService;
+exports.CoreTenantService = CoreTenantService = CoreTenantService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, mongoose_1.InjectModel)(core_tenant_enums_1.TENANT_MEMBER_MODEL_TOKEN)),
+    __metadata("design:paramtypes", [mongoose_2.Model])
+], CoreTenantService);
+//# sourceMappingURL=core-tenant.service.js.map

package/dist/core/modules/tenant/core-tenant.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-tenant.service.js","sourceRoot":"","sources":["../../../../src/core/modules/tenant/core-tenant.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAA4F;AAC5F,+CAA+C;AAC/C,uCAAiC;AAEjC,yEAAqE;AACrE,2FAA+E;AAE/E,2DAA4G;AAsBrG,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAG2C;IAFpD,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAE/D,YAAuE,WAAyC;QAAzC,gBAAW,GAAX,WAAW,CAA8B;IAAG,CAAC;IAK1G,YAAY;QACpB,OAAO,8BAAa,CAAC,qBAAqB,EAAE,YAAY,EAAE,aAAa,IAAI,0CAAsB,CAAC;IACpG,CAAC;IAKS,cAAc;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC1C,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IAKS,cAAc;QACtB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;QACzC,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IAKD,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sCAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAE5F,CAAC;IACJ,CAAC;IAKD,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,MAAc;QAClD,OAAO,IAAI,CAAC,WAAW;aACpB,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;aAC3C,IAAI,EAAE;aACN,IAAI,EAA2C,CAAC;IACrD,CAAC;IAQD,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,MAAc,EACd,IAAa,EACb,WAAoB;QAEpB,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAGpD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,MAAM,KAAK,sCAAkB,CAAC,MAAM,EAAE,CAAC;gBAClD,MAAM,IAAI,4BAAmB,CAAC,iDAAiD,CAAC,CAAC;YACnF,CAAC;YAED,OAAO,wCAAc,CAAC,wBAAwB,CAAC,KAAK,IAAI,EAAE;gBACxD,OAAO,IAAI,CAAC,WAAW;qBACpB,gBAAgB,CACf,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EAClC;oBACE,SAAS,EAAE,WAAW;oBACtB,QAAQ,EAAE,IAAI,IAAI,EAAE;oBACpB,IAAI,EAAE,aAAa;oBACnB,MAAM,EAAE,sCAAkB,CAAC,MAAM;iBAClC,EACD,EAAE,GAAG,EAAE,IAAI,EAAE,CACd;qBACA,IAAI,EAAE;qBACN,IAAI,EAAoC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,wCAAc,CAAC,wBAAwB,CAAC,KAAK,IAAI,EAAE;YACxD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACxC,SAAS,EAAE,WAAW;gBACtB,QAAQ,EAAE,IAAI,IAAI,EAAE;gBACpB,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,sCAAkB,CAAC,MAAM;gBACjC,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,QAAQ,EAA2B,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC;IAMD,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,MAAc;QACjD,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEhD,OAAO,wCAAc,CAAC,wBAAwB,CAAC,KAAK,IAAI,EAAE;YACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW;iBAClC,gBAAgB,CACf,EAAE,MAAM,EAAE,sCAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACrE,EAAE,MAAM,EAAE,sCAAkB,CAAC,SAAS,EAAE,EACxC,EAAE,GAAG,EAAE,IAAI,EAAE,CACd;iBACA,IAAI,EAAE;iBACN,IAAI,EAAE,CAAC;YAEV,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0BAAiB,CAAC,sBAAsB,CAAC,CAAC;YACtD,CAAC;YAED,OAAO,MAA+B,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;IAMD,KAAK,CAAC,gBAAgB,CAAC,QAAgB,EAAE,MAAc,EAAE,IAAY;QACnE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,4BAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAG1C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,QAAQ,EAAE,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,CAAC;QAED,OAAO,wCAAc,CAAC,wBAAwB,CAAC,KAAK,IAAI,EAAE;YACxD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW;iBAClC,gBAAgB,CACf,EAAE,MAAM,EAAE,sCAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,EACrE,EAAE,IAAI,EAAE,EACR,EAAE,GAAG,EAAE,IAAI,EAAE,CACd;iBACA,IAAI,EAAE;iBACN,IAAI,EAAE,CAAC;YAEV,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;YAC7D,CAAC;YAED,OAAO,MAA+B,CAAC;QACzC,CAAC,CAAC,CAAC;IACL,CAAC;IAUD,KAAK,CAAC,kBAAkB,CAAC,QAAgB,EAAE,MAAc;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,OAAO,wCAAc,CAAC,wBAAwB,CAAC,KAAK,IAAI,EAAE;YACxD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC;gBACvD,IAAI,EAAE,WAAW;gBACjB,MAAM,EAAE,sCAAkB,CAAC,MAAM;gBACjC,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;YAEH,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;gBACpB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAC9D,IAAI,UAAU,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;oBACrC,MAAM,IAAI,4BAAmB,CAAC,oDAAoD,CAAC,CAAC;gBACtF,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA7MY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;IAIE,WAAA,IAAA,sBAAW,EAAC,6CAAyB,CAAC,CAAA;qCAAiC,gBAAK;GAH9E,iBAAiB,CA6M7B"}

package/dist/core.module.js

@@ -40,6 +40,7 @@ const error_code_module_1 = require("./core/modules/error-code/error-code.module
 const core_health_check_module_1 = require("./core/modules/health-check/core-health-check.module");
 const core_permissions_module_1 = require("./core/modules/permissions/core-permissions.module");
 const core_system_setup_module_1 = require("./core/modules/system-setup/core-system-setup.module");
+const core_tenant_module_1 = require("./core/modules/tenant/core-tenant.module");
 let CoreModule = class CoreModule {
     static { CoreModule_1 = this; }
     static graphQlEnabled = true;
@@ -218,6 +219,16 @@ let CoreModule = class CoreModule {
         if (isBetterAuthEnabled && config.systemSetup?.enabled !== false) {
             imports.push(core_system_setup_module_1.CoreSystemSetupModule);
         }
+        if (config.multiTenancy && config.multiTenancy.enabled !== false) {
+            const membershipModelName = config.multiTenancy.membershipModel ?? 'TenantMember';
+            if (!config.multiTenancy.excludeSchemas) {
+                config.multiTenancy.excludeSchemas = [];
+            }
+            if (!config.multiTenancy.excludeSchemas.includes(membershipModelName)) {
+                config.multiTenancy.excludeSchemas.push(membershipModelName);
+            }
+            imports.push(core_tenant_module_1.CoreTenantModule.forRoot({ modelName: membershipModelName }));
+        }
         const exports = [config_service_1.ConfigService, email_service_1.EmailService, template_service_1.TemplateService, mailjet_service_1.MailjetService];
         if (!process.env.VITEST && isGraphQlEnabled) {
             exports.push(complexity_plugin_1.ComplexityPlugin);