@loomcore/api 0.2.26 → 0.2.28

package/dist/controllers/organizations.controller.js

@@ -1,51 +1,102 @@
+var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn, decorators, contextIn, initializers, extraInitializers) {
+    function accept(f) { if (f !== void 0 && typeof f !== "function") throw new TypeError("Function expected"); return f; }
+    var kind = contextIn.kind, key = kind === "getter" ? "get" : kind === "setter" ? "set" : "value";
+    var target = !descriptorIn && ctor ? contextIn["static"] ? ctor : ctor.prototype : null;
+    var descriptor = descriptorIn || (target ? Object.getOwnPropertyDescriptor(target, contextIn.name) : {});
+    var _, done = false;
+    for (var i = decorators.length - 1; i >= 0; i--) {
+        var context = {};
+        for (var p in contextIn) context[p] = p === "access" ? {} : contextIn[p];
+        for (var p in contextIn.access) context.access[p] = contextIn.access[p];
+        context.addInitializer = function (f) { if (done) throw new TypeError("Cannot add initializers after decoration has completed"); extraInitializers.push(accept(f || null)); };
+        var result = (0, decorators[i])(kind === "accessor" ? { get: descriptor.get, set: descriptor.set } : descriptor[key], context);
+        if (kind === "accessor") {
+            if (result === void 0) continue;
+            if (result === null || typeof result !== "object") throw new TypeError("Object expected");
+            if (_ = accept(result.get)) descriptor.get = _;
+            if (_ = accept(result.set)) descriptor.set = _;
+            if (_ = accept(result.init)) initializers.unshift(_);
+        }
+        else if (_ = accept(result)) {
+            if (kind === "field") initializers.unshift(_);
+            else descriptor[key] = _;
+        }
+    }
+    if (target) Object.defineProperty(target, contextIn.name, descriptor);
+    done = true;
+};
+var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
+    var useValue = arguments.length > 2;
+    for (var i = 0; i < initializers.length; i++) {
+        value = useValue ? initializers[i].call(thisArg, value) : initializers[i].call(thisArg);
+    }
+    return useValue ? value : void 0;
+};
 import { BadRequestError } from "../errors/index.js";
-import { adminWrites, isAuthorized } from "../middleware/index.js";
 import { OrganizationService } from "../services/index.js";
-import { apiUtils } from "../utils/index.js";
+import { apiUtils, authorizeMethod } from "../utils/index.js";
 import { ApiController } from "./api.controller.js";
-export class OrganizationsController extends ApiController {
-    orgService;
-    constructor(app, database) {
-        const orgService = new OrganizationService(database);
-        super("organizations", app, orgService, adminWrites);
-        this.orgService = orgService;
-    }
-    mapRoutes(app) {
-        super.mapRoutes(app);
-        const auth = isAuthorized(this.routeAuth);
-        app.get(`/api/${this.slug}/get-by-name/:name`, auth, this.getByName.bind(this));
-        app.get(`/api/${this.slug}/get-by-code/:code`, auth, this.getByCode.bind(this));
-    }
-    async getByName(req, res, next) {
-        const { name } = req.params;
-        try {
-            res.set("Content-Type", "application/json");
-            const entity = await this.orgService.findOne(req.userContext, {
-                filters: { name: { contains: name } },
-            });
-            if (!entity)
-                throw new BadRequestError("Organization name not found");
-            apiUtils.apiResponse(res, 200, { data: entity });
+import { Authorize } from "../decorators/authorize.decorator.js";
+let OrganizationsController = (() => {
+    let _classDecorators = [Authorize('admin')];
+    let _classDescriptor;
+    let _classExtraInitializers = [];
+    let _classThis;
+    let _classSuper = ApiController;
+    var OrganizationsController = class extends _classSuper {
+        static { _classThis = this; }
+        static {
+            const _metadata = typeof Symbol === "function" && Symbol.metadata ? Object.create(_classSuper[Symbol.metadata] ?? null) : void 0;
+            __esDecorate(null, _classDescriptor = { value: _classThis }, _classDecorators, { kind: "class", name: _classThis.name, metadata: _metadata }, null, _classExtraInitializers);
+            OrganizationsController = _classThis = _classDescriptor.value;
+            if (_metadata) Object.defineProperty(_classThis, Symbol.metadata, { enumerable: true, configurable: true, writable: true, value: _metadata });
+            __runInitializers(_classThis, _classExtraInitializers);
         }
-        catch (err) {
-            next(err);
-            return;
+        orgService;
+        constructor(app, database) {
+            const orgService = new OrganizationService(database);
+            super("organizations", app, orgService);
+            this.orgService = orgService;
         }
-    }
-    async getByCode(req, res, next) {
-        const { code } = req.params;
-        try {
-            res.set("Content-Type", "application/json");
-            const entity = await this.orgService.findOne(req.userContext, {
-                filters: { code: { eq: code } },
-            });
-            if (!entity)
-                throw new BadRequestError("Organization code not found");
-            apiUtils.apiResponse(res, 200, { data: entity });
+        mapRoutes(app) {
+            super.mapRoutes(app);
+            const authorize = (method) => authorizeMethod(this, method);
+            app.get(`/api/${this.slug}/get-by-name/:name`, authorize('getByName'), this.getByName.bind(this));
+            app.get(`/api/${this.slug}/get-by-code/:code`, authorize('getByCode'), this.getByCode.bind(this));
         }
-        catch (err) {
-            next(err);
-            return;
+        async getByName(req, res, next) {
+            const { name } = req.params;
+            try {
+                res.set("Content-Type", "application/json");
+                const entity = await this.orgService.findOne(req.userContext, {
+                    filters: { name: { contains: name } },
+                });
+                if (!entity)
+                    throw new BadRequestError("Organization name not found");
+                apiUtils.apiResponse(res, 200, { data: entity });
+            }
+            catch (err) {
+                next(err);
+                return;
+            }
         }
-    }
-}
+        async getByCode(req, res, next) {
+            const { code } = req.params;
+            try {
+                res.set("Content-Type", "application/json");
+                const entity = await this.orgService.findOne(req.userContext, {
+                    filters: { code: { eq: code } },
+                });
+                if (!entity)
+                    throw new BadRequestError("Organization code not found");
+                apiUtils.apiResponse(res, 200, { data: entity });
+            }
+            catch (err) {
+                next(err);
+                return;
+            }
+        }
+    };
+    return OrganizationsController = _classThis;
+})();
+export { OrganizationsController };

package/dist/controllers/query-api.controller.d.ts

@@ -2,17 +2,15 @@ import { Application, NextFunction, Request, Response } from 'express';
 import { IEntity, IModelSpec } from '@loomcore/common/models';
 import type { TSchema } from '@sinclair/typebox';
 import { IGenericQueryService } from '../services/index.js';
-import { type MethodAuth } from '../middleware/index.js';
 export declare abstract class QueryApiController<T extends IEntity> {
     protected app: Application;
     protected service: IGenericQueryService<T>;
     protected slug: string;
     protected apiResourceName: string;
-    protected routeAuth: MethodAuth;
     protected modelSpec?: IModelSpec;
     protected publicSpec?: IModelSpec;
     protected idSchema: TSchema;
-    protected constructor(slug: string, app: Application, service: IGenericQueryService<T>, routeAuth?: MethodAuth, resourceName?: string, modelSpec?: IModelSpec, publicSpec?: IModelSpec);
+    protected constructor(slug: string, app: Application, service: IGenericQueryService<T>, resourceName?: string, modelSpec?: IModelSpec, publicSpec?: IModelSpec);
     mapRoutes(app: Application): void;
     getAll(req: Request, res: Response, next: NextFunction): Promise<void>;
     get(req: Request, res: Response, next: NextFunction): Promise<void>;

package/dist/controllers/query-api.controller.js

@@ -1,22 +1,19 @@
 import { BadRequestError } from '../errors/index.js';
 import { Value } from '@sinclair/typebox/value';
 import { getIdSchema } from '@loomcore/common/validation';
-import { apiUtils } from '../utils/index.js';
-import { authenticated, isAuthorized, } from '../middleware/index.js';
+import { apiUtils, authorizeMethod } from '../utils/index.js';
 export class QueryApiController {
     app;
     service;
     slug;
     apiResourceName;
-    routeAuth;
     modelSpec;
     publicSpec;
     idSchema;
-    constructor(slug, app, service, routeAuth = authenticated, resourceName = '', modelSpec, publicSpec) {
+    constructor(slug, app, service, resourceName = '', modelSpec, publicSpec) {
         this.slug = slug;
         this.app = app;
         this.service = service;
-        this.routeAuth = routeAuth;
         this.apiResourceName = resourceName;
         this.modelSpec = modelSpec;
         this.publicSpec = publicSpec;
@@ -24,11 +21,11 @@ export class QueryApiController {
         this.mapRoutes(app);
     }
     mapRoutes(app) {
-        const auth = isAuthorized(this.routeAuth);
-        app.get(`/api/${this.slug}`, auth, this.get.bind(this));
-        app.get(`/api/${this.slug}/all`, auth, this.getAll.bind(this));
-        app.get(`/api/${this.slug}/count`, auth, this.getCount.bind(this));
-        app.get(`/api/${this.slug}/:id`, auth, this.getById.bind(this));
+        const authorize = (method) => authorizeMethod(this, method);
+        app.get(`/api/${this.slug}`, authorize('get'), this.get.bind(this));
+        app.get(`/api/${this.slug}/all`, authorize('getAll'), this.getAll.bind(this));
+        app.get(`/api/${this.slug}/count`, authorize('getCount'), this.getCount.bind(this));
+        app.get(`/api/${this.slug}/:id`, authorize('getById'), this.getById.bind(this));
     }
     async getAll(req, res, next) {
         res.set('Content-Type', 'application/json');
@@ -47,14 +44,15 @@ export class QueryApiController {
         if (!idParam) {
             throw new BadRequestError('ID parameter is required');
         }
+        let id;
         try {
-            const id = Value.Convert(this.idSchema, idParam);
-            const entity = await this.service.getById(req.userContext, id);
-            apiUtils.apiResponse(res, 200, { data: entity }, this.modelSpec, this.publicSpec);
+            id = Value.Convert(this.idSchema, idParam);
         }
         catch (error) {
             throw new BadRequestError(`Invalid ID format: ${error.message || error}`);
         }
+        const entity = await this.service.getById(req.userContext, id);
+        apiUtils.apiResponse(res, 200, { data: entity }, this.modelSpec, this.publicSpec);
     }
     async getCount(req, res, next) {
         res.set('Content-Type', 'application/json');

package/dist/controllers/roles.controller.d.ts

@@ -1,6 +1,6 @@
-import { Application } from "express";
-import { IDatabase } from "../databases/models/index.js";
-import { IRole } from "../models/role.model.js";
+import type { Application } from "express";
+import type { IDatabase } from "../databases/models/index.js";
+import { type IRole } from "@loomcore/common/models";
 import { ApiController } from "./api.controller.js";
 export declare class RolesController extends ApiController<IRole> {
     constructor(app: Application, database: IDatabase);

package/dist/controllers/roles.controller.js

@@ -1,10 +1,9 @@
-import { adminWrites } from "../middleware/index.js";
-import { RoleModelSpec } from "../models/role.model.js";
-import { MultiTenantApiService } from "../services/multi-tenant-api.service.js";
+import { RoleModelSpec } from "@loomcore/common/models";
+import { RolesService } from "../services/roles.service.js";
 import { ApiController } from "./api.controller.js";
 export class RolesController extends ApiController {
     constructor(app, database) {
-        const roleService = new MultiTenantApiService(database, "roles", "role", RoleModelSpec);
-        super("roles", app, roleService, adminWrites, "role", RoleModelSpec, RoleModelSpec);
+        const roleService = new RolesService(database);
+        super("roles", app, roleService, "role", RoleModelSpec);
     }
 }

package/dist/controllers/user-roles.controller.d.ts

@@ -1,6 +1,6 @@
 import type { Application } from "express";
 import type { IDatabase } from "../databases/models/index.js";
-import { type IUserRole } from "../models/user-role.model.js";
+import { type IUserRole } from "@loomcore/common/models";
 import { ApiController } from "./api.controller.js";
 export declare class UserRolesController extends ApiController<IUserRole> {
     constructor(app: Application, database: IDatabase);

package/dist/controllers/user-roles.controller.js

@@ -1,10 +1,9 @@
-import { adminWrites } from "../middleware/index.js";
-import { UserRoleModelSpec, } from "../models/user-role.model.js";
-import { MultiTenantApiService } from "../services/multi-tenant-api.service.js";
+import { UserRoleModelSpec } from "@loomcore/common/models";
+import { UserRolesService } from "../services/user-roles.service.js";
 import { ApiController } from "./api.controller.js";
 export class UserRolesController extends ApiController {
     constructor(app, database) {
-        const userRoleService = new MultiTenantApiService(database, "user_roles", "user_role", UserRoleModelSpec);
-        super("user-roles", app, userRoleService, adminWrites, "user-role", UserRoleModelSpec, UserRoleModelSpec);
+        const userRoleService = new UserRolesService(database);
+        super("user-roles", app, userRoleService, "user-role", UserRoleModelSpec);
     }
 }

package/dist/controllers/users.controller.d.ts

@@ -1,14 +1,12 @@
 import { type IModelSpec, type IUser } from "@loomcore/common/models";
 import type { Application } from "express";
 import type { IDatabase } from "../databases/models/index.js";
-import { type MethodAuth } from "../middleware/index.js";
 import { UserService } from "../services/index.js";
 import { ApiController } from "./api.controller.js";
 export interface UsersControllerOptions {
     userService: UserService;
     userSpec: IModelSpec;
     publicUserSpec: IModelSpec;
-    methodAuth: MethodAuth;
 }
 export declare class UsersController extends ApiController<IUser> {
     userService: UserService;

package/dist/controllers/users.controller.js

@@ -1,5 +1,4 @@
 import { PublicUserSpec, UserSpec, } from "@loomcore/common/models";
-import { authenticated } from "../middleware/index.js";
 import { UserService } from "../services/index.js";
 import { ApiController } from "./api.controller.js";
 export class UsersController extends ApiController {
@@ -8,9 +7,8 @@ export class UsersController extends ApiController {
         userService: new UserService(database),
         userSpec: UserSpec,
         publicUserSpec: PublicUserSpec,
-        methodAuth: authenticated,
     }) {
-        super("users", app, options.userService, options.methodAuth, "user", options.userSpec, options.publicUserSpec);
+        super("users", app, options.userService, "user", options.userSpec, options.publicUserSpec);
         this.userService = options.userService;
     }
 }

package/dist/databases/postgres/postgres.database.d.ts

@@ -1,4 +1,4 @@
-import { IEntity, IModelSpec, IPagedResult, IQueryOptions, IUserContextAuthorization } from "@loomcore/common/models";
+import { IEntity, IModelSpec, IPagedResult, IQueryOptions } from "@loomcore/common/models";
 import type { AppIdType } from "@loomcore/common/types";
 import { TSchema } from "@sinclair/typebox";
 import { DeleteResult, IDatabase } from "../models/index.js";
@@ -29,5 +29,5 @@ export declare class PostgresDatabase implements IDatabase {
     deleteMany(queryObject: IQueryOptions, pluralResourceName: string): Promise<DeleteResult>;
     find<T extends IEntity>(queryObject: IQueryOptions, pluralResourceName: string): Promise<T[]>;
     findOne<T extends IEntity>(queryObject: IQueryOptions, pluralResourceName: string): Promise<T | null>;
-    getUserAuthorizations(userId: AppIdType, orgId?: AppIdType): Promise<IUserContextAuthorization[]>;
+    getUserFeatures(userId: AppIdType, orgId?: AppIdType): Promise<string[]>;
 }

package/dist/databases/postgres/postgres.database.js

@@ -68,7 +68,7 @@ export class PostgresDatabase {
     async findOne(queryObject, pluralResourceName) {
         return findOneQuery(this.connection, queryObject, pluralResourceName);
     }
-    async getUserAuthorizations(userId, orgId) {
+    async getUserFeatures(userId, orgId) {
         const now = new Date();
         let query = `
             SELECT DISTINCT
@@ -93,16 +93,6 @@ export class PostgresDatabase {
             values.push(orgId);
         }
         const result = await this.connection.query(query, values);
-        const authorizations = [];
-        for (const row of result.rows) {
-            authorizations.push({
-                _id: row._id,
-                _orgId: row._orgId,
-                role: row.role,
-                feature: row.feature,
-                config: row.config || undefined,
-            });
-        }
-        return authorizations;
+        return result.rows.map((row) => row.feature);
     }
 }

package/dist/decorators/authorize.decorator.d.ts

@@ -0,0 +1,13 @@
+import 'reflect-metadata';
+export declare const AUTH_METADATA_KEY: unique symbol;
+export type MatchMode = 'all' | 'any';
+export interface AuthRequirement {
+    features: string[];
+    mode: MatchMode;
+    allowAnonymous?: boolean;
+}
+export declare function Authorize(features?: string | string[], options?: {
+    all?: boolean;
+}): (value: Function, _context: ClassDecoratorContext | ClassMethodDecoratorContext) => void;
+export declare function AllowAnonymous(): (value: Function, _context: ClassDecoratorContext | ClassMethodDecoratorContext) => void;
+export declare function resolveAuthRequirement(controllerConstructor: Function, prototype: any, propertyKey: string): AuthRequirement | undefined;

package/dist/decorators/authorize.decorator.js

@@ -0,0 +1,33 @@
+import 'reflect-metadata';
+export const AUTH_METADATA_KEY = Symbol('authorize:features');
+export function Authorize(features = [], options = {}) {
+    const requirement = {
+        features: Array.isArray(features) ? features : [features],
+        mode: options.all ? 'all' : 'any',
+    };
+    return function (value, _context) {
+        Reflect.defineMetadata(AUTH_METADATA_KEY, requirement, value);
+    };
+}
+export function AllowAnonymous() {
+    return function (value, _context) {
+        const metadataValue = {
+            features: [],
+            mode: 'any',
+            allowAnonymous: true,
+        };
+        Reflect.defineMetadata(AUTH_METADATA_KEY, metadataValue, value);
+    };
+}
+export function resolveAuthRequirement(controllerConstructor, prototype, propertyKey) {
+    const method = prototype[propertyKey];
+    if (typeof method === 'function') {
+        const methodLevel = Reflect.getMetadata(AUTH_METADATA_KEY, method);
+        if (methodLevel)
+            return methodLevel;
+    }
+    const classLevel = Reflect.getMetadata(AUTH_METADATA_KEY, controllerConstructor);
+    if (classLevel)
+        return classLevel;
+    return undefined;
+}

package/dist/errors/unauthorized.error.d.ts

@@ -1,7 +1,7 @@
 import { CustomError } from '@loomcore/common/errors';
 export declare class UnauthorizedError extends CustomError {
     statusCode: number;
-    constructor();
+    constructor(missing?: string[]);
     serializeErrors(): {
         message: string;
     }[];

package/dist/errors/unauthorized.error.js

@@ -1,11 +1,13 @@
 import { CustomError } from '@loomcore/common/errors';
 export class UnauthorizedError extends CustomError {
     statusCode = 403;
-    constructor() {
-        super('Unauthorized');
+    constructor(missing) {
+        super(missing?.length
+            ? `Missing required feature(s): ${missing.join(', ')}`
+            : 'Unauthorized');
         Object.setPrototypeOf(this, UnauthorizedError.prototype);
     }
     serializeErrors() {
-        return [{ message: 'Unauthorized' }];
+        return [{ message: this.message }];
     }
 }

package/dist/middleware/authorize/authenticate-request.d.ts

@@ -0,0 +1,3 @@
+import type { IUserContext } from "@loomcore/common/models";
+import type { Request } from "express";
+export declare function authenticateRequest(req: Request): IUserContext;

package/dist/middleware/authorize/authenticate-request.js

@@ -0,0 +1,21 @@
+import jwt from "jsonwebtoken";
+import { UnauthenticatedError } from "../../errors/unauthenticated.error.js";
+import { getAuthConfig } from "../../utils/auth/get-auth-config.util.js";
+import { getAuthUserContextSpec } from "../../utils/index.js";
+function extractBearerToken(req) {
+    const authHeader = req.headers?.authorization;
+    if (!authHeader) {
+        return null;
+    }
+    const parts = authHeader.split("Bearer ");
+    return parts.length > 1 ? parts[1] : null;
+}
+export function authenticateRequest(req) {
+    const token = extractBearerToken(req);
+    if (!token) {
+        throw new UnauthenticatedError();
+    }
+    const authConfig = getAuthConfig();
+    const rawPayload = jwt.verify(token, authConfig.clientSecret);
+    return getAuthUserContextSpec().decode(rawPayload);
+}

package/dist/middleware/authorize/authorize.middleware.d.ts

@@ -0,0 +1,3 @@
+import type { RequestHandler } from 'express';
+import { AuthRequirement } from '../../decorators/authorize.decorator.js';
+export declare function buildAuthGuard(requirement: AuthRequirement | undefined): RequestHandler;

package/dist/middleware/authorize/authorize.middleware.js

@@ -0,0 +1,23 @@
+import { UnauthorizedError } from '../../errors/index.js';
+import { authenticateRequest } from './authenticate-request.js';
+export function buildAuthGuard(requirement) {
+    return (req, _res, next) => {
+        if (requirement?.allowAnonymous) {
+            return next();
+        }
+        const userContext = authenticateRequest(req);
+        req.userContext = userContext;
+        if (!requirement || requirement.features.length === 0) {
+            return next();
+        }
+        const userFeatures = new Set(userContext.features);
+        const hasAccess = requirement.mode === 'all'
+            ? requirement.features.every((f) => userFeatures.has(f))
+            : requirement.features.some((f) => userFeatures.has(f));
+        if (!hasAccess) {
+            const missing = requirement.features.filter((f) => !userFeatures.has(f));
+            throw new UnauthorizedError(missing);
+        }
+        next();
+    };
+}

package/dist/middleware/index.d.ts

@@ -1,5 +1,4 @@
 export * from "./ensure-user-context.js";
 export * from "./error-handler.js";
-export * from "./is-authorized.js";
-export * from "../models/method-auth.model.js";
 export * from "./request-lifecycle.js";
+export * from "./authorize/authorize.middleware.js";

package/dist/middleware/index.js

@@ -1,5 +1,4 @@
 export * from "./ensure-user-context.js";
 export * from "./error-handler.js";
-export * from "./is-authorized.js";
-export * from "../models/method-auth.model.js";
 export * from "./request-lifecycle.js";
+export * from "./authorize/authorize.middleware.js";

package/dist/models/index.d.ts

@@ -2,5 +2,4 @@ export * from './app-config.interface.js';
 export * from './base-api-config.interface.js';
 export * from './database-config.interface.js';
 export * from './initial-database-config.interface.js';
-export * from './refresh-token.model.js';
 export * from './email-client.interface.js';

package/dist/models/index.js

@@ -2,5 +2,4 @@ export * from './app-config.interface.js';
 export * from './base-api-config.interface.js';
 export * from './database-config.interface.js';
 export * from './initial-database-config.interface.js';
-export * from './refresh-token.model.js';
 export * from './email-client.interface.js';

package/dist/services/authorizations.service.d.ts

@@ -0,0 +1,7 @@
+import { IAuthorization, IUserContext } from "@loomcore/common/models";
+import { IDatabase } from "../databases/index.js";
+import { MultiTenantApiService } from "./multi-tenant-api.service.js";
+export declare class AuthorizationsService extends MultiTenantApiService<IAuthorization> {
+    constructor(database: IDatabase);
+    preProcessEntity(userContext: IUserContext, entity: Partial<IAuthorization>, isCreate: boolean, allowId?: boolean): Promise<Partial<IAuthorization>>;
+}

package/dist/services/authorizations.service.js

@@ -0,0 +1,12 @@
+import { AuthorizationModelSpec } from "@loomcore/common/models";
+import { MultiTenantApiService } from "./multi-tenant-api.service.js";
+import { assertUserHasFeature } from "../utils/index.js";
+export class AuthorizationsService extends MultiTenantApiService {
+    constructor(database) {
+        super(database, "authorizations", "authorization", AuthorizationModelSpec);
+    }
+    async preProcessEntity(userContext, entity, isCreate, allowId = true) {
+        assertUserHasFeature(userContext, ['admin', 'system', 'authorizations']);
+        return super.preProcessEntity(userContext, entity, isCreate, allowId);
+    }
+}

package/dist/services/features.service.d.ts

@@ -0,0 +1,7 @@
+import { IFeature, IUserContext } from "@loomcore/common/models";
+import { IDatabase } from "../databases/index.js";
+import { MultiTenantApiService } from "./multi-tenant-api.service.js";
+export declare class FeaturesService extends MultiTenantApiService<IFeature> {
+    constructor(database: IDatabase);
+    preProcessEntity(userContext: IUserContext, entity: Partial<IFeature>, isCreate: boolean, allowId?: boolean): Promise<Partial<IFeature>>;
+}

package/dist/services/features.service.js

@@ -0,0 +1,12 @@
+import { FeatureModelSpec } from "@loomcore/common/models";
+import { MultiTenantApiService } from "./multi-tenant-api.service.js";
+import { assertUserHasFeature } from "../utils/index.js";
+export class FeaturesService extends MultiTenantApiService {
+    constructor(database) {
+        super(database, "features", "feature", FeatureModelSpec);
+    }
+    async preProcessEntity(userContext, entity, isCreate, allowId = true) {
+        assertUserHasFeature(userContext, ['admin', 'system', 'features']);
+        return super.preProcessEntity(userContext, entity, isCreate, allowId);
+    }
+}

package/dist/services/index.d.ts

@@ -8,5 +8,9 @@ export * from "./organization.service.js";
 export * from "./organization-domain.service.js";
 export * from "./password-reset-token.service.js";
 export * from "./refresh-token.service.js";
+export * from "./authorizations.service.js";
+export * from "./features.service.js";
+export * from "./roles.service.js";
+export * from "./user-roles.service.js";
 export * from "./tenant-query-decorator.js";
 export * from "./user.service.js";

package/dist/services/index.js

@@ -8,5 +8,9 @@ export * from "./organization.service.js";
 export * from "./organization-domain.service.js";
 export * from "./password-reset-token.service.js";
 export * from "./refresh-token.service.js";
+export * from "./authorizations.service.js";
+export * from "./features.service.js";
+export * from "./roles.service.js";
+export * from "./user-roles.service.js";
 export * from "./tenant-query-decorator.js";
 export * from "./user.service.js";

package/dist/services/refresh-token.service.d.ts

@@ -1,5 +1,5 @@
+import { IRefreshToken } from "@loomcore/common/models";
 import type { IDatabase } from "../databases/models/index.js";
-import { type IRefreshToken } from "../models/refresh-token.model.js";
 import { MultiTenantApiService } from "./multi-tenant-api.service.js";
 export declare class RefreshTokenService extends MultiTenantApiService<IRefreshToken> {
     constructor(database: IDatabase);

package/dist/services/refresh-token.service.js

@@ -1,4 +1,4 @@
-import { refreshTokenModelSpec, } from "../models/refresh-token.model.js";
+import { refreshTokenModelSpec } from "@loomcore/common/models";
 import { MultiTenantApiService } from "./multi-tenant-api.service.js";
 export class RefreshTokenService extends MultiTenantApiService {
     constructor(database) {

package/dist/services/roles.service.d.ts

@@ -0,0 +1,7 @@
+import { IRole, IUserContext } from "@loomcore/common/models";
+import { IDatabase } from "../databases/index.js";
+import { MultiTenantApiService } from "./multi-tenant-api.service.js";
+export declare class RolesService extends MultiTenantApiService<IRole> {
+    constructor(database: IDatabase);
+    preProcessEntity(userContext: IUserContext, entity: Partial<IRole>, isCreate: boolean, allowId?: boolean): Promise<Partial<IRole>>;
+}

package/dist/services/roles.service.js

@@ -0,0 +1,12 @@
+import { RoleModelSpec } from "@loomcore/common/models";
+import { MultiTenantApiService } from "./multi-tenant-api.service.js";
+import { assertUserHasFeature } from "../utils/index.js";
+export class RolesService extends MultiTenantApiService {
+    constructor(database) {
+        super(database, "roles", "role", RoleModelSpec);
+    }
+    async preProcessEntity(userContext, entity, isCreate, allowId = true) {
+        assertUserHasFeature(userContext, ['admin', 'system', 'roles']);
+        return super.preProcessEntity(userContext, entity, isCreate, allowId);
+    }
+}