@loomcore/api 0.2.69 → 0.2.71

package/dist/databases/postgres/utils/build-join-where.js

@@ -0,0 +1,136 @@
+import { readFilterValue } from '../../utils/nullish-filter-value.js';
+import { findJoinOperation, parentAliasOf, } from '../../utils/resolve-join-filter.js';
+import { collectOuterOneToOneAliases } from './build-join-clauses.js';
+import { toPostgresStoreName, toSnakeCase } from './convert-keys.util.js';
+export function toSqlColumnName(column) {
+    if (column.startsWith('_')) {
+        return column;
+    }
+    if (column === 'id') {
+        return '_id';
+    }
+    return toSnakeCase(column);
+}
+function quoteIdent(value) {
+    return `"${value.replace(/"/g, '""')}"`;
+}
+export function appendFilterConditions(qualifiedKey, value, conditions, values, paramIndex) {
+    if (value.eq !== undefined) {
+        const comparison = readFilterValue(value.eq);
+        if (comparison.kind === 'value') {
+            conditions.push(`(${qualifiedKey} = $${paramIndex.current} OR (${qualifiedKey} IS NULL AND $${paramIndex.current} IS NULL))`);
+            values.push(comparison.value);
+            paramIndex.current++;
+        }
+        else {
+            conditions.push(`${qualifiedKey} IS NULL`);
+        }
+    }
+    if (value.ne !== undefined) {
+        const comparison = readFilterValue(value.ne);
+        if (comparison.kind === 'value') {
+            conditions.push(`(${qualifiedKey} != $${paramIndex.current} OR (${qualifiedKey} IS NOT NULL AND $${paramIndex.current} IS NULL) OR (${qualifiedKey} IS NULL AND $${paramIndex.current} IS NOT NULL))`);
+            values.push(comparison.value);
+            paramIndex.current++;
+        }
+        else {
+            conditions.push(`${qualifiedKey} IS NOT NULL`);
+        }
+    }
+    if (value.in !== undefined && Array.isArray(value.in)) {
+        const placeholders = value.in.map(() => `$${paramIndex.current++}`).join(', ');
+        conditions.push(`${qualifiedKey} IN (${placeholders})`);
+        values.push(...value.in);
+    }
+    if (value.gte !== undefined) {
+        conditions.push(`${qualifiedKey} >= $${paramIndex.current}`);
+        values.push(value.gte);
+        paramIndex.current++;
+    }
+    if (value.lte !== undefined) {
+        conditions.push(`${qualifiedKey} <= $${paramIndex.current}`);
+        values.push(value.lte);
+        paramIndex.current++;
+    }
+    if (value.gt !== undefined) {
+        conditions.push(`${qualifiedKey} > $${paramIndex.current}`);
+        values.push(value.gt);
+        paramIndex.current++;
+    }
+    if (value.lt !== undefined) {
+        conditions.push(`${qualifiedKey} < $${paramIndex.current}`);
+        values.push(value.lt);
+        paramIndex.current++;
+    }
+    if (value.contains !== undefined) {
+        conditions.push(`LOWER(${qualifiedKey}) LIKE LOWER($${paramIndex.current})`);
+        values.push(`%${value.contains}%`);
+        paramIndex.current++;
+    }
+}
+function qualifyLocalField(localField, mainTableName) {
+    const dot = localField.indexOf('.');
+    if (dot === -1) {
+        return mainTableName ? `${quoteIdent(mainTableName)}.${quoteIdent(localField)}` : quoteIdent(localField);
+    }
+    const alias = localField.slice(0, dot);
+    const column = localField.slice(dot + 1);
+    return `${quoteIdent(alias)}.${quoteIdent(column)}`;
+}
+function ancestorChain(target, operations, mainTableName, outerAliases) {
+    const chain = [target];
+    let current = target;
+    const seen = new Set([target.as]);
+    while (true) {
+        const parentAlias = parentAliasOf(current.localField);
+        if (parentAlias === null || parentAlias === mainTableName || outerAliases.has(parentAlias)) {
+            break;
+        }
+        if (seen.has(parentAlias)) {
+            break;
+        }
+        const parent = findJoinOperation(operations, parentAlias);
+        if (!parent) {
+            break;
+        }
+        seen.add(parent.as);
+        chain.unshift(parent);
+        current = parent;
+    }
+    return chain;
+}
+function existsSql(target, qualifiedColumn, filter, operations, mainTableName, outerAliases, values, paramIndex) {
+    const chain = ancestorChain(target, operations, mainTableName, outerAliases);
+    const first = chain[0];
+    let sql = `EXISTS (SELECT 1 FROM ${quoteIdent(toPostgresStoreName(first.from))} AS ${quoteIdent(first.as)}`;
+    for (let index = 1; index < chain.length; index++) {
+        const child = chain[index];
+        const fromTable = quoteIdent(toPostgresStoreName(child.from));
+        const childAlias = quoteIdent(child.as);
+        const onLeft = qualifyLocalField(child.localField, mainTableName);
+        sql += ` INNER JOIN ${fromTable} AS ${childAlias} ON ${onLeft} = ${childAlias}.${quoteIdent(child.foreignField)}`;
+    }
+    const conditions = [
+        `${qualifyLocalField(first.localField, mainTableName)} = ${quoteIdent(first.as)}.${quoteIdent(first.foreignField)}`,
+    ];
+    appendFilterConditions(qualifiedColumn, filter, conditions, values, paramIndex);
+    sql += ` WHERE ${conditions.join(' AND ')})`;
+    return sql;
+}
+export function joinFilterSql(joinFilter, operations, mainTableName, values, paramIndex) {
+    const target = findJoinOperation(operations, joinFilter.aliases[joinFilter.aliases.length - 1]);
+    if (!target) {
+        return null;
+    }
+    const outerAliases = collectOuterOneToOneAliases(operations, mainTableName);
+    const qualified = `${quoteIdent(target.as)}.${quoteIdent(toSqlColumnName(joinFilter.column))}`;
+    if (!joinFilter.crossesMany && outerAliases.has(target.as)) {
+        const conditions = [];
+        appendFilterConditions(qualified, joinFilter.filter, conditions, values, paramIndex);
+        if (joinFilter.filter.ne !== undefined) {
+            conditions.push(`${quoteIdent(target.as)}."_id" IS NOT NULL`);
+        }
+        return conditions.join(' AND ');
+    }
+    return existsSql(target, qualified, joinFilter.filter, operations, mainTableName, outerAliases, values, paramIndex);
+}

package/dist/databases/postgres/utils/build-order-by-clause.d.ts

@@ -1,5 +1,2 @@
 import { IQueryOptions } from '@loomcore/common/models';
-export interface BuildOrderByClauseOptions {
-    tablePrefix?: string;
-}
-export declare function buildOrderByClause(queryObject: IQueryOptions, options?: BuildOrderByClauseOptions): string;
+export declare function buildOrderByClause(queryObject: IQueryOptions, tablePrefix: string): string;

package/dist/databases/postgres/utils/build-order-by-clause.js

@@ -1,9 +1,8 @@
-export function buildOrderByClause(queryObject, options) {
+export function buildOrderByClause(queryObject, tablePrefix) {
     if (!queryObject.orderBy) {
         return '';
     }
     const orderBy = queryObject.orderBy;
     const sortDirection = queryObject.sortDirection || 'asc';
-    const qualified = options?.tablePrefix ? `"${options.tablePrefix}"."${orderBy}"` : orderBy;
-    return `ORDER BY ${qualified} ${sortDirection}`;
+    return `ORDER BY "${tablePrefix}"."${orderBy}" ${sortDirection}`;
 }

package/dist/databases/postgres/utils/build-select-clause.js

@@ -2,6 +2,7 @@ import { LeftJoin } from '../../operations/left-join.operation.js';
 import { InnerJoin } from '../../operations/inner-join.operation.js';
 import { LeftJoinMany } from '../../operations/left-join-many.operation.js';
 import { toPostgresStoreName } from './convert-keys.util.js';
+import { isJoinOperation } from '../../utils/is-join-operation.util.js';
 const PK = '_id';
 export async function getTableColumns(client, tableName) {
     const storeName = toPostgresStoreName(tableName);
@@ -172,10 +173,7 @@ async function buildJoinDataObject(client, operations, mainTableName) {
     return jsonbBuildObject(entries);
 }
 export async function buildSelectClause(client, mainTableName, operations) {
-    const leftJoinOperations = operations.filter(op => op instanceof LeftJoin);
-    const innerJoinOperations = operations.filter(op => op instanceof InnerJoin);
-    const leftJoinManyOperations = operations.filter(op => op instanceof LeftJoinMany);
-    const hasJoins = leftJoinOperations.length > 0 || innerJoinOperations.length > 0 || leftJoinManyOperations.length > 0;
+    const hasJoins = operations.some(isJoinOperation);
     if (!hasJoins) {
         return '*';
     }

package/dist/databases/postgres/utils/build-where-clause.d.ts

@@ -1,5 +1,6 @@
 import { IQueryOptions } from '@loomcore/common/models';
-export declare function buildWhereClause(queryObject: IQueryOptions, values?: any[], tablePrefix?: string): {
+import type { Operation } from '../../operations/operation.js';
+export declare function buildWhereClause(queryObject: IQueryOptions, tablePrefix: string, values?: any[], operations?: Operation[]): {
     whereClause: string;
     values: any[];
 };

package/dist/databases/postgres/utils/build-where-clause.js

@@ -1,76 +1,24 @@
-import { readFilterValue } from '../../utils/nullish-filter-value.js';
-import { toSnakeCase } from './convert-keys.util.js';
-export function buildWhereClause(queryObject, values = [], tablePrefix) {
-    const filters = queryObject.filters || {};
+import { splitFiltersByType } from '../../utils/resolve-join-filter.js';
+import { appendFilterConditions, joinFilterSql, toSqlColumnName } from './build-join-where.js';
+export function buildWhereClause(queryObject, tablePrefix, values = [], operations) {
+    const useJoinFilters = operations !== undefined && operations.length > 0;
+    const { rootOptions, joinFilters } = useJoinFilters
+        ? splitFiltersByType(queryObject, operations, tablePrefix)
+        : { rootOptions: queryObject, joinFilters: [] };
+    const filters = rootOptions.filters || {};
     const conditions = [];
-    let paramIndex = values.length + 1;
-    const qualifyColumn = (columnName) => {
-        return tablePrefix ? `"${tablePrefix}"."${columnName}"` : `"${columnName}"`;
-    };
+    const paramIndex = { current: values.length + 1 };
     for (const [key, value] of Object.entries(filters)) {
         if (value) {
-            let snakeKey;
-            if (key.startsWith('_')) {
-                snakeKey = key;
-            }
-            else if (key === 'id') {
-                snakeKey = '_id';
-            }
-            else {
-                snakeKey = toSnakeCase(key);
-            }
-            const qualifiedKey = qualifyColumn(snakeKey);
-            if (value.eq !== undefined) {
-                const comparison = readFilterValue(value.eq);
-                if (comparison.kind === 'value') {
-                    conditions.push(`(${qualifiedKey} = $${paramIndex} OR (${qualifiedKey} IS NULL AND $${paramIndex} IS NULL))`);
-                    values.push(comparison.value);
-                    paramIndex++;
-                }
-                else {
-                    conditions.push(`${qualifiedKey} IS NULL`);
-                }
-            }
-            if (value.ne !== undefined) {
-                const comparison = readFilterValue(value.ne);
-                if (comparison.kind === 'value') {
-                    conditions.push(`(${qualifiedKey} != $${paramIndex} OR (${qualifiedKey} IS NOT NULL AND $${paramIndex} IS NULL) OR (${qualifiedKey} IS NULL AND $${paramIndex} IS NOT NULL))`);
-                    values.push(comparison.value);
-                    paramIndex++;
-                }
-                else {
-                    conditions.push(`${qualifiedKey} IS NOT NULL`);
-                }
-            }
-            if (value.in !== undefined && Array.isArray(value.in)) {
-                const placeholders = value.in.map(() => `$${paramIndex++}`).join(', ');
-                conditions.push(`${qualifiedKey} IN (${placeholders})`);
-                values.push(...value.in);
-            }
-            if (value.gte !== undefined) {
-                conditions.push(`${qualifiedKey} >= $${paramIndex}`);
-                values.push(value.gte);
-                paramIndex++;
-            }
-            if (value.lte !== undefined) {
-                conditions.push(`${qualifiedKey} <= $${paramIndex}`);
-                values.push(value.lte);
-                paramIndex++;
-            }
-            if (value.gt !== undefined) {
-                conditions.push(`${qualifiedKey} > $${paramIndex}`);
-                values.push(value.gt);
-                paramIndex++;
-            }
-            if (value.lt !== undefined) {
-                conditions.push(`${qualifiedKey} < $${paramIndex}`);
-                values.push(value.lt);
-                paramIndex++;
-            }
-            if (value.contains !== undefined) {
-                conditions.push(`LOWER(${qualifiedKey}) LIKE LOWER($${paramIndex})`);
-                values.push(`%${value.contains}%`);
-                paramIndex++;
+            const qualifiedKey = `"${tablePrefix}"."${toSqlColumnName(key)}"`;
+            appendFilterConditions(qualifiedKey, value, conditions, values, paramIndex);
+        }
+    }
+    if (useJoinFilters) {
+        for (const joinFilter of joinFilters) {
+            const predicate = joinFilterSql(joinFilter, operations, tablePrefix, values, paramIndex);
+            if (predicate) {
+                conditions.push(predicate);
             }
         }
     }

package/dist/databases/utils/is-join-operation.util.d.ts

@@ -0,0 +1,3 @@
+import { type JoinOperation } from "../operations/join-operation.js";
+import { type Operation } from "../operations/operation.js";
+export declare function isJoinOperation(operation: Operation): operation is JoinOperation;

package/dist/databases/utils/is-join-operation.util.js

@@ -0,0 +1,6 @@
+import { InnerJoin } from "../operations/inner-join.operation.js";
+import { LeftJoin } from "../operations/left-join.operation.js";
+import { LeftJoinMany } from "../operations/left-join-many.operation.js";
+export function isJoinOperation(operation) {
+    return operation instanceof LeftJoin || operation instanceof InnerJoin || operation instanceof LeftJoinMany;
+}

package/dist/databases/utils/resolve-join-filter.d.ts

@@ -0,0 +1,13 @@
+import type { IQueryOptions } from '@loomcore/common/models';
+import type { ClassifiedFilterKey } from '../models/classified-filter-key.js';
+import type { Operation } from '../operations/operation.js';
+import type { JoinOperation } from '../operations/join-operation.js';
+import { JoinFilter } from '../models/join-filter.interface.js';
+export declare function parentAliasOf(localField: string): string | null;
+export declare function findJoinOperation(operations: Operation[], alias: string): JoinOperation | undefined;
+export declare function logicalParentAlias(operation: JoinOperation, operations: Operation[], mainTableName: string): string | null;
+export declare function classifyFilterKey(key: string, operations: Operation[], mainTableName: string): ClassifiedFilterKey;
+export declare function splitFiltersByType(queryOptions: IQueryOptions, operations: Operation[], mainTableName: string): {
+    rootOptions: IQueryOptions;
+    joinFilters: JoinFilter[];
+};

package/dist/databases/utils/resolve-join-filter.js

@@ -0,0 +1,75 @@
+import { BadRequestError } from '../../errors/index.js';
+import { LeftJoinMany } from '../operations/left-join-many.operation.js';
+import { isJoinOperation } from './is-join-operation.util.js';
+export function parentAliasOf(localField) {
+    const dot = localField.indexOf('.');
+    if (dot === -1) {
+        return null;
+    }
+    return localField.slice(0, dot);
+}
+export function findJoinOperation(operations, alias) {
+    return operations.find((operation) => isJoinOperation(operation) && operation.as === alias);
+}
+export function logicalParentAlias(operation, operations, mainTableName) {
+    const rawParent = parentAliasOf(operation.localField);
+    if (rawParent === null || rawParent === mainTableName) {
+        return null;
+    }
+    const parent = findJoinOperation(operations, rawParent);
+    return parent ? parent.as : null;
+}
+export function classifyFilterKey(key, operations, mainTableName) {
+    if (!key.includes('.') || operations.length === 0) {
+        return { type: 'root' };
+    }
+    const parts = key.split('.');
+    if (parts.some(part => part.length === 0)) {
+        return { type: 'root' };
+    }
+    if (!findJoinOperation(operations, parts[0])) {
+        return { type: 'root' };
+    }
+    const column = parts[parts.length - 1];
+    const aliases = parts.slice(0, -1);
+    for (let index = 0; index < aliases.length; index++) {
+        const alias = aliases[index];
+        const operation = findJoinOperation(operations, alias);
+        if (!operation) {
+            throw new BadRequestError(`Invalid join filter "${key}": "${alias}" is not a joined table`);
+        }
+        const expectedParent = index === 0 ? null : aliases[index - 1];
+        const actualParent = logicalParentAlias(operation, operations, mainTableName);
+        if (actualParent !== expectedParent) {
+            const where = actualParent ? `"${actualParent}"` : 'the root collection';
+            throw new BadRequestError(`Invalid join filter "${key}": "${alias}" is nested under ${where}`);
+        }
+    }
+    const crossesMany = aliases.some(alias => findJoinOperation(operations, alias) instanceof LeftJoinMany);
+    return { type: 'join', aliases, column, crossesMany };
+}
+export function splitFiltersByType(queryOptions, operations, mainTableName) {
+    const rootFilters = {};
+    const joinFilters = [];
+    for (const [key, filter] of Object.entries(queryOptions.filters ?? {})) {
+        if (!filter) {
+            continue;
+        }
+        const classified = classifyFilterKey(key, operations, mainTableName);
+        if (classified.type === 'root') {
+            rootFilters[key] = filter;
+            continue;
+        }
+        joinFilters.push({
+            key,
+            filter,
+            aliases: classified.aliases,
+            column: classified.column,
+            crossesMany: classified.crossesMany,
+        });
+    }
+    return {
+        rootOptions: { ...queryOptions, filters: rootFilters },
+        joinFilters,
+    };
+}

package/dist/services/organization.service.d.ts

@@ -1,7 +1,19 @@
-import { type IOrganization, type IUserContext } from '@loomcore/common/models';
+import { type IOrganization, type IUser, type IUserContext } from '@loomcore/common/models';
 import type { AppIdType } from '@loomcore/common/types';
 import type { IDatabase } from '../databases/models/index.js';
 import { GenericApiService } from './generic-api-service/generic-api.service.js';
+export interface ICreateOrganizationWithAdminInput {
+    name: string;
+    code: string;
+    adminEmail: string;
+    adminDisplayName?: string;
+}
+export interface ICreateOrganizationWithAdminResult {
+    organization: IOrganization;
+    adminUser: IUser;
+}
+export declare function buildOrganizationTenantDomain(code: string): string;
+export declare function buildOrganizationClientBaseUrl(code: string): string;
 export declare class OrganizationService extends GenericApiService<IOrganization> {
     private organizationDomainService;
     constructor(database: IDatabase);
@@ -10,4 +22,8 @@ export declare class OrganizationService extends GenericApiService<IOrganization
     validateRepoAuthToken(userContext: IUserContext, orgCode: string, authToken: string): Promise<AppIdType | null>;
     getMetaOrg(userContext: IUserContext): Promise<IOrganization | null>;
     findByDomain(userContext: IUserContext, domain: string): Promise<IOrganization | null>;
+    createOrganizationWithAdmin(userContext: IUserContext, input: ICreateOrganizationWithAdminInput): Promise<ICreateOrganizationWithAdminResult>;
+    private parseCreateOrganizationWithAdminInput;
+    private assertCreateOrganizationWithAdminUniqueness;
+    private cleanupCreatedOrganizationWithAdmin;
 }

package/dist/services/organization.service.js

@@ -1,7 +1,31 @@
-import { OrganizationSpec, } from '@loomcore/common/models';
-import { BadRequestError } from '../errors/index.js';
-import { OrganizationDomainService } from './organization-domain.service.js';
+import { getSystemUserContext, OrganizationSpec, } from '@loomcore/common/models';
+import { config } from '../config/index.js';
+import { BadRequestError, ServerError } from '../errors/index.js';
+import { initiatePasswordReset } from '../utils/auth/initiate-password-reset.util.js';
+import { logger } from '../utils/logger.utils.js';
+import { passwordUtils } from '../utils/password.utils.js';
+import { stringUtils } from '../utils/string.utils.js';
+import { AuthorizationService } from './authorization.service.js';
+import { FeatureService } from './feature.service.js';
 import { GenericApiService } from './generic-api-service/generic-api.service.js';
+import { OrganizationDomainService } from './organization-domain.service.js';
+import { PasswordResetTokenService } from './password-reset-token.service.js';
+import { RoleService } from './role.service.js';
+import { UserRoleService } from './user-role.service.js';
+import { UserService } from './user.service.js';
+const ADMIN_ROLE_AND_FEATURE_NAME = 'admin';
+const DEFAULT_ADMIN_DISPLAY_NAME = 'Admin User';
+const DEFAULT_ORGANIZATION_STATUS = 1;
+export function buildOrganizationTenantDomain(code) {
+    const hostName = config.network?.hostName;
+    if (!hostName) {
+        throw new ServerError('network.hostName is not configured');
+    }
+    return `${code}.${hostName}`;
+}
+export function buildOrganizationClientBaseUrl(code) {
+    return `https://${buildOrganizationTenantDomain(code)}`;
+}
 export class OrganizationService extends GenericApiService {
     organizationDomainService;
     constructor(database) {
@@ -54,4 +78,182 @@ export class OrganizationService extends GenericApiService {
             filters: { _id: { eq: organizationDomain.organizationId } },
         });
     }
+    async createOrganizationWithAdmin(userContext, input) {
+        const parsed = this.parseCreateOrganizationWithAdminInput(input);
+        const domain = buildOrganizationTenantDomain(parsed.code);
+        await this.assertCreateOrganizationWithAdminUniqueness(userContext, parsed, domain);
+        const created = {};
+        const userService = new UserService(this.database);
+        const roleService = new RoleService(this.database);
+        const featureService = new FeatureService(this.database);
+        const userRoleService = new UserRoleService(this.database);
+        const authorizationService = new AuthorizationService(this.database);
+        try {
+            const organization = await super.create(userContext, {
+                name: parsed.name,
+                code: parsed.code,
+                status: DEFAULT_ORGANIZATION_STATUS,
+                isMetaOrg: false,
+            });
+            if (!organization?._id) {
+                throw new ServerError('Failed to create organization');
+            }
+            created.organizationId = organization._id;
+            const organizationDomain = await this.organizationDomainService.create(userContext, {
+                organizationId: organization._id,
+                domain,
+            });
+            if (!organizationDomain?._id) {
+                throw new ServerError('Failed to create organization domain');
+            }
+            created.domainId = organizationDomain._id;
+            const adminUser = await userService.create(userContext, {
+                _orgId: organization._id,
+                email: parsed.adminEmail,
+                displayName: parsed.adminDisplayName,
+                password: passwordUtils.generateRandomPassword(),
+            });
+            if (!adminUser?._id) {
+                throw new ServerError('Failed to create organization admin user');
+            }
+            created.userId = adminUser._id;
+            const role = await roleService.create(userContext, {
+                _orgId: organization._id,
+                name: ADMIN_ROLE_AND_FEATURE_NAME,
+            });
+            if (!role?._id) {
+                throw new ServerError('Failed to create organization admin role');
+            }
+            created.roleId = role._id;
+            const feature = await featureService.create(userContext, {
+                _orgId: organization._id,
+                name: ADMIN_ROLE_AND_FEATURE_NAME,
+            });
+            if (!feature?._id) {
+                throw new ServerError('Failed to create organization admin feature');
+            }
+            created.featureId = feature._id;
+            const userRole = await userRoleService.create(userContext, {
+                _orgId: organization._id,
+                userId: adminUser._id,
+                roleId: role._id,
+            });
+            if (!userRole?._id) {
+                throw new ServerError('Failed to create organization admin user role');
+            }
+            created.userRoleId = userRole._id;
+            const authorization = await authorizationService.create(userContext, {
+                _orgId: organization._id,
+                roleId: role._id,
+                featureId: feature._id,
+            });
+            if (!authorization?._id) {
+                throw new ServerError('Failed to create organization admin authorization');
+            }
+            created.authorizationId = authorization._id;
+            await initiatePasswordReset(getSystemUserContext(), this.database, organization._id, parsed.adminEmail, buildOrganizationClientBaseUrl(parsed.code), 'welcome');
+            logger.info(`Created organization ${parsed.code} with admin ${parsed.adminEmail}`);
+            const { password: _password, ...adminUserWithoutPassword } = adminUser;
+            return {
+                organization,
+                adminUser: adminUserWithoutPassword,
+            };
+        }
+        catch (error) {
+            await this.cleanupCreatedOrganizationWithAdmin(created, parsed.adminEmail);
+            throw error;
+        }
+    }
+    parseCreateOrganizationWithAdminInput(input) {
+        if (!input || typeof input !== 'object') {
+            throw new BadRequestError('Request body is required.');
+        }
+        const rawInput = input;
+        if ('password' in rawInput && rawInput.password !== undefined) {
+            throw new BadRequestError('Password must not be provided. The admin will set their password via the welcome email.');
+        }
+        if ('adminPassword' in rawInput && rawInput.adminPassword !== undefined) {
+            throw new BadRequestError('Password must not be provided. The admin will set their password via the welcome email.');
+        }
+        const name = typeof input.name === 'string' ? input.name.trim() : '';
+        const code = typeof input.code === 'string' ? input.code : '';
+        const adminEmail = typeof input.adminEmail === 'string' ? input.adminEmail.trim().toLowerCase() : '';
+        if (input.adminDisplayName !== undefined && typeof input.adminDisplayName !== 'string') {
+            throw new BadRequestError('Admin display name must be a string.');
+        }
+        const adminDisplayName = input.adminDisplayName === undefined ? DEFAULT_ADMIN_DISPLAY_NAME : input.adminDisplayName;
+        if (!name) {
+            throw new BadRequestError('Organization name is required.');
+        }
+        if (!code) {
+            throw new BadRequestError('Organization code is required.');
+        }
+        if (!stringUtils.isValidDnsLabel(code)) {
+            throw new BadRequestError('Organization code must be a valid DNS label: lowercase letters, digits, and hyphens, with no leading or trailing hyphen.');
+        }
+        if (!adminEmail) {
+            throw new BadRequestError('Admin email is required.');
+        }
+        if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(adminEmail)) {
+            throw new BadRequestError('Admin email is not a valid email address.');
+        }
+        return { name, code, adminEmail, adminDisplayName };
+    }
+    async assertCreateOrganizationWithAdminUniqueness(userContext, parsed, domain) {
+        const existingByName = await this.findOne(userContext, {
+            filters: { name: { eq: parsed.name } },
+        });
+        if (existingByName) {
+            throw new BadRequestError('Organization name is already in use.');
+        }
+        const existingByCode = await this.findOne(userContext, {
+            filters: { code: { eq: parsed.code } },
+        });
+        if (existingByCode) {
+            throw new BadRequestError('Organization code is already in use.');
+        }
+        const existingDomain = await this.organizationDomainService.findOne(userContext, {
+            filters: { domain: { eq: domain } },
+        });
+        if (existingDomain) {
+            throw new BadRequestError('Organization domain is already in use.');
+        }
+    }
+    async cleanupCreatedOrganizationWithAdmin(created, adminEmail) {
+        const systemUserContext = getSystemUserContext();
+        const userService = new UserService(this.database);
+        const roleService = new RoleService(this.database);
+        const featureService = new FeatureService(this.database);
+        const userRoleService = new UserRoleService(this.database);
+        const authorizationService = new AuthorizationService(this.database);
+        const passwordResetTokenService = new PasswordResetTokenService(this.database);
+        const deleteByIdIfPresent = async (label, deleteById, id) => {
+            if (id === undefined) {
+                return;
+            }
+            try {
+                await deleteById(systemUserContext, id);
+            }
+            catch (cleanupError) {
+                logger.error(`Failed to clean up ${label} ${String(id)} after createOrganizationWithAdmin error`, cleanupError);
+            }
+        };
+        if (created.organizationId !== undefined) {
+            try {
+                await passwordResetTokenService.deleteMany(systemUserContext, {
+                    filters: { email: { eq: adminEmail }, _orgId: { eq: created.organizationId } },
+                });
+            }
+            catch (cleanupError) {
+                logger.error('Failed to clean up password reset tokens after createOrganizationWithAdmin error', cleanupError);
+            }
+        }
+        await deleteByIdIfPresent('authorization', authorizationService.deleteById.bind(authorizationService), created.authorizationId);
+        await deleteByIdIfPresent('userRole', userRoleService.deleteById.bind(userRoleService), created.userRoleId);
+        await deleteByIdIfPresent('feature', featureService.deleteById.bind(featureService), created.featureId);
+        await deleteByIdIfPresent('role', roleService.deleteById.bind(roleService), created.roleId);
+        await deleteByIdIfPresent('user', userService.deleteById.bind(userService), created.userId);
+        await deleteByIdIfPresent('organizationDomain', this.organizationDomainService.deleteById.bind(this.organizationDomainService), created.domainId);
+        await deleteByIdIfPresent('organization', this.deleteById.bind(this), created.organizationId);
+    }
 }

package/dist/utils/password.utils.d.ts

@@ -1,7 +1,9 @@
 declare function hashPassword(password: string): Promise<string>;
+declare function generateRandomPassword(): string;
 declare function comparePasswords(storedPassword: string, suppliedPassword: string): Promise<boolean>;
 export declare const passwordUtils: {
     hashPassword: typeof hashPassword;
     comparePasswords: typeof comparePasswords;
+    generateRandomPassword: typeof generateRandomPassword;
 };
 export {};

package/dist/utils/password.utils.js

@@ -6,6 +6,9 @@ async function hashPassword(password) {
     const buf = (await scryptAsync(password, salt, 64));
     return `${buf.toString('hex')}.${salt}`;
 }
+function generateRandomPassword() {
+    return randomBytes(16).toString('hex');
+}
 async function comparePasswords(storedPassword, suppliedPassword) {
     if (!storedPassword?.includes('.')) {
         return false;
@@ -20,4 +23,5 @@ async function comparePasswords(storedPassword, suppliedPassword) {
 export const passwordUtils = {
     hashPassword,
     comparePasswords,
+    generateRandomPassword,
 };