@lssm/example.saas-boilerplate 0.0.0-canary-20251217060834 → 0.0.0-canary-20251217073102

package/dist/libs/identity-rbac/dist/contracts/user.js

@@ -0,0 +1,335 @@
+import { ScalarTypeEnum } from "../schema/dist/ScalarTypeEnum.js";
+import { SchemaModel } from "../schema/dist/SchemaModel.js";
+import "../schema/dist/index.js";
+import { defineCommand, defineQuery } from "./dist/spec.js";
+import "./dist/index.js";
+
+//#region ../../libs/identity-rbac/dist/contracts/user.js
+const OWNERS = ["platform.identity-rbac"];
+const UserProfileModel = new SchemaModel({
+	name: "UserProfile",
+	description: "User profile information",
+	fields: {
+		id: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		email: {
+			type: ScalarTypeEnum.EmailAddress(),
+			isOptional: false
+		},
+		emailVerified: {
+			type: ScalarTypeEnum.Boolean(),
+			isOptional: false
+		},
+		name: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		firstName: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		lastName: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		locale: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		timezone: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		imageUrl: {
+			type: ScalarTypeEnum.URL(),
+			isOptional: true
+		},
+		role: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		onboardingCompleted: {
+			type: ScalarTypeEnum.Boolean(),
+			isOptional: false
+		},
+		createdAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const CreateUserInputModel = new SchemaModel({
+	name: "CreateUserInput",
+	description: "Input for creating a new user",
+	fields: {
+		email: {
+			type: ScalarTypeEnum.EmailAddress(),
+			isOptional: false
+		},
+		name: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		firstName: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		lastName: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		password: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		}
+	}
+});
+const UpdateUserInputModel = new SchemaModel({
+	name: "UpdateUserInput",
+	description: "Input for updating a user profile",
+	fields: {
+		name: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		firstName: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		lastName: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		locale: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		timezone: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		imageUrl: {
+			type: ScalarTypeEnum.URL(),
+			isOptional: true
+		}
+	}
+});
+const DeleteUserInputModel = new SchemaModel({
+	name: "DeleteUserInput",
+	description: "Input for deleting a user",
+	fields: { confirmEmail: {
+		type: ScalarTypeEnum.EmailAddress(),
+		isOptional: false
+	} }
+});
+const SuccessResultModel = new SchemaModel({
+	name: "SuccessResult",
+	description: "Simple success result",
+	fields: { success: {
+		type: ScalarTypeEnum.Boolean(),
+		isOptional: false
+	} }
+});
+const UserDeletedPayloadModel = new SchemaModel({
+	name: "UserDeletedPayload",
+	description: "Payload for user deleted event",
+	fields: { userId: {
+		type: ScalarTypeEnum.String_unsecure(),
+		isOptional: false
+	} }
+});
+const ListUsersInputModel = new SchemaModel({
+	name: "ListUsersInput",
+	description: "Input for listing users",
+	fields: {
+		limit: {
+			type: ScalarTypeEnum.Int_unsecure(),
+			isOptional: true
+		},
+		offset: {
+			type: ScalarTypeEnum.Int_unsecure(),
+			isOptional: true
+		},
+		search: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		}
+	}
+});
+const ListUsersOutputModel = new SchemaModel({
+	name: "ListUsersOutput",
+	description: "Output for listing users",
+	fields: {
+		users: {
+			type: UserProfileModel,
+			isOptional: false,
+			isArray: true
+		},
+		total: {
+			type: ScalarTypeEnum.Int_unsecure(),
+			isOptional: false
+		}
+	}
+});
+/**
+* Create a new user account.
+*/
+const CreateUserContract = defineCommand({
+	meta: {
+		name: "identity.user.create",
+		version: 1,
+		stability: "stable",
+		owners: [...OWNERS],
+		tags: [
+			"identity",
+			"user",
+			"create"
+		],
+		description: "Create a new user account.",
+		goal: "Register a new user in the system.",
+		context: "Used during signup flows. May trigger email verification."
+	},
+	io: {
+		input: CreateUserInputModel,
+		output: UserProfileModel,
+		errors: { EMAIL_EXISTS: {
+			description: "A user with this email already exists",
+			http: 409,
+			gqlCode: "EMAIL_EXISTS",
+			when: "Email is already registered"
+		} }
+	},
+	policy: { auth: "anonymous" },
+	sideEffects: {
+		emits: [{
+			name: "user.created",
+			version: 1,
+			when: "User is successfully created",
+			payload: UserProfileModel
+		}],
+		audit: ["user.created"]
+	}
+});
+/**
+* Get the current user's profile.
+*/
+const GetCurrentUserContract = defineQuery({
+	meta: {
+		name: "identity.user.me",
+		version: 1,
+		stability: "stable",
+		owners: [...OWNERS],
+		tags: [
+			"identity",
+			"user",
+			"profile"
+		],
+		description: "Get the current authenticated user profile.",
+		goal: "Retrieve user profile for the authenticated session.",
+		context: "Called on app load and after profile updates."
+	},
+	io: {
+		input: null,
+		output: UserProfileModel
+	},
+	policy: { auth: "user" }
+});
+/**
+* Update user profile.
+*/
+const UpdateUserContract = defineCommand({
+	meta: {
+		name: "identity.user.update",
+		version: 1,
+		stability: "stable",
+		owners: [...OWNERS],
+		tags: [
+			"identity",
+			"user",
+			"update"
+		],
+		description: "Update user profile information.",
+		goal: "Allow users to update their profile.",
+		context: "Self-service profile updates."
+	},
+	io: {
+		input: UpdateUserInputModel,
+		output: UserProfileModel
+	},
+	policy: { auth: "user" },
+	sideEffects: {
+		emits: [{
+			name: "user.updated",
+			version: 1,
+			when: "User profile is updated",
+			payload: UserProfileModel
+		}],
+		audit: ["user.updated"]
+	}
+});
+/**
+* Delete user account.
+*/
+const DeleteUserContract = defineCommand({
+	meta: {
+		name: "identity.user.delete",
+		version: 1,
+		stability: "stable",
+		owners: [...OWNERS],
+		tags: [
+			"identity",
+			"user",
+			"delete"
+		],
+		description: "Delete user account and all associated data.",
+		goal: "Allow users to delete their account (GDPR compliance).",
+		context: "Self-service account deletion. Cascades to memberships, sessions, etc."
+	},
+	io: {
+		input: DeleteUserInputModel,
+		output: SuccessResultModel
+	},
+	policy: {
+		auth: "user",
+		escalate: "human_review"
+	},
+	sideEffects: {
+		emits: [{
+			name: "user.deleted",
+			version: 1,
+			when: "User account is deleted",
+			payload: UserDeletedPayloadModel
+		}],
+		audit: ["user.deleted"]
+	}
+});
+/**
+* List users (admin only).
+*/
+const ListUsersContract = defineQuery({
+	meta: {
+		name: "identity.user.list",
+		version: 1,
+		stability: "stable",
+		owners: [...OWNERS],
+		tags: [
+			"identity",
+			"user",
+			"admin",
+			"list"
+		],
+		description: "List all users (admin only).",
+		goal: "Allow admins to browse and manage users.",
+		context: "Admin dashboard user management."
+	},
+	io: {
+		input: ListUsersInputModel,
+		output: ListUsersOutputModel
+	},
+	policy: { auth: "admin" }
+});
+
+//#endregion
+export { CreateUserInputModel, DeleteUserInputModel, ListUsersInputModel, ListUsersOutputModel, SuccessResultModel, UpdateUserInputModel, UserDeletedPayloadModel, UserProfileModel };

package/dist/libs/identity-rbac/dist/entities/index.js

@@ -0,0 +1,35 @@
+import { AccountEntity, SessionEntity, UserEntity, VerificationEntity } from "./user.js";
+import { InvitationEntity, MemberEntity, OrganizationEntity, OrganizationTypeEnum, TeamEntity, TeamMemberEntity } from "./organization.js";
+import { ApiKeyEntity, PasskeyEntity, PermissionEntity, PolicyBindingEntity, RoleEntity } from "./rbac.js";
+
+//#region ../../libs/identity-rbac/dist/entities/index.js
+/**
+* All identity-rbac entities for schema composition.
+*/
+const identityRbacEntities = [
+	UserEntity,
+	SessionEntity,
+	AccountEntity,
+	VerificationEntity,
+	OrganizationEntity,
+	MemberEntity,
+	InvitationEntity,
+	TeamEntity,
+	TeamMemberEntity,
+	RoleEntity,
+	PermissionEntity,
+	PolicyBindingEntity,
+	ApiKeyEntity,
+	PasskeyEntity
+];
+/**
+* Module schema contribution for identity-rbac.
+*/
+const identityRbacSchemaContribution = {
+	moduleId: "@lssm/lib.identity-rbac",
+	entities: identityRbacEntities,
+	enums: [OrganizationTypeEnum]
+};
+
+//#endregion
+export { identityRbacEntities, identityRbacSchemaContribution };

package/dist/libs/identity-rbac/dist/entities/organization.js

@@ -0,0 +1,151 @@
+import { defineEntity, defineEntityEnum, field, index } from "../schema/dist/entity/defineEntity.js";
+import "../schema/dist/index.js";
+
+//#region ../../libs/identity-rbac/dist/entities/organization.js
+/**
+* Organization type enum.
+*/
+const OrganizationTypeEnum = defineEntityEnum({
+	name: "OrganizationType",
+	values: ["PLATFORM_ADMIN", "CONTRACT_SPEC_CUSTOMER"],
+	schema: "lssm_sigil",
+	description: "Type of organization in the platform."
+});
+/**
+* Organization entity - tenant/company grouping.
+*/
+const OrganizationEntity = defineEntity({
+	name: "Organization",
+	description: "An organization is a tenant boundary grouping users.",
+	schema: "lssm_sigil",
+	map: "organization",
+	fields: {
+		id: field.id({ description: "Unique organization identifier" }),
+		name: field.string({ description: "Organization display name" }),
+		slug: field.string({
+			isOptional: true,
+			isUnique: true,
+			description: "URL-friendly identifier"
+		}),
+		logo: field.url({
+			isOptional: true,
+			description: "Organization logo URL"
+		}),
+		description: field.string({
+			isOptional: true,
+			description: "Organization description"
+		}),
+		metadata: field.json({
+			isOptional: true,
+			description: "Arbitrary organization metadata"
+		}),
+		type: field.enum("OrganizationType", { description: "Organization type" }),
+		onboardingCompleted: field.boolean({ default: false }),
+		onboardingStep: field.string({ isOptional: true }),
+		referralCode: field.string({
+			isOptional: true,
+			isUnique: true,
+			description: "Unique referral code"
+		}),
+		referredBy: field.string({
+			isOptional: true,
+			description: "ID of referring user"
+		}),
+		createdAt: field.createdAt(),
+		updatedAt: field.updatedAt(),
+		members: field.hasMany("Member"),
+		invitations: field.hasMany("Invitation"),
+		teams: field.hasMany("Team"),
+		policyBindings: field.hasMany("PolicyBinding")
+	},
+	enums: [OrganizationTypeEnum]
+});
+/**
+* Member entity - user membership in an organization.
+*/
+const MemberEntity = defineEntity({
+	name: "Member",
+	description: "Membership of a user in an organization with a role.",
+	schema: "lssm_sigil",
+	map: "member",
+	fields: {
+		id: field.id(),
+		userId: field.foreignKey(),
+		organizationId: field.foreignKey(),
+		role: field.string({ description: "Role in organization (owner, admin, member)" }),
+		createdAt: field.createdAt(),
+		user: field.belongsTo("User", ["userId"], ["id"], { onDelete: "Cascade" }),
+		organization: field.belongsTo("Organization", ["organizationId"], ["id"], { onDelete: "Cascade" })
+	},
+	indexes: [index.unique(["userId", "organizationId"])]
+});
+/**
+* Invitation entity - pending organization invites.
+*/
+const InvitationEntity = defineEntity({
+	name: "Invitation",
+	description: "An invitation to join an organization.",
+	schema: "lssm_sigil",
+	map: "invitation",
+	fields: {
+		id: field.id(),
+		organizationId: field.foreignKey(),
+		email: field.email({ description: "Invited email address" }),
+		role: field.string({
+			isOptional: true,
+			description: "Role to assign on acceptance"
+		}),
+		status: field.string({
+			default: "\"pending\"",
+			description: "Invitation status"
+		}),
+		acceptedAt: field.dateTime({ isOptional: true }),
+		expiresAt: field.dateTime({ isOptional: true }),
+		inviterId: field.foreignKey({ description: "User who sent the invitation" }),
+		teamId: field.string({ isOptional: true }),
+		createdAt: field.createdAt(),
+		updatedAt: field.updatedAt(),
+		organization: field.belongsTo("Organization", ["organizationId"], ["id"], { onDelete: "Cascade" }),
+		inviter: field.belongsTo("User", ["inviterId"], ["id"], { onDelete: "Cascade" }),
+		team: field.belongsTo("Team", ["teamId"], ["id"], { onDelete: "Cascade" })
+	}
+});
+/**
+* Team entity - team within an organization.
+*/
+const TeamEntity = defineEntity({
+	name: "Team",
+	description: "Team within an organization.",
+	schema: "lssm_sigil",
+	map: "team",
+	fields: {
+		id: field.id(),
+		name: field.string({ description: "Team name" }),
+		organizationId: field.foreignKey(),
+		createdAt: field.createdAt(),
+		updatedAt: field.updatedAt(),
+		organization: field.belongsTo("Organization", ["organizationId"], ["id"], { onDelete: "Cascade" }),
+		members: field.hasMany("TeamMember"),
+		invitations: field.hasMany("Invitation")
+	}
+});
+/**
+* TeamMember entity - user's team membership.
+*/
+const TeamMemberEntity = defineEntity({
+	name: "TeamMember",
+	description: "Team membership for a user.",
+	schema: "lssm_sigil",
+	map: "team_member",
+	fields: {
+		id: field.id(),
+		teamId: field.foreignKey(),
+		userId: field.foreignKey(),
+		createdAt: field.createdAt(),
+		team: field.belongsTo("Team", ["teamId"], ["id"], { onDelete: "Cascade" }),
+		user: field.belongsTo("User", ["userId"], ["id"], { onDelete: "Cascade" })
+	}
+});
+
+//#endregion
+export { InvitationEntity, MemberEntity, OrganizationEntity, OrganizationTypeEnum, TeamEntity, TeamMemberEntity };

package/dist/libs/identity-rbac/dist/entities/rbac.js

@@ -0,0 +1,138 @@
+import { defineEntity, field, index } from "../schema/dist/entity/defineEntity.js";
+import "../schema/dist/index.js";
+
+//#region ../../libs/identity-rbac/dist/entities/rbac.js
+/**
+* Role entity - named set of permissions.
+*/
+const RoleEntity = defineEntity({
+	name: "Role",
+	description: "A role defines a named set of permissions.",
+	schema: "lssm_sigil",
+	map: "role",
+	fields: {
+		id: field.id(),
+		name: field.string({
+			isUnique: true,
+			description: "Unique role name"
+		}),
+		description: field.string({
+			isOptional: true,
+			description: "Role description"
+		}),
+		permissions: field.string({
+			isArray: true,
+			description: "Array of permission names"
+		}),
+		createdAt: field.createdAt(),
+		updatedAt: field.updatedAt(),
+		policyBindings: field.hasMany("PolicyBinding")
+	}
+});
+/**
+* Permission entity - atomic access right.
+*/
+const PermissionEntity = defineEntity({
+	name: "Permission",
+	description: "A permission represents an atomic access right.",
+	schema: "lssm_sigil",
+	map: "permission",
+	fields: {
+		id: field.id(),
+		name: field.string({
+			isUnique: true,
+			description: "Unique permission name"
+		}),
+		description: field.string({
+			isOptional: true,
+			description: "Permission description"
+		}),
+		createdAt: field.createdAt(),
+		updatedAt: field.updatedAt()
+	}
+});
+/**
+* PolicyBinding entity - binds roles to principals.
+*/
+const PolicyBindingEntity = defineEntity({
+	name: "PolicyBinding",
+	description: "Binds roles to principals (users or organizations).",
+	schema: "lssm_sigil",
+	map: "policy_binding",
+	fields: {
+		id: field.id(),
+		roleId: field.foreignKey(),
+		targetType: field.string({ description: "\"user\" or \"organization\"" }),
+		targetId: field.string({ description: "ID of User or Organization" }),
+		expiresAt: field.dateTime({
+			isOptional: true,
+			description: "When binding expires"
+		}),
+		createdAt: field.createdAt(),
+		userId: field.string({ isOptional: true }),
+		organizationId: field.string({ isOptional: true }),
+		role: field.belongsTo("Role", ["roleId"], ["id"], { onDelete: "Cascade" }),
+		user: field.belongsTo("User", ["userId"], ["id"]),
+		organization: field.belongsTo("Organization", ["organizationId"], ["id"])
+	},
+	indexes: [index.on(["targetType", "targetId"])]
+});
+/**
+* ApiKey entity - API keys for programmatic access.
+*/
+const ApiKeyEntity = defineEntity({
+	name: "ApiKey",
+	description: "API keys for programmatic access.",
+	schema: "lssm_sigil",
+	map: "api_key",
+	fields: {
+		id: field.id(),
+		name: field.string({ description: "API key name" }),
+		start: field.string({ description: "Starting characters for identification" }),
+		prefix: field.string({ description: "API key prefix" }),
+		key: field.string({ description: "Hashed API key" }),
+		userId: field.foreignKey(),
+		refillInterval: field.int({ description: "Refill interval in ms" }),
+		refillAmount: field.int({ description: "Amount to refill" }),
+		lastRefillAt: field.dateTime(),
+		remaining: field.int({ description: "Remaining requests" }),
+		requestCount: field.int({ description: "Total requests made" }),
+		lastRequest: field.dateTime(),
+		enabled: field.boolean({ default: true }),
+		rateLimitEnabled: field.boolean({ default: true }),
+		rateLimitTimeWindow: field.int({ description: "Rate limit window in ms" }),
+		rateLimitMax: field.int({ description: "Max requests in window" }),
+		expiresAt: field.dateTime(),
+		permissions: field.string({ isArray: true }),
+		metadata: field.json({ isOptional: true }),
+		createdAt: field.createdAt(),
+		updatedAt: field.updatedAt(),
+		user: field.belongsTo("User", ["userId"], ["id"], { onDelete: "Cascade" })
+	}
+});
+/**
+* Passkey entity - WebAuthn passkeys.
+*/
+const PasskeyEntity = defineEntity({
+	name: "Passkey",
+	description: "WebAuthn passkeys for passwordless authentication.",
+	schema: "lssm_sigil",
+	map: "passkey",
+	fields: {
+		id: field.id(),
+		name: field.string({ description: "Passkey name" }),
+		publicKey: field.string({ description: "Public key" }),
+		userId: field.foreignKey(),
+		credentialID: field.string({ description: "Credential ID" }),
+		counter: field.int({ description: "Counter" }),
+		deviceType: field.string({ description: "Device type" }),
+		backedUp: field.boolean({ description: "Whether passkey is backed up" }),
+		transports: field.string({ description: "Transports" }),
+		aaguid: field.string({ description: "Authenticator GUID" }),
+		createdAt: field.createdAt(),
+		user: field.belongsTo("User", ["userId"], ["id"], { onDelete: "Cascade" })
+	}
+});
+
+//#endregion
+export { ApiKeyEntity, PasskeyEntity, PermissionEntity, PolicyBindingEntity, RoleEntity };