@lssm/example.wealth-snapshot 0.0.0-canary-20251217060834 → 0.0.0-canary-20251217072406

package/dist/libs/identity-rbac/dist/entities/user.js

@@ -0,0 +1,194 @@
+import { defineEntity, field, index } from "../schema/dist/entity/defineEntity.js";
+import "../schema/dist/index.js";
+
+//#region ../../libs/identity-rbac/dist/entities/user.js
+/**
+* User entity - core user profile and authentication.
+*/
+const UserEntity = defineEntity({
+	name: "User",
+	description: "A user of the platform. Users hold core profile information and authenticate via Account records.",
+	schema: "lssm_sigil",
+	map: "user",
+	fields: {
+		id: field.id({ description: "Unique user identifier" }),
+		email: field.email({
+			isUnique: true,
+			description: "User email address"
+		}),
+		emailVerified: field.boolean({
+			default: false,
+			description: "Whether email has been verified"
+		}),
+		name: field.string({
+			isOptional: true,
+			description: "Display name"
+		}),
+		firstName: field.string({
+			isOptional: true,
+			description: "First name"
+		}),
+		lastName: field.string({
+			isOptional: true,
+			description: "Last name"
+		}),
+		locale: field.string({
+			isOptional: true,
+			description: "User locale (e.g., \"en-US\")"
+		}),
+		timezone: field.string({
+			isOptional: true,
+			description: "Olson timezone (e.g., \"Europe/Paris\")"
+		}),
+		imageUrl: field.url({
+			isOptional: true,
+			description: "URL of avatar or profile picture"
+		}),
+		image: field.string({
+			isOptional: true,
+			description: "Legacy image field"
+		}),
+		metadata: field.json({
+			isOptional: true,
+			description: "Arbitrary user metadata"
+		}),
+		onboardingCompleted: field.boolean({
+			default: false,
+			description: "Whether onboarding is complete"
+		}),
+		onboardingStep: field.string({
+			isOptional: true,
+			description: "Current onboarding step"
+		}),
+		whitelistedAt: field.dateTime({
+			isOptional: true,
+			description: "When user was whitelisted"
+		}),
+		role: field.string({
+			isOptional: true,
+			default: "\"user\"",
+			description: "User role (user, admin)"
+		}),
+		banned: field.boolean({
+			default: false,
+			description: "Whether user is banned"
+		}),
+		banReason: field.string({
+			isOptional: true,
+			description: "Reason for ban"
+		}),
+		banExpires: field.dateTime({
+			isOptional: true,
+			description: "When ban expires"
+		}),
+		phoneNumber: field.string({
+			isOptional: true,
+			isUnique: true,
+			description: "Phone number"
+		}),
+		phoneNumberVerified: field.boolean({
+			default: false,
+			description: "Whether phone is verified"
+		}),
+		createdAt: field.createdAt(),
+		updatedAt: field.updatedAt(),
+		sessions: field.hasMany("Session"),
+		accounts: field.hasMany("Account"),
+		memberships: field.hasMany("Member"),
+		invitations: field.hasMany("Invitation"),
+		teamMemberships: field.hasMany("TeamMember"),
+		policyBindings: field.hasMany("PolicyBinding"),
+		apiKeys: field.hasMany("ApiKey"),
+		passkeys: field.hasMany("Passkey")
+	}
+});
+/**
+* Session entity - login sessions.
+*/
+const SessionEntity = defineEntity({
+	name: "Session",
+	description: "Represents a login session (e.g., web session or API token).",
+	schema: "lssm_sigil",
+	map: "session",
+	fields: {
+		id: field.id(),
+		userId: field.foreignKey(),
+		expiresAt: field.dateTime({ description: "Session expiration time" }),
+		token: field.string({
+			isUnique: true,
+			description: "Session token"
+		}),
+		ipAddress: field.string({
+			isOptional: true,
+			description: "Client IP address"
+		}),
+		userAgent: field.string({
+			isOptional: true,
+			description: "Client user agent"
+		}),
+		impersonatedBy: field.string({
+			isOptional: true,
+			description: "Admin impersonating this session"
+		}),
+		activeOrganizationId: field.string({
+			isOptional: true,
+			description: "Active org context"
+		}),
+		activeTeamId: field.string({
+			isOptional: true,
+			description: "Active team context"
+		}),
+		createdAt: field.createdAt(),
+		updatedAt: field.updatedAt(),
+		user: field.belongsTo("User", ["userId"], ["id"], { onDelete: "Cascade" })
+	}
+});
+/**
+* Account entity - external authentication accounts.
+*/
+const AccountEntity = defineEntity({
+	name: "Account",
+	description: "External authentication accounts (OAuth, password, etc.).",
+	schema: "lssm_sigil",
+	map: "account",
+	fields: {
+		id: field.id(),
+		accountId: field.string({ description: "Account ID from provider" }),
+		providerId: field.string({ description: "Provider identifier" }),
+		userId: field.foreignKey(),
+		accessToken: field.string({ isOptional: true }),
+		refreshToken: field.string({ isOptional: true }),
+		idToken: field.string({ isOptional: true }),
+		accessTokenExpiresAt: field.dateTime({ isOptional: true }),
+		refreshTokenExpiresAt: field.dateTime({ isOptional: true }),
+		scope: field.string({ isOptional: true }),
+		password: field.string({
+			isOptional: true,
+			description: "Hashed password for password providers"
+		}),
+		createdAt: field.createdAt(),
+		updatedAt: field.updatedAt(),
+		user: field.belongsTo("User", ["userId"], ["id"], { onDelete: "Cascade" })
+	},
+	indexes: [index.unique(["accountId", "providerId"])]
+});
+/**
+* Verification entity - email/phone verification tokens.
+*/
+const VerificationEntity = defineEntity({
+	name: "Verification",
+	description: "Verification tokens for email/phone confirmation.",
+	schema: "lssm_sigil",
+	map: "verification",
+	fields: {
+		id: field.uuid(),
+		identifier: field.string({ description: "Email or phone being verified" }),
+		value: field.string({ description: "Verification code/token" }),
+		expiresAt: field.dateTime({ description: "Token expiration" }),
+		createdAt: field.createdAt(),
+		updatedAt: field.updatedAt()
+	}
+});
+
+//#endregion
+export { AccountEntity, SessionEntity, UserEntity, VerificationEntity };

package/dist/libs/identity-rbac/dist/events.js

@@ -0,0 +1,522 @@
+import { ScalarTypeEnum } from "./schema/dist/ScalarTypeEnum.js";
+import { SchemaModel } from "./schema/dist/SchemaModel.js";
+import "./schema/dist/index.js";
+import { defineEvent } from "./contracts/dist/events.js";
+import "./contracts/dist/index.js";
+
+//#region ../../libs/identity-rbac/dist/events.js
+const UserCreatedPayload = new SchemaModel({
+	name: "UserCreatedPayload",
+	description: "Payload for user created event",
+	fields: {
+		userId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		email: {
+			type: ScalarTypeEnum.EmailAddress(),
+			isOptional: false
+		},
+		name: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		createdAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const UserUpdatedPayload = new SchemaModel({
+	name: "UserUpdatedPayload",
+	description: "Payload for user updated event",
+	fields: {
+		userId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		updatedFields: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false,
+			isArray: true
+		},
+		updatedAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const UserDeletedPayload = new SchemaModel({
+	name: "UserDeletedPayload",
+	description: "Payload for user deleted event",
+	fields: {
+		userId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		email: {
+			type: ScalarTypeEnum.EmailAddress(),
+			isOptional: false
+		},
+		deletedAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const UserEmailVerifiedPayload = new SchemaModel({
+	name: "UserEmailVerifiedPayload",
+	description: "Payload for user email verified event",
+	fields: {
+		userId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		email: {
+			type: ScalarTypeEnum.EmailAddress(),
+			isOptional: false
+		},
+		verifiedAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const OrgCreatedPayload = new SchemaModel({
+	name: "OrgCreatedPayload",
+	description: "Payload for org created event",
+	fields: {
+		orgId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		name: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		slug: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		createdBy: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		createdAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const OrgUpdatedPayload = new SchemaModel({
+	name: "OrgUpdatedPayload",
+	description: "Payload for org updated event",
+	fields: {
+		orgId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		updatedFields: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false,
+			isArray: true
+		},
+		updatedBy: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		updatedAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const OrgDeletedPayload = new SchemaModel({
+	name: "OrgDeletedPayload",
+	description: "Payload for org deleted event",
+	fields: {
+		orgId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		name: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		deletedBy: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		deletedAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const OrgMemberAddedPayload = new SchemaModel({
+	name: "OrgMemberAddedPayload",
+	description: "Payload for member added event",
+	fields: {
+		orgId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		userId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		role: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		invitedBy: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		joinedAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const OrgMemberRemovedPayload = new SchemaModel({
+	name: "OrgMemberRemovedPayload",
+	description: "Payload for member removed event",
+	fields: {
+		orgId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		userId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		removedBy: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		reason: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		removedAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const OrgMemberRoleChangedPayload = new SchemaModel({
+	name: "OrgMemberRoleChangedPayload",
+	description: "Payload for member role changed event",
+	fields: {
+		orgId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		userId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		previousRole: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		newRole: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		changedBy: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		changedAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const OrgInviteSentPayload = new SchemaModel({
+	name: "OrgInviteSentPayload",
+	description: "Payload for invite sent event",
+	fields: {
+		invitationId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		orgId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		email: {
+			type: ScalarTypeEnum.EmailAddress(),
+			isOptional: false
+		},
+		role: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		invitedBy: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		expiresAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: true
+		},
+		sentAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const OrgInviteAcceptedPayload = new SchemaModel({
+	name: "OrgInviteAcceptedPayload",
+	description: "Payload for invite accepted event",
+	fields: {
+		invitationId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		orgId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		userId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		acceptedAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const OrgInviteDeclinedPayload = new SchemaModel({
+	name: "OrgInviteDeclinedPayload",
+	description: "Payload for invite declined event",
+	fields: {
+		invitationId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		orgId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		declinedAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const RoleAssignedPayload = new SchemaModel({
+	name: "RoleAssignedPayload",
+	description: "Payload for role assigned event",
+	fields: {
+		bindingId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		roleId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		roleName: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		targetType: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		targetId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		assignedBy: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		expiresAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: true
+		},
+		assignedAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const RoleRevokedPayload = new SchemaModel({
+	name: "RoleRevokedPayload",
+	description: "Payload for role revoked event",
+	fields: {
+		bindingId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		roleId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		roleName: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		targetType: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		targetId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		revokedBy: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		revokedAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+/**
+* Emitted when a new user is created.
+*/
+const UserCreatedEvent = defineEvent({
+	name: "user.created",
+	version: 1,
+	description: "A new user has been created.",
+	payload: UserCreatedPayload
+});
+/**
+* Emitted when a user profile is updated.
+*/
+const UserUpdatedEvent = defineEvent({
+	name: "user.updated",
+	version: 1,
+	description: "A user profile has been updated.",
+	payload: UserUpdatedPayload
+});
+/**
+* Emitted when a user is deleted.
+*/
+const UserDeletedEvent = defineEvent({
+	name: "user.deleted",
+	version: 1,
+	description: "A user account has been deleted.",
+	pii: ["email"],
+	payload: UserDeletedPayload
+});
+/**
+* Emitted when a user's email is verified.
+*/
+const UserEmailVerifiedEvent = defineEvent({
+	name: "user.email_verified",
+	version: 1,
+	description: "A user has verified their email address.",
+	payload: UserEmailVerifiedPayload
+});
+/**
+* Emitted when a new organization is created.
+*/
+const OrgCreatedEvent = defineEvent({
+	name: "org.created",
+	version: 1,
+	description: "A new organization has been created.",
+	payload: OrgCreatedPayload
+});
+/**
+* Emitted when an organization is updated.
+*/
+const OrgUpdatedEvent = defineEvent({
+	name: "org.updated",
+	version: 1,
+	description: "An organization has been updated.",
+	payload: OrgUpdatedPayload
+});
+/**
+* Emitted when an organization is deleted.
+*/
+const OrgDeletedEvent = defineEvent({
+	name: "org.deleted",
+	version: 1,
+	description: "An organization has been deleted.",
+	payload: OrgDeletedPayload
+});
+/**
+* Emitted when a member joins an organization.
+*/
+const OrgMemberAddedEvent = defineEvent({
+	name: "org.member.added",
+	version: 1,
+	description: "A user has joined an organization.",
+	payload: OrgMemberAddedPayload
+});
+/**
+* Emitted when a member leaves or is removed from an organization.
+*/
+const OrgMemberRemovedEvent = defineEvent({
+	name: "org.member.removed",
+	version: 1,
+	description: "A user has left or been removed from an organization.",
+	payload: OrgMemberRemovedPayload
+});
+/**
+* Emitted when a member's role is changed.
+*/
+const OrgMemberRoleChangedEvent = defineEvent({
+	name: "org.member.role_changed",
+	version: 1,
+	description: "A member's role in an organization has changed.",
+	payload: OrgMemberRoleChangedPayload
+});
+/**
+* Emitted when an invitation is sent.
+*/
+const OrgInviteSentEvent = defineEvent({
+	name: "org.invite.sent",
+	version: 1,
+	description: "An invitation to join an organization has been sent.",
+	pii: ["email"],
+	payload: OrgInviteSentPayload
+});
+/**
+* Emitted when an invitation is accepted.
+*/
+const OrgInviteAcceptedEvent = defineEvent({
+	name: "org.invite.accepted",
+	version: 1,
+	description: "An invitation has been accepted.",
+	payload: OrgInviteAcceptedPayload
+});
+/**
+* Emitted when an invitation is declined.
+*/
+const OrgInviteDeclinedEvent = defineEvent({
+	name: "org.invite.declined",
+	version: 1,
+	description: "An invitation has been declined.",
+	payload: OrgInviteDeclinedPayload
+});
+/**
+* Emitted when a role is assigned to a user or organization.
+*/
+const RoleAssignedEvent = defineEvent({
+	name: "role.assigned",
+	version: 1,
+	description: "A role has been assigned.",
+	payload: RoleAssignedPayload
+});
+/**
+* Emitted when a role is revoked from a user or organization.
+*/
+const RoleRevokedEvent = defineEvent({
+	name: "role.revoked",
+	version: 1,
+	description: "A role has been revoked.",
+	payload: RoleRevokedPayload
+});
+
+//#endregion

package/dist/libs/identity-rbac/dist/index.js

@@ -0,0 +1,11 @@
+import "./events.js";
+import { AccountEntity, SessionEntity, UserEntity, VerificationEntity } from "./entities/user.js";
+import { InvitationEntity, MemberEntity, OrganizationEntity, OrganizationTypeEnum, TeamEntity, TeamMemberEntity } from "./entities/organization.js";
+import { ApiKeyEntity, PasskeyEntity, PermissionEntity, PolicyBindingEntity, RoleEntity } from "./entities/rbac.js";
+import { identityRbacEntities, identityRbacSchemaContribution } from "./entities/index.js";
+import { CreateUserInputModel, DeleteUserInputModel, ListUsersInputModel, ListUsersOutputModel, SuccessResultModel, UpdateUserInputModel, UserDeletedPayloadModel, UserProfileModel } from "./contracts/user.js";
+import { AcceptInviteInputModel, CreateOrgInputModel, GetOrgInputModel, InvitationModel, InviteMemberInputModel, ListMembersInputModel, ListMembersOutputModel, ListUserOrgsOutputModel, MemberModel, MemberRemovedPayloadModel, MemberUserModel, OrganizationModel, OrganizationWithRoleModel, RemoveMemberInputModel, UpdateOrgInputModel } from "./contracts/organization.js";
+import { AssignRoleInputModel, BindingIdPayloadModel, CheckPermissionInputModel, CreateRoleInputModel, DeleteRoleInputModel, ListRolesOutputModel, ListUserPermissionsInputModel, ListUserPermissionsOutputModel, PermissionCheckResultModel, PolicyBindingModel, RevokeRoleInputModel, RoleModel, UpdateRoleInputModel } from "./contracts/rbac.js";
+import "./contracts/index.js";
+import { Permission } from "./policies/engine.js";
+import "./policies/index.js";