@managemint-solutions/sdk 0.52.0 → 0.54.0

package/dist/clients/index.js

@@ -18,6 +18,7 @@ exports.ClientsResource = void 0;
 const enum_1 = require("@managemint-solutions/entities/audit-trail/enum");
 const audit_1 = require("../audit");
 const errors_1 = require("../errors");
+const tenancy_1 = require("../tenancy");
 const transforms_1 = require("../transforms");
 __exportStar(require("./dto"), exports);
 // The public contract is the shared ClientSummary / ClientEntity from
@@ -74,6 +75,8 @@ class ClientsResource {
     supabase;
     auth;
     table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    audit;
     constructor(supabase, auth, audit) {
         this.supabase = supabase;
         this.auth = auth;
@@ -81,6 +84,7 @@ class ClientsResource {
             table: 'clients',
             entityType: enum_1.AuditTrailEntityType.CLIENTS,
         });
+        this.audit = new audit_1.EntityAuditTrail(supabase, auth, enum_1.AuditTrailEntityType.CLIENTS);
     }
     async list(query) {
         const page = query.page;
@@ -89,14 +93,16 @@ class ClientsResource {
         const trimmedSearch = query.search?.trim();
         // `order`/`range` return `this`, so the builder stays a filter builder and the conditional
         // filters below can be reassigned onto it without a cast.
-        let clientsQuery = this.supabase
+        let clientsQuery = (0, tenancy_1.scopeToOrganization)(this.supabase
             .from('clients')
-            .select(CLIENT_LIST_SELECT, { count: 'estimated' })
-            .eq('organization_id', this.auth.organization_id)
+            .select((0, tenancy_1.withOrganization)(CLIENT_LIST_SELECT, this.auth), { count: 'estimated' }), this.auth)
             .eq('archived', query.archive)
             .eq('deleted', false)
             .order('created_at', { ascending: false })
             .range(offset, offset + pageSize - 1);
+        if (query.organization_id) {
+            clientsQuery = clientsQuery.eq('organization_id', query.organization_id);
+        }
         if (trimmedSearch) {
             clientsQuery = clientsQuery.or((0, transforms_1.orIlike)(['name', 'email'], trimmedSearch));
         }
@@ -115,10 +121,7 @@ class ClientsResource {
         return (0, transforms_1.toMmsList)(data, page, pageSize, count);
     }
     async getById(clientId) {
-        const { data, error } = await this.supabase
-            .from('clients')
-            .select(CLIENT_DETAIL_SELECT)
-            .eq('organization_id', this.auth.organization_id)
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('clients').select(CLIENT_DETAIL_SELECT), this.auth)
             .eq('mms_id', clientId)
             .single();
         if (error)
@@ -140,7 +143,7 @@ class ClientsResource {
     async create(input) {
         const row = await this.table.insert({
             ...input,
-            organization_id: this.auth.organization_id,
+            organization_id: (0, tenancy_1.requireOrganization)(this.auth),
             created_by: this.auth.mms_id,
             created_at: new Date().toISOString(),
         });

package/dist/emulation-handshakes/index.d.ts

@@ -0,0 +1,13 @@
+import type { TypedSupabaseClient } from '../client';
+/**
+ * `emulation_handshakes`, service client only: proof that a user's next sign-in is the admin
+ * api's own mint, which the custom access token hook spends to mark that token emulated.
+ */
+export declare class EmulationHandshakesResource {
+    private readonly supabase;
+    constructor(supabase: TypedSupabaseClient);
+    /** Opens a handshake for `userId`'s next sign-in, good for thirty seconds. Returns its id. */
+    open(userId: string, credentialId: string): Promise<number>;
+    /** Deletes the handshake, spent or not, once the mint is over. */
+    close(id: number): Promise<void>;
+}

package/dist/emulation-handshakes/index.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EmulationHandshakesResource = void 0;
+const errors_1 = require("../errors");
+/**
+ * `emulation_handshakes`, service client only: proof that a user's next sign-in is the admin
+ * api's own mint, which the custom access token hook spends to mark that token emulated.
+ */
+class EmulationHandshakesResource {
+    supabase;
+    constructor(supabase) {
+        this.supabase = supabase;
+    }
+    /** Opens a handshake for `userId`'s next sign-in, good for thirty seconds. Returns its id. */
+    async open(userId, credentialId) {
+        const { data, error } = await this.supabase
+            .from('emulation_handshakes')
+            .insert({
+            user_id: userId,
+            credential_id: credentialId,
+            expires_at: new Date(Date.now() + 30_000).toISOString(),
+        })
+            .select('id')
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data.id;
+    }
+    /** Deletes the handshake, spent or not, once the mint is over. */
+    async close(id) {
+        const { error } = await this.supabase.from('emulation_handshakes').delete().eq('id', id);
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+    }
+}
+exports.EmulationHandshakesResource = EmulationHandshakesResource;

package/dist/errors.js

@@ -90,7 +90,7 @@ exports.mapPostgrestError = mapPostgrestError;
  * network/unknown failures have none, hence the 500 fallback.
  */
 const mapStorageError = (error, message = error.message) => new SupabaseClientError({
-    status: error.status ?? 500,
+    status: error.status || 500,
     error: 'Storage Error',
     message,
 }, { cause: error });
@@ -101,7 +101,7 @@ exports.mapStorageError = mapStorageError;
  * status GoTrue answered with; network/unknown failures carry none, hence the 500 fallback.
  */
 const mapAuthError = (error) => new SupabaseClientError({
-    status: error.status ?? 500,
+    status: error.status || 500,
     error: 'Authentication Error',
     message: error.message,
 }, { cause: error });

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export { SupabaseClient, createSupabaseClient } from './client';
 export type { SupabaseClientConfig, TypedSupabaseClient } from './client';
-export type { AuthContext, VerifiedAuth, VerifiedOrganization, VerifyAccessTokenConfig, } from './auth';
+export { SupabaseStaffClient, createSupabaseStaffClient } from './staff-client';
+export type { AuthContext, StaffContext, VerifiedAuth, VerifiedOrganization, VerifiedStaff, VerifyAccessTokenConfig, } from './auth';
 export { SupabaseAuthClient, createSupabaseAuthClient } from './auth-client';
 export type { SupabaseAuthClientConfig } from './auth-client';
 export { ExchangeRefreshTokenDto, ExchangeTokenHashDto, ResetPasswordDto, SendPasswordResetEmailDto, SignInDto, } from './auth-client';
@@ -9,8 +10,8 @@ export type { SupabaseOrganizationScope, SupabaseServiceClientConfig } from './s
 export { SupabaseClientError } from './errors';
 export type { SupabaseClientErrorInit } from './errors';
 export { EmptyToNull, IsNullable } from './validators';
-export type { AuditActor, AuditChanges, AuditEntry, AuditErrorHandler, AuditGuard, AuditRow, AuditedTable, AuditedTableOptions, } from './audit';
-export { GetAuditTrailDto } from './audit';
+export type { AuditActor, AuditChanges, AuditEntry, AuditErrorHandler, AuditGuard, AuditNameTable, AuditRow, AuditedTable, AuditedTableOptions, EntityAuditTrail, OrganizationTableFactory, } from './audit';
+export { GetAuditTrailDto, withAuditBatch } from './audit';
 export { CancelSubscriptionDto, GetPaymentsQueryDto, InitialPaymentDto, PaymentIdDto, PurchaseModuleDto, ReinstateSubscriptionDto, } from './billing';
 export { GetInvoicesQueryDto, InvoiceIdDto } from './billing/invoices';
 export type { CreateFeatureRequestRow, CreatedFeatureRequest } from './feature-requests';
@@ -21,23 +22,26 @@ export { AddStatusDto, GetStatusesDto, ReorderStatusesDto, StatusIdDto, UpdateSt
 export { AddLabelDto, GetLabelsDto, LabelIdDto, UpdateLabelDto } from './labels';
 export { AddAdditionalDetailsDto, AdditionalDetailsIdDto, GetAdditionalDetailsDto, IsAdditionalDetailsValueByType, UpdateAdditionalDetailsDto, } from './additional-details';
 export { AddNoteDto, GetNotesDto, NoteIdDto } from './notes';
-export type { CreateNotificationInput, CreatedNotification, NotificationContentRow, OrganizationTableFactory, QueuedNotification, } from './notifications';
+export type { CreateNotificationInput, CreatedNotification, NotificationContentRow, QueuedNotification, } from './notifications';
 export { GetNotificationsDto, NotificationIdDto } from './notifications';
 export type { OrganizationInvite } from './organization-invites';
 export type { OrganizationPaymentMethod, PaymentMethodLookupColumn, } from './organization-payment-methods';
 export type { CreateOrganizationRow, OrganizationRow } from './organizations';
-export { CreateOrganizationDto, UpdateOrganizationDto } from './organizations';
+export { CreateOrganizationDto, GetOrganizationsDto, OrganizationIdDto, UpdateOrganizationDto, } from './organizations';
 export { PermissionsResource } from './permissions';
 export type { PermissionFlags } from './permissions';
 export { UpdatePermissionsDto } from './permissions';
+export { CreateStaffDto, StaffIdDto, UpdateStaffPermissionsDto } from './staff';
+export type { CreateUserApiCredentialRow, UserApiCredentialRow } from './user-api-credentials';
+export { CreateUserApiCredentialDto, MintEmulationTokenDto, UserApiCredentialIdDto, } from './user-api-credentials';
 export type { UserEmploymentRow, UserRow } from './users';
-export { AddUserDto, GetUsersQueryDto, UpdateMyProfileDto, UpdateUserDto, UserIdDto, } from './users';
+export { AddUserDto, GetUsersQueryDto, StaffGetUsersDto, UpdateMyProfileDto, UpdateUserDto, UserIdDto, } from './users';
 export type { ClaimOutcome, WebhookEventRow, WebhookEventsTable } from './webhook-events';
 export { GetSupportingFilesDto, SupportingFileIdDto, SupportingFileNamesDto } from './supporting-files';
-export { ClientIdDto, CreateClientDto, GetClientsDto, UpdateClientDto } from './clients';
-export { ConvertLeadDto, CreateLeadDto, GetLeadsDto, LeadIdDto, UpdateLeadDto } from './leads';
-export { CreateProjectDto, GetProjectsDto, ProjectIdDto, UpdateProjectDto } from './projects';
-export { AddTaskLinkDto, CreateTaskDto, GetTasksDto, TaskIdDto, TaskLinkIdDto, UpdateTaskDto } from './tasks';
+export { ClientIdDto, CreateClientDto, GetClientsDto, StaffGetClientsDto, UpdateClientDto } from './clients';
+export { ConvertLeadDto, CreateLeadDto, GetLeadsDto, LeadIdDto, StaffGetLeadsDto, UpdateLeadDto } from './leads';
+export { CreateProjectDto, GetProjectsDto, ProjectIdDto, StaffGetProjectsDto, UpdateProjectDto } from './projects';
+export { AddTaskLinkDto, CreateTaskDto, GetTasksDto, StaffGetTasksDto, TaskIdDto, TaskLinkIdDto, UpdateTaskDto, } from './tasks';
 export type { CreateLeaveEntitlementInput, CreateLeaveRequestRow, ReviewLeaveRequestRow, UpdateLeaveRequestRow, } from './leave';
 export type { BalanceEntitlement, BalanceRequest, LeaveCycle } from './leave';
 export { BulkCreateLeaveEntitlementsDto, CreateLeaveAdjustmentDto, CreateLeaveEntitlementDto, CreateLeaveRequestDto, CreateLeaveTypeDto, GetLeaveCalendarDto, GetLeaveEntitlementsDto, GetLeaveRequestsDto, GetLeaveTypesDto, LeaveEntitlementIdDto, LeaveRequestIdDto, LeaveTypeIdDto, ReviewLeaveRequestDto, UpdateLeaveEntitlementDto, UpdateLeaveRequestDto, UpdateLeaveTypeDto, } from './leave';

package/dist/index.js

@@ -3,16 +3,19 @@
 // the audit diff, the row helpers, the select-string fragments, the error mappers - and stays
 // reachable only from inside. The `./nest` entrypoint is listed separately, in src/nest/index.ts.
 //
-// Resources are reached through the three clients (`supabase.tasks`, `scope.invoices`, ...), so
+// Resources are reached through the clients (`supabase.tasks`, `scope.invoices`, ...), so
 // their classes are not exported: a consumer never constructs one, and every export is a contract
 // to keep. The row and input types they produce and accept are exported for annotations.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UpdatePermissionsDto = exports.PermissionsResource = exports.UpdateOrganizationDto = exports.CreateOrganizationDto = exports.NotificationIdDto = exports.GetNotificationsDto = exports.NoteIdDto = exports.GetNotesDto = exports.AddNoteDto = exports.UpdateAdditionalDetailsDto = exports.IsAdditionalDetailsValueByType = exports.GetAdditionalDetailsDto = exports.AdditionalDetailsIdDto = exports.AddAdditionalDetailsDto = exports.UpdateLabelDto = exports.LabelIdDto = exports.GetLabelsDto = exports.AddLabelDto = exports.UpdateStatusDto = exports.StatusIdDto = exports.ReorderStatusesDto = exports.GetStatusesDto = exports.AddStatusDto = exports.CreateSupportRequestDto = exports.UpdateConfigDto = exports.CreateConfigDto = exports.CreateFeatureRequestDto = exports.InvoiceIdDto = exports.GetInvoicesQueryDto = exports.ReinstateSubscriptionDto = exports.PurchaseModuleDto = exports.PaymentIdDto = exports.InitialPaymentDto = exports.GetPaymentsQueryDto = exports.CancelSubscriptionDto = exports.GetAuditTrailDto = exports.IsNullable = exports.EmptyToNull = exports.SupabaseClientError = exports.createSupabaseServiceClient = exports.SupabaseServiceClient = exports.SignInDto = exports.SendPasswordResetEmailDto = exports.ResetPasswordDto = exports.ExchangeTokenHashDto = exports.ExchangeRefreshTokenDto = exports.createSupabaseAuthClient = exports.SupabaseAuthClient = exports.createSupabaseClient = exports.SupabaseClient = void 0;
-exports.isWithinPeriod = exports.initialUntil = exports.cyclePeriodFor = exports.countWorkingDays = exports.completedMonths = exports.addMonths = exports.GetPublicHolidaysDto = exports.UpdateLeaveTypeDto = exports.UpdateLeaveRequestDto = exports.UpdateLeaveEntitlementDto = exports.ReviewLeaveRequestDto = exports.LeaveTypeIdDto = exports.LeaveRequestIdDto = exports.LeaveEntitlementIdDto = exports.GetLeaveTypesDto = exports.GetLeaveRequestsDto = exports.GetLeaveEntitlementsDto = exports.GetLeaveCalendarDto = exports.CreateLeaveTypeDto = exports.CreateLeaveRequestDto = exports.CreateLeaveEntitlementDto = exports.CreateLeaveAdjustmentDto = exports.BulkCreateLeaveEntitlementsDto = exports.UpdateTaskDto = exports.TaskLinkIdDto = exports.TaskIdDto = exports.GetTasksDto = exports.CreateTaskDto = exports.AddTaskLinkDto = exports.UpdateProjectDto = exports.ProjectIdDto = exports.GetProjectsDto = exports.CreateProjectDto = exports.UpdateLeadDto = exports.LeadIdDto = exports.GetLeadsDto = exports.CreateLeadDto = exports.ConvertLeadDto = exports.UpdateClientDto = exports.GetClientsDto = exports.CreateClientDto = exports.ClientIdDto = exports.SupportingFileNamesDto = exports.SupportingFileIdDto = exports.GetSupportingFilesDto = exports.UserIdDto = exports.UpdateUserDto = exports.UpdateMyProfileDto = exports.GetUsersQueryDto = exports.AddUserDto = void 0;
-exports.monthlyTotalMinor = exports.weekStartOf = exports.minutesBetween = exports.UpdateTimesheetEntryDto = exports.TimesheetIdDto = exports.TimesheetEntryIdDto = exports.ReviewTimesheetDto = exports.GetTimesheetsDto = exports.GetTimesheetReportDto = exports.CreateTimesheetEntryDto = exports.todayInJohannesburg = exports.shiftDays = exports.proRataDays = void 0;
+exports.CreateOrganizationDto = exports.NotificationIdDto = exports.GetNotificationsDto = exports.NoteIdDto = exports.GetNotesDto = exports.AddNoteDto = exports.UpdateAdditionalDetailsDto = exports.IsAdditionalDetailsValueByType = exports.GetAdditionalDetailsDto = exports.AdditionalDetailsIdDto = exports.AddAdditionalDetailsDto = exports.UpdateLabelDto = exports.LabelIdDto = exports.GetLabelsDto = exports.AddLabelDto = exports.UpdateStatusDto = exports.StatusIdDto = exports.ReorderStatusesDto = exports.GetStatusesDto = exports.AddStatusDto = exports.CreateSupportRequestDto = exports.UpdateConfigDto = exports.CreateConfigDto = exports.CreateFeatureRequestDto = exports.InvoiceIdDto = exports.GetInvoicesQueryDto = exports.ReinstateSubscriptionDto = exports.PurchaseModuleDto = exports.PaymentIdDto = exports.InitialPaymentDto = exports.GetPaymentsQueryDto = exports.CancelSubscriptionDto = exports.withAuditBatch = exports.GetAuditTrailDto = exports.IsNullable = exports.EmptyToNull = exports.SupabaseClientError = exports.createSupabaseServiceClient = exports.SupabaseServiceClient = exports.SignInDto = exports.SendPasswordResetEmailDto = exports.ResetPasswordDto = exports.ExchangeTokenHashDto = exports.ExchangeRefreshTokenDto = exports.createSupabaseAuthClient = exports.SupabaseAuthClient = exports.createSupabaseStaffClient = exports.SupabaseStaffClient = exports.createSupabaseClient = exports.SupabaseClient = void 0;
+exports.GetLeaveEntitlementsDto = exports.GetLeaveCalendarDto = exports.CreateLeaveTypeDto = exports.CreateLeaveRequestDto = exports.CreateLeaveEntitlementDto = exports.CreateLeaveAdjustmentDto = exports.BulkCreateLeaveEntitlementsDto = exports.UpdateTaskDto = exports.TaskLinkIdDto = exports.TaskIdDto = exports.StaffGetTasksDto = exports.GetTasksDto = exports.CreateTaskDto = exports.AddTaskLinkDto = exports.UpdateProjectDto = exports.StaffGetProjectsDto = exports.ProjectIdDto = exports.GetProjectsDto = exports.CreateProjectDto = exports.UpdateLeadDto = exports.StaffGetLeadsDto = exports.LeadIdDto = exports.GetLeadsDto = exports.CreateLeadDto = exports.ConvertLeadDto = exports.UpdateClientDto = exports.StaffGetClientsDto = exports.GetClientsDto = exports.CreateClientDto = exports.ClientIdDto = exports.SupportingFileNamesDto = exports.SupportingFileIdDto = exports.GetSupportingFilesDto = exports.UserIdDto = exports.UpdateUserDto = exports.UpdateMyProfileDto = exports.StaffGetUsersDto = exports.GetUsersQueryDto = exports.AddUserDto = exports.UserApiCredentialIdDto = exports.MintEmulationTokenDto = exports.CreateUserApiCredentialDto = exports.UpdateStaffPermissionsDto = exports.StaffIdDto = exports.CreateStaffDto = exports.UpdatePermissionsDto = exports.PermissionsResource = exports.UpdateOrganizationDto = exports.OrganizationIdDto = exports.GetOrganizationsDto = void 0;
+exports.monthlyTotalMinor = exports.weekStartOf = exports.minutesBetween = exports.UpdateTimesheetEntryDto = exports.TimesheetIdDto = exports.TimesheetEntryIdDto = exports.ReviewTimesheetDto = exports.GetTimesheetsDto = exports.GetTimesheetReportDto = exports.CreateTimesheetEntryDto = exports.todayInJohannesburg = exports.shiftDays = exports.proRataDays = exports.isWithinPeriod = exports.initialUntil = exports.cyclePeriodFor = exports.countWorkingDays = exports.completedMonths = exports.addMonths = exports.GetPublicHolidaysDto = exports.UpdateLeaveTypeDto = exports.UpdateLeaveRequestDto = exports.UpdateLeaveEntitlementDto = exports.ReviewLeaveRequestDto = exports.LeaveTypeIdDto = exports.LeaveRequestIdDto = exports.LeaveEntitlementIdDto = exports.GetLeaveTypesDto = exports.GetLeaveRequestsDto = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "SupabaseClient", { enumerable: true, get: function () { return client_1.SupabaseClient; } });
 Object.defineProperty(exports, "createSupabaseClient", { enumerable: true, get: function () { return client_1.createSupabaseClient; } });
+var staff_client_1 = require("./staff-client");
+Object.defineProperty(exports, "SupabaseStaffClient", { enumerable: true, get: function () { return staff_client_1.SupabaseStaffClient; } });
+Object.defineProperty(exports, "createSupabaseStaffClient", { enumerable: true, get: function () { return staff_client_1.createSupabaseStaffClient; } });
 var auth_client_1 = require("./auth-client");
 Object.defineProperty(exports, "SupabaseAuthClient", { enumerable: true, get: function () { return auth_client_1.SupabaseAuthClient; } });
 Object.defineProperty(exports, "createSupabaseAuthClient", { enumerable: true, get: function () { return auth_client_1.createSupabaseAuthClient; } });
@@ -32,6 +35,7 @@ Object.defineProperty(exports, "EmptyToNull", { enumerable: true, get: function
 Object.defineProperty(exports, "IsNullable", { enumerable: true, get: function () { return validators_1.IsNullable; } });
 var audit_1 = require("./audit");
 Object.defineProperty(exports, "GetAuditTrailDto", { enumerable: true, get: function () { return audit_1.GetAuditTrailDto; } });
+Object.defineProperty(exports, "withAuditBatch", { enumerable: true, get: function () { return audit_1.withAuditBatch; } });
 var billing_1 = require("./billing");
 Object.defineProperty(exports, "CancelSubscriptionDto", { enumerable: true, get: function () { return billing_1.CancelSubscriptionDto; } });
 Object.defineProperty(exports, "GetPaymentsQueryDto", { enumerable: true, get: function () { return billing_1.GetPaymentsQueryDto; } });
@@ -75,6 +79,8 @@ Object.defineProperty(exports, "GetNotificationsDto", { enumerable: true, get: f
 Object.defineProperty(exports, "NotificationIdDto", { enumerable: true, get: function () { return notifications_1.NotificationIdDto; } });
 var organizations_1 = require("./organizations");
 Object.defineProperty(exports, "CreateOrganizationDto", { enumerable: true, get: function () { return organizations_1.CreateOrganizationDto; } });
+Object.defineProperty(exports, "GetOrganizationsDto", { enumerable: true, get: function () { return organizations_1.GetOrganizationsDto; } });
+Object.defineProperty(exports, "OrganizationIdDto", { enumerable: true, get: function () { return organizations_1.OrganizationIdDto; } });
 Object.defineProperty(exports, "UpdateOrganizationDto", { enumerable: true, get: function () { return organizations_1.UpdateOrganizationDto; } });
 // The one resource class still exported: the api's permissions guard spec drives a real
 // PermissionsResource over a stubbed client.
@@ -82,9 +88,18 @@ var permissions_1 = require("./permissions");
 Object.defineProperty(exports, "PermissionsResource", { enumerable: true, get: function () { return permissions_1.PermissionsResource; } });
 var permissions_2 = require("./permissions");
 Object.defineProperty(exports, "UpdatePermissionsDto", { enumerable: true, get: function () { return permissions_2.UpdatePermissionsDto; } });
+var staff_1 = require("./staff");
+Object.defineProperty(exports, "CreateStaffDto", { enumerable: true, get: function () { return staff_1.CreateStaffDto; } });
+Object.defineProperty(exports, "StaffIdDto", { enumerable: true, get: function () { return staff_1.StaffIdDto; } });
+Object.defineProperty(exports, "UpdateStaffPermissionsDto", { enumerable: true, get: function () { return staff_1.UpdateStaffPermissionsDto; } });
+var user_api_credentials_1 = require("./user-api-credentials");
+Object.defineProperty(exports, "CreateUserApiCredentialDto", { enumerable: true, get: function () { return user_api_credentials_1.CreateUserApiCredentialDto; } });
+Object.defineProperty(exports, "MintEmulationTokenDto", { enumerable: true, get: function () { return user_api_credentials_1.MintEmulationTokenDto; } });
+Object.defineProperty(exports, "UserApiCredentialIdDto", { enumerable: true, get: function () { return user_api_credentials_1.UserApiCredentialIdDto; } });
 var users_1 = require("./users");
 Object.defineProperty(exports, "AddUserDto", { enumerable: true, get: function () { return users_1.AddUserDto; } });
 Object.defineProperty(exports, "GetUsersQueryDto", { enumerable: true, get: function () { return users_1.GetUsersQueryDto; } });
+Object.defineProperty(exports, "StaffGetUsersDto", { enumerable: true, get: function () { return users_1.StaffGetUsersDto; } });
 Object.defineProperty(exports, "UpdateMyProfileDto", { enumerable: true, get: function () { return users_1.UpdateMyProfileDto; } });
 Object.defineProperty(exports, "UpdateUserDto", { enumerable: true, get: function () { return users_1.UpdateUserDto; } });
 Object.defineProperty(exports, "UserIdDto", { enumerable: true, get: function () { return users_1.UserIdDto; } });
@@ -96,22 +111,26 @@ var clients_1 = require("./clients");
 Object.defineProperty(exports, "ClientIdDto", { enumerable: true, get: function () { return clients_1.ClientIdDto; } });
 Object.defineProperty(exports, "CreateClientDto", { enumerable: true, get: function () { return clients_1.CreateClientDto; } });
 Object.defineProperty(exports, "GetClientsDto", { enumerable: true, get: function () { return clients_1.GetClientsDto; } });
+Object.defineProperty(exports, "StaffGetClientsDto", { enumerable: true, get: function () { return clients_1.StaffGetClientsDto; } });
 Object.defineProperty(exports, "UpdateClientDto", { enumerable: true, get: function () { return clients_1.UpdateClientDto; } });
 var leads_1 = require("./leads");
 Object.defineProperty(exports, "ConvertLeadDto", { enumerable: true, get: function () { return leads_1.ConvertLeadDto; } });
 Object.defineProperty(exports, "CreateLeadDto", { enumerable: true, get: function () { return leads_1.CreateLeadDto; } });
 Object.defineProperty(exports, "GetLeadsDto", { enumerable: true, get: function () { return leads_1.GetLeadsDto; } });
 Object.defineProperty(exports, "LeadIdDto", { enumerable: true, get: function () { return leads_1.LeadIdDto; } });
+Object.defineProperty(exports, "StaffGetLeadsDto", { enumerable: true, get: function () { return leads_1.StaffGetLeadsDto; } });
 Object.defineProperty(exports, "UpdateLeadDto", { enumerable: true, get: function () { return leads_1.UpdateLeadDto; } });
 var projects_1 = require("./projects");
 Object.defineProperty(exports, "CreateProjectDto", { enumerable: true, get: function () { return projects_1.CreateProjectDto; } });
 Object.defineProperty(exports, "GetProjectsDto", { enumerable: true, get: function () { return projects_1.GetProjectsDto; } });
 Object.defineProperty(exports, "ProjectIdDto", { enumerable: true, get: function () { return projects_1.ProjectIdDto; } });
+Object.defineProperty(exports, "StaffGetProjectsDto", { enumerable: true, get: function () { return projects_1.StaffGetProjectsDto; } });
 Object.defineProperty(exports, "UpdateProjectDto", { enumerable: true, get: function () { return projects_1.UpdateProjectDto; } });
 var tasks_1 = require("./tasks");
 Object.defineProperty(exports, "AddTaskLinkDto", { enumerable: true, get: function () { return tasks_1.AddTaskLinkDto; } });
 Object.defineProperty(exports, "CreateTaskDto", { enumerable: true, get: function () { return tasks_1.CreateTaskDto; } });
 Object.defineProperty(exports, "GetTasksDto", { enumerable: true, get: function () { return tasks_1.GetTasksDto; } });
+Object.defineProperty(exports, "StaffGetTasksDto", { enumerable: true, get: function () { return tasks_1.StaffGetTasksDto; } });
 Object.defineProperty(exports, "TaskIdDto", { enumerable: true, get: function () { return tasks_1.TaskIdDto; } });
 Object.defineProperty(exports, "TaskLinkIdDto", { enumerable: true, get: function () { return tasks_1.TaskLinkIdDto; } });
 Object.defineProperty(exports, "UpdateTaskDto", { enumerable: true, get: function () { return tasks_1.UpdateTaskDto; } });

package/dist/leads/dto.d.ts

@@ -1,5 +1,5 @@
 import type { UUID } from 'crypto';
-import type { ConvertLeadDto as ConvertLeadDtoType, CreateLeadDto as CreateLeadDtoType, GetLeadsDto as GetLeadsDtoType, LeadIdDto as LeadIdDtoType, UpdateLeadDto as UpdateLeadDtoType } from '@managemint-solutions/entities/leads/dto';
+import type { ConvertLeadDto as ConvertLeadDtoType, CreateLeadDto as CreateLeadDtoType, GetLeadsDto as GetLeadsDtoType, StaffGetLeadsDto as StaffGetLeadsDtoType, LeadIdDto as LeadIdDtoType, UpdateLeadDto as UpdateLeadDtoType } from '@managemint-solutions/entities/leads/dto';
 import { LeadSource } from '@managemint-solutions/entities/leads/enum';
 export declare class GetLeadsDto implements Omit<GetLeadsDtoType, 'status_id_in'> {
     readonly search?: string | null;
@@ -13,6 +13,10 @@ export declare class GetLeadsDto implements Omit<GetLeadsDtoType, 'status_id_in'
     readonly completed?: boolean | null;
     readonly archive: boolean;
 }
+/** A staff read across organizations, optionally narrowed to one of them. */
+export declare class StaffGetLeadsDto extends GetLeadsDto implements Omit<StaffGetLeadsDtoType, 'status_id_in'> {
+    readonly organization_id?: string | null;
+}
 export declare class LeadIdDto implements LeadIdDtoType {
     readonly leadId: string;
 }

package/dist/leads/dto.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConvertLeadDto = exports.UpdateLeadDto = exports.CreateLeadDto = exports.LeadIdDto = exports.GetLeadsDto = void 0;
+exports.ConvertLeadDto = exports.UpdateLeadDto = exports.CreateLeadDto = exports.LeadIdDto = exports.StaffGetLeadsDto = exports.GetLeadsDto = void 0;
 const class_validator_1 = require("class-validator");
 const class_transformer_1 = require("class-transformer");
 const enum_1 = require("@managemint-solutions/entities/leads/enum");
@@ -107,6 +107,17 @@ __decorate([
     (0, class_validator_1.IsBoolean)({ message: 'Include archived must be a boolean' }),
     __metadata("design:type", Boolean)
 ], GetLeadsDto.prototype, "archive", void 0);
+/** A staff read across organizations, optionally narrowed to one of them. */
+class StaffGetLeadsDto extends GetLeadsDto {
+    organization_id;
+}
+exports.StaffGetLeadsDto = StaffGetLeadsDto;
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsUUID)('7', { message: 'Invalid organization ID format' }),
+    __metadata("design:type", Object)
+], StaffGetLeadsDto.prototype, "organization_id", void 0);
 class LeadIdDto {
     leadId;
 }

package/dist/leads/index.d.ts

@@ -1,9 +1,9 @@
 import type { ClientEntity } from '@managemint-solutions/entities/clients';
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { LeadEntity, LeadSummary } from '@managemint-solutions/entities/leads';
-import type { AuthContext } from '../auth';
+import type { ClientContext } from '../auth';
 import type { AdditionalDetailsResource } from '../additional-details';
-import { type AuditResource } from '../audit';
+import { EntityAuditTrail, type AuditResource } from '../audit';
 import type { ClientsResource } from '../clients';
 import type { TypedSupabaseClient } from '../client';
 import type { ConvertLeadDto, CreateLeadDto, GetLeadsDto, UpdateLeadDto } from './dto';
@@ -11,11 +11,14 @@ export * from './dto';
 export declare class LeadsResource {
     private readonly supabase;
     private readonly auth;
-    private readonly audit;
     private readonly additionalDetails;
     private readonly table;
-    constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource, additionalDetails: AdditionalDetailsResource);
-    list(query: GetLeadsDto): Promise<MmsList<LeadSummary>>;
+    /** This record's history - its own rows and the rows that hang off it. */
+    readonly audit: EntityAuditTrail;
+    constructor(supabase: TypedSupabaseClient, auth: ClientContext, audit: AuditResource, additionalDetails: AdditionalDetailsResource);
+    list(query: GetLeadsDto & {
+        organization_id?: string | null;
+    }): Promise<MmsList<LeadSummary>>;
     getById(leadId: string): Promise<LeadEntity>;
     create(input: CreateLeadDto): Promise<LeadEntity>;
     update(leadId: string, input: UpdateLeadDto): Promise<LeadEntity>;

package/dist/leads/index.js

@@ -24,6 +24,7 @@ const enum_6 = require("@managemint-solutions/entities/audit-trail/enum");
 const audit_1 = require("../audit");
 const errors_1 = require("../errors");
 const paths_1 = require("../supporting-files/paths");
+const tenancy_1 = require("../tenancy");
 const transforms_1 = require("../transforms");
 const won_1 = require("./won");
 __exportStar(require("./dto"), exports);
@@ -106,18 +107,19 @@ const refuse = (status, message) => new errors_1.SupabaseClientError({ status, e
 class LeadsResource {
     supabase;
     auth;
-    audit;
     additionalDetails;
     table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    audit;
     constructor(supabase, auth, audit, additionalDetails) {
         this.supabase = supabase;
         this.auth = auth;
-        this.audit = audit;
         this.additionalDetails = additionalDetails;
         this.table = (0, audit_1.auditedTable)(supabase, auth, audit, {
             table: 'leads',
             entityType: enum_6.AuditTrailEntityType.LEADS,
         });
+        this.audit = new audit_1.EntityAuditTrail(supabase, auth, enum_6.AuditTrailEntityType.LEADS);
     }
     async list(query) {
         const page = query.page;
@@ -126,14 +128,16 @@ class LeadsResource {
         const trimmedSearch = query.search?.trim();
         // `order`/`range` return `this`, so the builder stays a filter builder and the conditional
         // filters below can be reassigned onto it without a cast.
-        let leadsQuery = this.supabase
+        let leadsQuery = (0, tenancy_1.scopeToOrganization)(this.supabase
             .from('leads')
-            .select(LEAD_LIST_SELECT, { count: 'estimated' })
-            .eq('organization_id', this.auth.organization_id)
+            .select((0, tenancy_1.withOrganization)(LEAD_LIST_SELECT, this.auth), { count: 'estimated' }), this.auth)
             .eq('archived', query.archive)
             .eq('deleted', false)
             .order('created_at', { ascending: false })
             .range(offset, offset + pageSize - 1);
+        if (query.organization_id) {
+            leadsQuery = leadsQuery.eq('organization_id', query.organization_id);
+        }
         if (trimmedSearch) {
             leadsQuery = leadsQuery.or((0, transforms_1.orIlike)(['name', 'contact_person', 'email'], trimmedSearch));
         }
@@ -161,10 +165,7 @@ class LeadsResource {
         return (0, transforms_1.toMmsList)(data, page, pageSize, count);
     }
     async getById(leadId) {
-        const { data, error } = await this.supabase
-            .from('leads')
-            .select(LEAD_DETAIL_SELECT)
-            .eq('organization_id', this.auth.organization_id)
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('leads').select(LEAD_DETAIL_SELECT), this.auth)
             .eq('mms_id', leadId)
             .single();
         if (error)
@@ -195,7 +196,7 @@ class LeadsResource {
             // Omitted means the creator owns the lead; an explicit null leaves it unassigned.
             assigned_to_id: input.assigned_to_id === undefined ? this.auth.mms_id : input.assigned_to_id,
             lost_reason: lostReason,
-            organization_id: this.auth.organization_id,
+            organization_id: (0, tenancy_1.requireOrganization)(this.auth),
             created_by: this.auth.mms_id,
             created_at: new Date().toISOString(),
         });
@@ -207,7 +208,7 @@ class LeadsResource {
         const { data, error } = await this.supabase
             .from('leads')
             .select('status_id, converted_client_id')
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', (0, tenancy_1.requireOrganization)(this.auth))
             .eq('mms_id', leadId)
             .single();
         if (error)
@@ -227,12 +228,12 @@ class LeadsResource {
         return this.getById(leadId);
     }
     async archive(leadId) {
-        await (0, won_1.refuseWonLead)(this.supabase, this.auth.organization_id, leadId);
+        await (0, won_1.refuseWonLead)(this.supabase, (0, tenancy_1.requireOrganization)(this.auth), leadId);
         await this.table.transition(leadId, enum_6.AuditTrailAction.ARCHIVE, (0, transforms_1.archivedPatch)(this.auth.mms_id));
         return this.getById(leadId);
     }
     async unarchive(leadId) {
-        await (0, won_1.refuseWonLead)(this.supabase, this.auth.organization_id, leadId);
+        await (0, won_1.refuseWonLead)(this.supabase, (0, tenancy_1.requireOrganization)(this.auth), leadId);
         await this.table.transition(leadId, enum_6.AuditTrailAction.UNARCHIVE, (0, transforms_1.unarchivedPatch)(this.auth.mms_id));
         return this.getById(leadId);
     }
@@ -242,7 +243,7 @@ class LeadsResource {
     }
     /** Soft delete - the row stays, flagged `deleted`, and `restore()` brings it back. A Won lead cannot be deleted. */
     async remove(leadId) {
-        await (0, won_1.refuseWonLead)(this.supabase, this.auth.organization_id, leadId);
+        await (0, won_1.refuseWonLead)(this.supabase, (0, tenancy_1.requireOrganization)(this.auth), leadId);
         await this.table.transition(leadId, enum_6.AuditTrailAction.DELETE, (0, transforms_1.deletedPatch)(this.auth.mms_id));
     }
     /**
@@ -265,11 +266,12 @@ class LeadsResource {
      * client is created, and read back, without the caller holding any clients permission.
      */
     async convert(leadId, input, clients) {
+        const organizationId = (0, tenancy_1.requireOrganization)(this.auth);
         // (a) The lead, in this organization, not deleted and not converted already.
         const { data, error } = await this.supabase
             .from('leads')
             .select(LEAD_CONVERT_SELECT)
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', organizationId)
             .eq('mms_id', leadId)
             .maybeSingle();
         if (error)
@@ -323,7 +325,7 @@ class LeadsResource {
             const { error: moveError } = await this.supabase
                 .from(table)
                 .update({ entity_type: toType, entity_id: clientId })
-                .eq('organization_id', this.auth.organization_id)
+                .eq('organization_id', organizationId)
                 .eq('entity_type', fromType)
                 .eq('entity_id', leadId);
             if (moveError)
@@ -335,7 +337,7 @@ class LeadsResource {
         const { data: files, error: filesError } = await this.supabase
             .from('supporting_files')
             .select('mms_id, name, extension')
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', organizationId)
             .eq('entity_type', enum_5.SupportingFilesEntityTypes.LEAD)
             .eq('entity_id', leadId);
         if (filesError)
@@ -343,7 +345,7 @@ class LeadsResource {
         for (const file of files) {
             const { error: storageError } = await this.supabase.storage
                 .from(SUPPORTING_FILES_BUCKET)
-                .move((0, paths_1.storagePath)(this.auth.organization_id, enum_5.SupportingFilesEntityTypes.LEAD, leadId, file.name, file.extension), (0, paths_1.storagePath)(this.auth.organization_id, enum_5.SupportingFilesEntityTypes.CLIENT, clientId, file.name, file.extension));
+                .move((0, paths_1.storagePath)(organizationId, enum_5.SupportingFilesEntityTypes.LEAD, leadId, file.name, file.extension), (0, paths_1.storagePath)(organizationId, enum_5.SupportingFilesEntityTypes.CLIENT, clientId, file.name, file.extension));
             if (storageError) {
                 if (storageError.status === 404 || storageError.statusCode === '404')
                     continue;
@@ -352,7 +354,7 @@ class LeadsResource {
             const { error: rowError } = await this.supabase
                 .from('supporting_files')
                 .update({ entity_type: enum_5.SupportingFilesEntityTypes.CLIENT, entity_id: clientId })
-                .eq('organization_id', this.auth.organization_id)
+                .eq('organization_id', organizationId)
                 .eq('mms_id', file.mms_id);
             if (rowError)
                 throw (0, errors_1.mapPostgrestError)(rowError);
@@ -362,7 +364,7 @@ class LeadsResource {
         const { data: won, error: wonError } = await this.supabase
             .from('statuses')
             .select('mms_id')
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', organizationId)
             .eq('is_won', true)
             .maybeSingle();
         if (wonError)
@@ -389,7 +391,7 @@ class LeadsResource {
         const { data, error } = await this.supabase
             .from('statuses')
             .select('is_fail, is_won')
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', (0, tenancy_1.requireOrganization)(this.auth))
             .eq('entity_type', enum_4.StatusEntityTypes.LEAD)
             .eq('mms_id', statusId)
             .maybeSingle();

package/dist/leave/leave-adjustments.js

@@ -27,6 +27,7 @@ class LeaveAdjustmentsResource {
         this.table = (0, audit_1.auditedTable)(supabase, auth, audit, {
             table: 'leave_adjustments',
             entityType: enum_1.AuditTrailEntityType.LEAVE_ADJUSTMENTS,
+            related: { entityType: enum_1.AuditTrailEntityType.LEAVE_ENTITLEMENTS, column: 'leave_entitlement_id' },
         });
     }
     /** The adjustments of the given entitlements, oldest first. */

package/dist/leave/leave-entitlements.d.ts

@@ -1,7 +1,7 @@
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { LeaveEntitlementEntity, LeavePeriod } from '@managemint-solutions/entities/leave';
 import { LeaveGrantMethod } from '@managemint-solutions/entities/leave/enum';
-import { type AuditActor, type AuditResource } from '../audit';
+import { EntityAuditTrail, type AuditActor, type AuditResource } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { GetLeaveEntitlementsDto, UpdateLeaveEntitlementDto } from './dto';
 /** The create input after the api has resolved the defaults and copied the type's policy on. */
@@ -21,6 +21,8 @@ export declare class LeaveEntitlementsResource {
     private readonly supabase;
     private readonly auth;
     private readonly table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    readonly audit: EntityAuditTrail;
     constructor(supabase: TypedSupabaseClient, auth: AuditActor, audit: AuditResource);
     list(query: GetLeaveEntitlementsDto): Promise<MmsList<LeaveEntitlementEntity>>;
     getById(leaveEntitlementId: string): Promise<LeaveEntitlementEntity>;

package/dist/leave/leave-entitlements.js

@@ -38,6 +38,8 @@ class LeaveEntitlementsResource {
     supabase;
     auth;
     table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    audit;
     constructor(supabase, auth, audit) {
         this.supabase = supabase;
         this.auth = auth;
@@ -45,6 +47,7 @@ class LeaveEntitlementsResource {
             table: 'leave_entitlements',
             entityType: enum_1.AuditTrailEntityType.LEAVE_ENTITLEMENTS,
         });
+        this.audit = new audit_1.EntityAuditTrail(supabase, auth, enum_1.AuditTrailEntityType.LEAVE_ENTITLEMENTS);
     }
     async list(query) {
         const page = query.page;

package/dist/leave/leave-requests.d.ts

@@ -1,7 +1,7 @@
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { LeaveCalendarEntry, LeaveRequestEntity } from '@managemint-solutions/entities/leave';
 import { LeaveRequestStatus, LeaveReviewDecision } from '@managemint-solutions/entities/leave/enum';
-import { type AuditActor, type AuditResource } from '../audit';
+import { EntityAuditTrail, type AuditActor, type AuditResource } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { GetLeaveCalendarDto, GetLeaveRequestsDto } from './dto';
 /** A request as the api inserts it: the caller's own, with the days already counted. */
@@ -39,6 +39,8 @@ export declare class LeaveRequestsResource {
     private readonly supabase;
     private readonly auth;
     private readonly table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    readonly audit: EntityAuditTrail;
     constructor(supabase: TypedSupabaseClient, auth: AuditActor, audit: AuditResource);
     list(query: GetLeaveRequestsDto, options?: ListOptions): Promise<MmsList<LeaveRequestEntity>>;
     getById(leaveRequestId: string): Promise<LeaveRequestEntity>;

package/dist/leave/leave-requests.js

@@ -49,6 +49,8 @@ class LeaveRequestsResource {
     supabase;
     auth;
     table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    audit;
     constructor(supabase, auth, audit) {
         this.supabase = supabase;
         this.auth = auth;
@@ -56,6 +58,7 @@ class LeaveRequestsResource {
             table: 'leave_requests',
             entityType: enum_1.AuditTrailEntityType.LEAVE_REQUESTS,
         });
+        this.audit = new audit_1.EntityAuditTrail(supabase, auth, enum_1.AuditTrailEntityType.LEAVE_REQUESTS);
     }
     async list(query, options = {}) {
         const page = query.page;