@managemint-solutions/sdk 0.52.0 → 0.54.0

package/dist/service-client/index.d.ts

@@ -4,6 +4,7 @@ import { BillingResource } from '../billing';
 import { InvoicesResource } from '../billing/invoices';
 import { ClientsResource } from '../clients';
 import { ConfigsResource } from '../configs';
+import { EmulationHandshakesResource } from '../emulation-handshakes';
 import { FeatureRequestsResource } from '../feature-requests';
 import { LeaveEntitlementsResource, LeaveRequestsResource, LeaveTypesResource } from '../leave';
 import { NotificationsOutboxResource } from '../notifications';
@@ -11,6 +12,8 @@ import { OrganizationInvitesResource } from '../organization-invites';
 import { OrganizationPaymentMethodsResource, type PaymentMethodLookupColumn } from '../organization-payment-methods';
 import { OrganizationsResource, OrganizationSignupResource } from '../organizations';
 import { PermissionsResource } from '../permissions';
+import { StaffPermissionsResource, StaffResource } from '../staff';
+import { UserApiCredentialsResource } from '../user-api-credentials';
 import { UsersResource } from '../users';
 import { WebhookEventsResource } from '../webhook-events';
 export type SupabaseServiceClientConfig = {
@@ -61,7 +64,8 @@ export declare class SupabaseOrganizationScope {
 /**
  * The client for work that has no caller and no RLS context to run under: inbound webhooks
  * (Paystack, Resend, the Supabase `send_email` hook), the notification queue worker, unauthenticated
- * signup, the website's feature-request intake, and the writes RLS reserves for the service role
+ * signup, the website's feature-request intake, the admin api's writes (staff, their flags, user
+ * api credentials, the emulation mint), and the writes RLS reserves for the service role
  * outright - the ledger, the outbox, the webhook event logs, `organizations` INSERT, `permissions`
  * INSERT/DELETE.
  *
@@ -78,7 +82,34 @@ export declare class SupabaseServiceClient {
     readonly signup: OrganizationSignupResource;
     readonly paystackEvents: WebhookEventsResource;
     readonly resendEvents: WebhookEventsResource;
+    readonly staff: StaffResource;
+    readonly staffPermissions: StaffPermissionsResource;
+    readonly userApiCredentials: UserApiCredentialsResource;
+    readonly emulationHandshakes: EmulationHandshakesResource;
     constructor(config: SupabaseServiceClientConfig);
+    /**
+     * A one-time `token_hash` that signs `email` in - the admin api verifies it itself, at once,
+     * through `SupabaseAuthClient.exchangeMagicLinkToken`. Nothing is sent: the link only exists
+     * to be verified.
+     */
+    mintMagicLink(email: string): Promise<{
+        token_hash: string;
+    }>;
+    /**
+     * The auth user behind a staff pre-registration (`staff.preRegister`), confirmed and with the
+     * `staff` role - which is what links the two (`handle_auth_user_role_set`).
+     */
+    createStaffAuthUser(input: {
+        email: string;
+        password: string;
+    }): Promise<{
+        id: string;
+    }>;
+    /**
+     * Bans or unbans an auth user, so a deactivated user or staff member cannot sign in or refresh.
+     * A ban has no "forever" in GoTrue; a hundred years is the usual stand-in.
+     */
+    setAuthUserBanned(userId: string, banned: boolean): Promise<void>;
     /**
      * Scope to one organization once it is known. `actorMmsId` stays `null` for system work -
      * `audit_logs.created_by` is nullable precisely so an unattributed write is still recorded.
@@ -119,6 +150,13 @@ export declare class SupabaseServiceClient {
         user_id: string;
         organization_id: string;
     } | null>;
+    /**
+     * Deletes every audit row written before `cutoff` and says how many went - the daily
+     * retention cron. Every tenant at once: the period is the same for all of them. Batched by
+     * the internal identity, oldest first, so no single statement holds a long lock, and each
+     * delete is a range rather than a list of ids.
+     */
+    purgeAuditLogsBefore(cutoff: string): Promise<number>;
     /**
      * A ledger row by id alone. Also unscoped by necessity: a `charge.success` carries the
      * transaction id in its metadata, and the row is what says which tenant it belongs to.

package/dist/service-client/index.js

@@ -8,6 +8,7 @@ const billing_1 = require("../billing");
 const invoices_1 = require("../billing/invoices");
 const clients_1 = require("../clients");
 const configs_1 = require("../configs");
+const emulation_handshakes_1 = require("../emulation-handshakes");
 const feature_requests_1 = require("../feature-requests");
 const leave_1 = require("../leave");
 const notifications_1 = require("../notifications");
@@ -16,6 +17,8 @@ const organization_invites_1 = require("../organization-invites");
 const organization_payment_methods_1 = require("../organization-payment-methods");
 const organizations_1 = require("../organizations");
 const permissions_1 = require("../permissions");
+const staff_1 = require("../staff");
+const user_api_credentials_1 = require("../user-api-credentials");
 const users_1 = require("../users");
 const webhook_events_1 = require("../webhook-events");
 /**
@@ -49,7 +52,7 @@ class SupabaseOrganizationScope {
         this.leaveEntitlements = new leave_1.LeaveEntitlementsResource(supabase, actor, this.audit);
         this.leaveRequests = new leave_1.LeaveRequestsResource(supabase, actor, this.audit);
         this.organizations = new organizations_1.OrganizationsResource(supabase, actor, this.audit);
-        this.paymentMethod = new organization_payment_methods_1.OrganizationPaymentMethodsResource(supabase, actor, this.audit);
+        this.paymentMethod = new organization_payment_methods_1.OrganizationPaymentMethodsResource(supabase, actor);
         this.permissions = new permissions_1.PermissionsResource(supabase, actor, this.audit);
         this.users = new users_1.UsersResource(supabase, actor, this.audit);
     }
@@ -91,7 +94,8 @@ exports.SupabaseOrganizationScope = SupabaseOrganizationScope;
 /**
  * The client for work that has no caller and no RLS context to run under: inbound webhooks
  * (Paystack, Resend, the Supabase `send_email` hook), the notification queue worker, unauthenticated
- * signup, the website's feature-request intake, and the writes RLS reserves for the service role
+ * signup, the website's feature-request intake, the admin api's writes (staff, their flags, user
+ * api credentials, the emulation mint), and the writes RLS reserves for the service role
  * outright - the ledger, the outbox, the webhook event logs, `organizations` INSERT, `permissions`
  * INSERT/DELETE.
  *
@@ -111,6 +115,10 @@ class SupabaseServiceClient {
     signup;
     paystackEvents;
     resendEvents;
+    staff;
+    staffPermissions;
+    userApiCredentials;
+    emulationHandshakes;
     constructor(config) {
         this.config = config;
         this.supabase = (0, auth_1.createRawClient)(config.url, config.serviceRoleKey);
@@ -125,6 +133,51 @@ class SupabaseServiceClient {
             table: 'notifications',
             entityType: enum_1.AuditTrailEntityType.NOTIFICATION,
         }));
+        this.staff = new staff_1.StaffResource(this.supabase);
+        this.staffPermissions = new staff_1.StaffPermissionsResource(this.supabase);
+        this.userApiCredentials = new user_api_credentials_1.UserApiCredentialsResource(this.supabase, (organizationId) => this.forOrganization(organizationId).table({
+            table: 'user_api_credentials',
+            entityType: enum_1.AuditTrailEntityType.USER_API_CREDENTIAL,
+            related: { entityType: enum_1.AuditTrailEntityType.USER, column: 'user_id' },
+        }));
+        this.emulationHandshakes = new emulation_handshakes_1.EmulationHandshakesResource(this.supabase);
+    }
+    /**
+     * A one-time `token_hash` that signs `email` in - the admin api verifies it itself, at once,
+     * through `SupabaseAuthClient.exchangeMagicLinkToken`. Nothing is sent: the link only exists
+     * to be verified.
+     */
+    async mintMagicLink(email) {
+        const { data, error } = await this.supabase.auth.admin.generateLink({ type: 'magiclink', email });
+        if (error)
+            throw (0, errors_1.mapAuthError)(error);
+        return { token_hash: data.properties.hashed_token };
+    }
+    /**
+     * The auth user behind a staff pre-registration (`staff.preRegister`), confirmed and with the
+     * `staff` role - which is what links the two (`handle_auth_user_role_set`).
+     */
+    async createStaffAuthUser(input) {
+        const { data, error } = await this.supabase.auth.admin.createUser({
+            email: input.email,
+            password: input.password,
+            email_confirm: true,
+            role: 'staff',
+        });
+        if (error)
+            throw (0, errors_1.mapAuthError)(error);
+        return { id: data.user.id };
+    }
+    /**
+     * Bans or unbans an auth user, so a deactivated user or staff member cannot sign in or refresh.
+     * A ban has no "forever" in GoTrue; a hundred years is the usual stand-in.
+     */
+    async setAuthUserBanned(userId, banned) {
+        const { error } = await this.supabase.auth.admin.updateUserById(userId, {
+            ban_duration: banned ? '876000h' : 'none',
+        });
+        if (error)
+            throw (0, errors_1.mapAuthError)(error);
     }
     /**
      * Scope to one organization once it is known. `actorMmsId` stays `null` for system work -
@@ -209,6 +262,40 @@ class SupabaseServiceClient {
             throw (0, errors_1.mapPostgrestError)(error);
         return (data ?? null);
     }
+    /**
+     * Deletes every audit row written before `cutoff` and says how many went - the daily
+     * retention cron. Every tenant at once: the period is the same for all of them. Batched by
+     * the internal identity, oldest first, so no single statement holds a long lock, and each
+     * delete is a range rather than a list of ids.
+     */
+    async purgeAuditLogsBefore(cutoff) {
+        // Supabase's default `max_rows`: a larger limit would come back short and end the loop early.
+        const batchSize = 1000;
+        let deleted = 0;
+        for (;;) {
+            const { data, error } = await this.supabase
+                .from('audit_logs')
+                .select('id')
+                .lt('created_at', cutoff)
+                .order('id', { ascending: true })
+                .limit(batchSize);
+            if (error)
+                throw (0, errors_1.mapPostgrestError)(error);
+            const batch = (data ?? []);
+            if (batch.length === 0)
+                return deleted;
+            const { error: deleteError } = await this.supabase
+                .from('audit_logs')
+                .delete()
+                .lt('created_at', cutoff)
+                .lte('id', batch[batch.length - 1].id);
+            if (deleteError)
+                throw (0, errors_1.mapPostgrestError)(deleteError);
+            deleted += batch.length;
+            if (batch.length < batchSize)
+                return deleted;
+        }
+    }
     /**
      * A ledger row by id alone. Also unscoped by necessity: a `charge.success` carries the
      * transaction id in its metadata, and the row is what says which tenant it belongs to.

package/dist/staff/dto.d.ts

@@ -0,0 +1,14 @@
+import type { CreateStaffDto as CreateStaffDtoType, StaffIdDto as StaffIdDtoType, UpdateStaffPermissionsDto as UpdateStaffPermissionsDtoType } from '@managemint-solutions/entities/staff/dto';
+import { UpdatePermissionsDto } from '../permissions/dto';
+export declare class StaffIdDto implements StaffIdDtoType {
+    readonly staffId: string;
+}
+export declare class CreateStaffDto implements CreateStaffDtoType {
+    readonly email: string;
+    readonly name: string;
+    readonly password: string;
+}
+export declare class UpdateStaffPermissionsDto extends UpdatePermissionsDto implements UpdateStaffPermissionsDtoType {
+    readonly is_admin: boolean;
+    readonly view_dashboard: boolean;
+}

package/dist/staff/dto.js

@@ -0,0 +1,63 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateStaffPermissionsDto = exports.CreateStaffDto = exports.StaffIdDto = void 0;
+const class_validator_1 = require("class-validator");
+const dto_1 = require("../permissions/dto");
+const validators_1 = require("../validators");
+class StaffIdDto {
+    // v4: a staff member's `mms_id` is their GoTrue auth uid, as a user's is (see UserIdDto).
+    staffId;
+}
+exports.StaffIdDto = StaffIdDto;
+__decorate([
+    (0, class_validator_1.IsUUID)('4', { message: 'Invalid staff ID format' }),
+    __metadata("design:type", String)
+], StaffIdDto.prototype, "staffId", void 0);
+// The email and password rules are AddUserDto's: a staff member is a GoTrue user like any other.
+class CreateStaffDto {
+    email;
+    name;
+    password;
+}
+exports.CreateStaffDto = CreateStaffDto;
+__decorate([
+    (0, class_validator_1.IsEmail)({}, { message: 'Invalid email address' }),
+    __metadata("design:type", String)
+], CreateStaffDto.prototype, "email", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Name is required' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Name is required' }),
+    (0, class_validator_1.MaxLength)(100, { message: 'Name cannot be longer than 100 characters' }),
+    __metadata("design:type", String)
+], CreateStaffDto.prototype, "name", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Password is required' }),
+    (0, class_validator_1.MinLength)(8, { message: 'Password must be at least 8 characters' }),
+    (0, validators_1.MatchesPasswordRules)(),
+    __metadata("design:type", String)
+], CreateStaffDto.prototype, "password", void 0);
+// The tenant flag set plus the two columns a staff row carries that it leaves out: admin, which
+// staff grant through the api (the service refuses self), and the dashboard flag, so a row read
+// back from GET can be sent as is. There is no owner.
+class UpdateStaffPermissionsDto extends dto_1.UpdatePermissionsDto {
+    is_admin;
+    view_dashboard;
+}
+exports.UpdateStaffPermissionsDto = UpdateStaffPermissionsDto;
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Admin must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdateStaffPermissionsDto.prototype, "is_admin", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'View Dashboard must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdateStaffPermissionsDto.prototype, "view_dashboard", void 0);

package/dist/staff/index.d.ts

@@ -0,0 +1,50 @@
+import type { StaffEntity, StaffPermissionsEntity } from '@managemint-solutions/entities/staff';
+import type { UpdateStaffPermissionsDto } from '@managemint-solutions/entities/staff/dto';
+import type { TypedSupabaseClient } from '../client';
+export * from './dto';
+/** Admin bypasses every individual flag, so the guard reads both at once. */
+type StaffPermissionFlags = {
+    is_admin: boolean;
+} & Record<string, boolean>;
+/**
+ * The `staff` table. Staff read it on their own client; every write is the service role's (staff
+ * hold SELECT only), so `preRegister`, `removePending` and `setActive` belong to the service
+ * client. Unaudited: an `audit_logs` row belongs to an organization, and staff have none.
+ */
+export declare class StaffResource {
+    private readonly supabase;
+    constructor(supabase: TypedSupabaseClient);
+    /** Every staff member, by name. A pending pre-registration is not one yet. */
+    list(): Promise<StaffEntity[]>;
+    getById(staffId: string): Promise<StaffEntity>;
+    /**
+     * The address, written before its auth user exists - the first half of creating a staff
+     * member. `mms_id` stays null until GoTrue creates the auth user with the `staff` role and
+     * `handle_auth_user_role_set` links the two.
+     */
+    preRegister(input: {
+        email: string;
+        name: string;
+        created_by: string;
+    }): Promise<void>;
+    /** Undoes a pre-registration whose auth user was never created. A linked row is never touched. */
+    removePending(email: string): Promise<void>;
+    /** Deactivates, stamping who and when, or reactivates, clearing them. */
+    setActive(staffId: string, active: boolean, by: string): Promise<StaffEntity>;
+}
+/**
+ * The `staff_permissions` table: one row per staff member, made by the role trigger alongside
+ * the link. Staff read it on their own client; `updateForStaff` is the service client's.
+ */
+export declare class StaffPermissionsResource {
+    private readonly supabase;
+    constructor(supabase: TypedSupabaseClient);
+    /**
+     * The one lookup the admin api's guard makes per gated request: the flag the route asked for,
+     * plus the admin bypass. Null when there is no row, which the guard treats as a denial.
+     */
+    flagsFor(staffId: string, flag: string): Promise<StaffPermissionFlags | null>;
+    /** The whole row. `*`: every flag, so a new flag column needs no select edit. */
+    getForStaff(staffId: string): Promise<StaffPermissionsEntity>;
+    updateForStaff(staffId: string, patch: UpdateStaffPermissionsDto, by: string): Promise<StaffPermissionsEntity>;
+}

package/dist/staff/index.js

@@ -0,0 +1,139 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StaffPermissionsResource = exports.StaffResource = void 0;
+const audit_1 = require("../audit");
+const errors_1 = require("../errors");
+const permissions_1 = require("../permissions");
+__exportStar(require("./dto"), exports);
+const STAFF_SELECT = 'mms_id, email, name, active, created_at, created_by, deactivated_at, deactivated_by';
+/**
+ * The `staff` table. Staff read it on their own client; every write is the service role's (staff
+ * hold SELECT only), so `preRegister`, `removePending` and `setActive` belong to the service
+ * client. Unaudited: an `audit_logs` row belongs to an organization, and staff have none.
+ */
+class StaffResource {
+    supabase;
+    constructor(supabase) {
+        this.supabase = supabase;
+    }
+    /** Every staff member, by name. A pending pre-registration is not one yet. */
+    async list() {
+        const { data, error } = await this.supabase
+            .from('staff')
+            .select(STAFF_SELECT)
+            .not('mms_id', 'is', null)
+            .order('name');
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? []);
+    }
+    async getById(staffId) {
+        const { data, error } = await this.supabase
+            .from('staff')
+            .select(STAFF_SELECT)
+            .eq('mms_id', staffId)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data;
+    }
+    /**
+     * The address, written before its auth user exists - the first half of creating a staff
+     * member. `mms_id` stays null until GoTrue creates the auth user with the `staff` role and
+     * `handle_auth_user_role_set` links the two.
+     */
+    async preRegister(input) {
+        const { error } = await this.supabase.from('staff').insert(input);
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+    }
+    /** Undoes a pre-registration whose auth user was never created. A linked row is never touched. */
+    async removePending(email) {
+        const { error } = await this.supabase
+            .from('staff')
+            .delete()
+            .eq('email', email)
+            .is('mms_id', null);
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+    }
+    /** Deactivates, stamping who and when, or reactivates, clearing them. */
+    async setActive(staffId, active, by) {
+        const { data, error } = await this.supabase
+            .from('staff')
+            .update({
+            active,
+            deactivated_at: active ? null : new Date().toISOString(),
+            deactivated_by: active ? null : by,
+        })
+            .eq('mms_id', staffId)
+            .select(STAFF_SELECT)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data;
+    }
+}
+exports.StaffResource = StaffResource;
+/**
+ * The `staff_permissions` table: one row per staff member, made by the role trigger alongside
+ * the link. Staff read it on their own client; `updateForStaff` is the service client's.
+ */
+class StaffPermissionsResource {
+    supabase;
+    constructor(supabase) {
+        this.supabase = supabase;
+    }
+    /**
+     * The one lookup the admin api's guard makes per gated request: the flag the route asked for,
+     * plus the admin bypass. Null when there is no row, which the guard treats as a denial.
+     */
+    async flagsFor(staffId, flag) {
+        (0, permissions_1.checkPermissionFlag)(flag);
+        const { data, error } = await this.supabase
+            .from('staff_permissions')
+            .select(`is_admin, ${flag}`)
+            .eq('staff_id', staffId)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? null);
+    }
+    /** The whole row. `*`: every flag, so a new flag column needs no select edit. */
+    async getForStaff(staffId) {
+        const { data, error } = await this.supabase
+            .from('staff_permissions')
+            .select('*')
+            .eq('staff_id', staffId)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (0, audit_1.withoutInternalId)(data);
+    }
+    async updateForStaff(staffId, patch, by) {
+        const { data, error } = await this.supabase
+            .from('staff_permissions')
+            .update({ ...patch, updated_at: new Date().toISOString(), last_updated_by: by })
+            .eq('staff_id', staffId)
+            .select('*')
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (0, audit_1.withoutInternalId)(data);
+    }
+}
+exports.StaffPermissionsResource = StaffPermissionsResource;

package/dist/staff-client.d.ts

@@ -0,0 +1,37 @@
+import { type StaffContext } from './auth';
+import { AuditResource } from './audit';
+import type { SupabaseClientConfig, TypedSupabaseClient } from './client';
+import { ClientsResource } from './clients';
+import { LeadsResource } from './leads';
+import { OrganizationsResource } from './organizations';
+import { ProjectsResource } from './projects';
+import { StaffPermissionsResource, StaffResource } from './staff';
+import { TasksResource } from './tasks';
+import { UserApiCredentialsReads } from './user-api-credentials';
+import { UsersResource } from './users';
+type SupabaseStaffClientConfig = Omit<SupabaseClientConfig, 'auth' | 'onAuditError'> & {
+    auth: StaffContext;
+};
+/**
+ * A staff member's data client, for the admin api: every query carries the staff token, so the
+ * `staff` role's policies decide what comes back. Reads span every organization and every write
+ * is refused with a 403. A resource not listed here is simply not available to staff.
+ */
+export declare class SupabaseStaffClient {
+    readonly supabase: TypedSupabaseClient;
+    /** The staff member the token belongs to - the caller, for a service that records who acted. */
+    readonly auth: StaffContext;
+    readonly audit: AuditResource;
+    readonly clients: ClientsResource;
+    readonly leads: LeadsResource;
+    readonly projects: ProjectsResource;
+    readonly tasks: TasksResource;
+    readonly users: UsersResource;
+    readonly organizations: OrganizationsResource;
+    readonly staff: StaffResource;
+    readonly staffPermissions: StaffPermissionsResource;
+    readonly userApiCredentials: UserApiCredentialsReads;
+    constructor({ url, key, accessToken, auth, client }: SupabaseStaffClientConfig);
+}
+export declare const createSupabaseStaffClient: (config: SupabaseStaffClientConfig) => SupabaseStaffClient;
+export {};

package/dist/staff-client.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSupabaseStaffClient = exports.SupabaseStaffClient = void 0;
+const auth_1 = require("./auth");
+const audit_1 = require("./audit");
+const additional_details_1 = require("./additional-details");
+const clients_1 = require("./clients");
+const leads_1 = require("./leads");
+const organizations_1 = require("./organizations");
+const projects_1 = require("./projects");
+const staff_1 = require("./staff");
+const tasks_1 = require("./tasks");
+const user_api_credentials_1 = require("./user-api-credentials");
+const users_1 = require("./users");
+/**
+ * A staff member's data client, for the admin api: every query carries the staff token, so the
+ * `staff` role's policies decide what comes back. Reads span every organization and every write
+ * is refused with a 403. A resource not listed here is simply not available to staff.
+ */
+class SupabaseStaffClient {
+    supabase; // escape hatch for not-yet-migrated queries
+    /** The staff member the token belongs to - the caller, for a service that records who acted. */
+    auth;
+    audit;
+    clients;
+    leads;
+    projects;
+    tasks;
+    users;
+    organizations;
+    staff;
+    staffPermissions;
+    userApiCredentials;
+    constructor({ url, key, accessToken, auth, client }) {
+        this.supabase = client ?? (0, auth_1.createRawClient)(url, key, accessToken);
+        this.auth = auth;
+        this.audit = new audit_1.AuditResource(this.supabase, auth);
+        this.clients = new clients_1.ClientsResource(this.supabase, auth, this.audit);
+        const additionalDetails = new additional_details_1.AdditionalDetailsResource(this.supabase, auth, this.audit);
+        this.leads = new leads_1.LeadsResource(this.supabase, auth, this.audit, additionalDetails);
+        this.projects = new projects_1.ProjectsResource(this.supabase, auth, this.audit);
+        this.tasks = new tasks_1.TasksResource(this.supabase, auth, this.audit);
+        this.users = new users_1.UsersResource(this.supabase, auth, this.audit);
+        this.organizations = new organizations_1.OrganizationsResource(this.supabase, auth, this.audit);
+        this.staff = new staff_1.StaffResource(this.supabase);
+        this.staffPermissions = new staff_1.StaffPermissionsResource(this.supabase);
+        this.userApiCredentials = new user_api_credentials_1.UserApiCredentialsReads(this.supabase);
+    }
+}
+exports.SupabaseStaffClient = SupabaseStaffClient;
+const createSupabaseStaffClient = (config) => new SupabaseStaffClient(config);
+exports.createSupabaseStaffClient = createSupabaseStaffClient;

package/dist/tasks/dto.d.ts

@@ -1,4 +1,4 @@
-import type { AddTaskLinkDto as AddTaskLinkDtoType, CreateTaskDto as CreateTaskDtoType, GetTasksDto as GetTasksDtoType, TaskIdDto as TaskIdDtoType, TaskLinkIdDto as TaskLinkIdDtoType, UpdateTaskDto as UpdateTaskDtoType } from '@managemint-solutions/entities/tasks/dto';
+import type { AddTaskLinkDto as AddTaskLinkDtoType, CreateTaskDto as CreateTaskDtoType, GetTasksDto as GetTasksDtoType, StaffGetTasksDto as StaffGetTasksDtoType, TaskIdDto as TaskIdDtoType, TaskLinkIdDto as TaskLinkIdDtoType, UpdateTaskDto as UpdateTaskDtoType } from '@managemint-solutions/entities/tasks/dto';
 import { TaskLinkType } from '@managemint-solutions/entities/tasks/enum';
 export declare class TaskIdDto implements TaskIdDtoType {
     readonly taskId: string;
@@ -31,6 +31,10 @@ export declare class GetTasksDto implements Omit<GetTasksDtoType, 'status_id_in'
     readonly priority_in?: number[] | null;
     readonly archive: boolean;
 }
+/** A staff read across organizations, optionally narrowed to one of them. */
+export declare class StaffGetTasksDto extends GetTasksDto implements Omit<StaffGetTasksDtoType, 'status_id_in' | 'status_id_not_in' | 'label_id_in' | 'priority_in'> {
+    readonly organization_id?: string | null;
+}
 export declare class CreateTaskDto implements CreateTaskDtoType {
     readonly name: string;
     readonly description?: string | null;

package/dist/tasks/dto.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UpdateTaskDto = exports.CreateTaskDto = exports.GetTasksDto = exports.AddTaskLinkDto = exports.TaskLinkIdDto = exports.TaskIdDto = void 0;
+exports.UpdateTaskDto = exports.CreateTaskDto = exports.StaffGetTasksDto = exports.GetTasksDto = exports.AddTaskLinkDto = exports.TaskLinkIdDto = exports.TaskIdDto = void 0;
 const class_validator_1 = require("class-validator");
 const class_transformer_1 = require("class-transformer");
 const enum_1 = require("@managemint-solutions/entities/tasks/enum");
@@ -206,6 +206,17 @@ __decorate([
     (0, class_validator_1.IsBoolean)({ message: 'Include archived must be a boolean' }),
     __metadata("design:type", Boolean)
 ], GetTasksDto.prototype, "archive", void 0);
+/** A staff read across organizations, optionally narrowed to one of them. */
+class StaffGetTasksDto extends GetTasksDto {
+    organization_id;
+}
+exports.StaffGetTasksDto = StaffGetTasksDto;
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsUUID)('7', { message: 'Invalid organization ID format' }),
+    __metadata("design:type", Object)
+], StaffGetTasksDto.prototype, "organization_id", void 0);
 class CreateTaskDto {
     name;
     description;