@managemint-solutions/sdk 0.52.0 → 0.54.0

package/dist/tasks/index.d.ts

@@ -1,17 +1,21 @@
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { TaskEntity, TaskSummary } from '@managemint-solutions/entities/tasks';
-import type { AuthContext } from '../auth';
-import { type AuditResource } from '../audit';
+import type { ClientContext } from '../auth';
+import { EntityAuditTrail, type AuditResource } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { AddTaskLinkDto, CreateTaskDto, GetTasksDto, UpdateTaskDto } from './dto';
 export * from './dto';
 export declare class TasksResource {
     private readonly supabase;
     private readonly auth;
-    private readonly audit;
+    private readonly auditLog;
     private readonly table;
-    constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
-    list(query: GetTasksDto): Promise<MmsList<TaskSummary>>;
+    /** This record's history - its own rows and the rows that hang off it. */
+    readonly audit: EntityAuditTrail;
+    constructor(supabase: TypedSupabaseClient, auth: ClientContext, auditLog: AuditResource);
+    list(query: GetTasksDto & {
+        organization_id?: string | null;
+    }): Promise<MmsList<TaskSummary>>;
     getById(taskId: string): Promise<TaskEntity>;
     create(input: CreateTaskDto): Promise<TaskEntity>;
     update(taskId: string, input: UpdateTaskDto): Promise<TaskEntity>;
@@ -43,11 +47,12 @@ export declare class TasksResource {
     private checkLabels;
     /**
      * Makes `labelIds` the task's whole label set. The join rows carry no audit of their own: the
-     * change is one UPDATE entry on the task, `labels: { old: [names], new: [names] }`, recorded
-     * only when the set actually moved - on a new task that entry is the record of the initial
-     * pinning. Only the difference is written, the new labels inserted before the dropped ones are
-     * deleted, so should the trigger still refuse one (a label deleted after `checkLabels`) the
-     * task's existing labels are untouched, and a label kept across an edit keeps its place.
+     * change is an UPDATE entry on the task, `labels: { old: [names], new: [names] }`, recorded
+     * only when the set actually moved - inside a request's audit batch it folds into the task's
+     * own entry for that save (`withAuditBatch`). Only the difference is written, the new labels
+     * inserted before the dropped ones are deleted, so should the trigger still refuse one (a label
+     * deleted after `checkLabels`) the task's existing labels are untouched, and a label kept
+     * across an edit keeps its place.
      */
     private setLabels;
 }

package/dist/tasks/index.js

@@ -20,6 +20,7 @@ const enum_2 = require("@managemint-solutions/entities/labels/enum");
 const enum_3 = require("@managemint-solutions/entities/audit-trail/enum");
 const audit_1 = require("../audit");
 const errors_1 = require("../errors");
+const tenancy_1 = require("../tenancy");
 const transforms_1 = require("../transforms");
 __exportStar(require("./dto"), exports);
 // The public contract is the shared TaskSummary / TaskEntity from @managemint-solutions/entities;
@@ -124,16 +125,19 @@ const linkedTasks = (rows, linkType) => rows
 class TasksResource {
     supabase;
     auth;
-    audit;
+    auditLog;
     table;
-    constructor(supabase, auth, audit) {
+    /** This record's history - its own rows and the rows that hang off it. */
+    audit;
+    constructor(supabase, auth, auditLog) {
         this.supabase = supabase;
         this.auth = auth;
-        this.audit = audit;
-        this.table = (0, audit_1.auditedTable)(supabase, auth, audit, {
+        this.auditLog = auditLog;
+        this.table = (0, audit_1.auditedTable)(supabase, auth, auditLog, {
             table: 'tasks',
             entityType: enum_3.AuditTrailEntityType.TASKS,
         });
+        this.audit = new audit_1.EntityAuditTrail(supabase, auth, enum_3.AuditTrailEntityType.TASKS);
     }
     async list(query) {
         const page = query.page;
@@ -143,17 +147,17 @@ class TasksResource {
         const labelIdIn = query.label_id_in && query.label_id_in.length > 0 ? query.label_id_in : null;
         // `order`/`range` return `this`, so the builder stays a filter builder and the conditional
         // filters below can be reassigned onto it without a cast.
-        let tasksQuery = this.supabase
+        let tasksQuery = (0, tenancy_1.scopeToOrganization)(this.supabase
             .from('tasks')
-            .select(labelIdIn ? `${TASK_LIST_SELECT}, ${LABEL_FILTER_SELECT}` : TASK_LIST_SELECT, {
-            count: 'estimated',
-        })
-            .eq('organization_id', this.auth.organization_id)
+            .select((0, tenancy_1.withOrganization)(labelIdIn ? `${TASK_LIST_SELECT}, ${LABEL_FILTER_SELECT}` : TASK_LIST_SELECT, this.auth), { count: 'estimated' }), this.auth)
             .eq('archived', query.archive)
             .eq('deleted', false)
             .order('priority', { ascending: false })
             .order('created_at', { ascending: false })
             .range(offset, offset + pageSize - 1);
+        if (query.organization_id) {
+            tasksQuery = tasksQuery.eq('organization_id', query.organization_id);
+        }
         if (trimmedSearch) {
             // "TASK-12", "#12" or "12" also finds task number 12; anything else is a text search only.
             const taskNumber = trimmedSearch.match(/^(?:[a-z]+-|#)?(\d+)$/i)?.[1];
@@ -217,11 +221,7 @@ class TasksResource {
         return (0, transforms_1.toMmsList)(rows, page, pageSize, count);
     }
     async getById(taskId) {
-        const { data, error } = await this.supabase
-            .from('tasks')
-            .select(TASK_DETAIL_SELECT)
-            .eq('mms_id', taskId)
-            .eq('organization_id', this.auth.organization_id)
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('tasks').select(TASK_DETAIL_SELECT).eq('mms_id', taskId), this.auth)
             .order('created_at', { referencedTable: 'links_out' })
             .order('created_at', { referencedTable: 'links_in' })
             .single();
@@ -247,7 +247,7 @@ class TasksResource {
         // BEFORE INSERT trigger fills it in when it arrives null.
         const row = await this.table.insert({
             ...fields,
-            organization_id: this.auth.organization_id,
+            organization_id: (0, tenancy_1.requireOrganization)(this.auth),
             created_by: this.auth.mms_id,
             created_at: new Date().toISOString(),
         });
@@ -297,6 +297,7 @@ class TasksResource {
      * made from.
      */
     async linkTask(taskId, input) {
+        const organizationId = (0, tenancy_1.requireOrganization)(this.auth);
         const refuse = (status, message, cause) => new errors_1.SupabaseClientError({ status, error: 'Database Error', message }, { cause });
         if (input.linked_task_id === taskId) {
             throw refuse(400, 'A task cannot be linked to itself');
@@ -304,7 +305,7 @@ class TasksResource {
         const { data: tasks, error: tasksError } = await this.supabase
             .from('tasks')
             .select('mms_id, task_number:task_id')
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', organizationId)
             .eq('deleted', false)
             .in('mms_id', [taskId, input.linked_task_id]);
         if (tasksError)
@@ -325,7 +326,7 @@ class TasksResource {
                 const { data: parentLink, error: parentError } = await this.supabase
                     .from('task_links')
                     .select('task_id')
-                    .eq('organization_id', this.auth.organization_id)
+                    .eq('organization_id', organizationId)
                     .eq('linked_task_id', child)
                     .eq('link_type', enum_1.TaskLinkType.CHILD)
                     .maybeSingle();
@@ -341,7 +342,7 @@ class TasksResource {
             task_id: taskId,
             linked_task_id: input.linked_task_id,
             link_type: input.link_type,
-            organization_id: this.auth.organization_id,
+            organization_id: organizationId,
             created_by: this.auth.mms_id,
         });
         if (error) {
@@ -356,7 +357,7 @@ class TasksResource {
             throw (0, errors_1.mapPostgrestError)(error);
         }
         const role = input.link_type === enum_1.TaskLinkType.CHILD ? 'subtask' : 'related';
-        await this.audit.record({
+        await this.auditLog.record({
             action: enum_3.AuditTrailAction.UPDATE,
             entityType: enum_3.AuditTrailEntityType.TASKS,
             entityId: taskId,
@@ -373,7 +374,7 @@ class TasksResource {
         const { data, error } = await this.supabase
             .from('task_links')
             .delete()
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', (0, tenancy_1.requireOrganization)(this.auth))
             .or(`and(task_id.eq.${taskId},linked_task_id.eq.${linkedTaskId}),and(task_id.eq.${linkedTaskId},linked_task_id.eq.${taskId})`)
             .select('task_id, link_type, from:tasks!task_id ( task_number:task_id ), to:tasks!linked_task_id ( task_number:task_id )');
         if (error)
@@ -384,7 +385,7 @@ class TasksResource {
         }
         const madeHere = row.task_id === taskId;
         const role = row.link_type === enum_1.TaskLinkType.RELATED ? 'related' : madeHere ? 'subtask' : 'parent';
-        await this.audit.record({
+        await this.auditLog.record({
             action: enum_3.AuditTrailAction.UPDATE,
             entityType: enum_3.AuditTrailEntityType.TASKS,
             entityId: taskId,
@@ -406,7 +407,7 @@ class TasksResource {
         const { count, error } = await this.supabase
             .from('labels')
             .select('mms_id', { count: 'exact', head: true })
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', (0, tenancy_1.requireOrganization)(this.auth))
             .eq('entity_type', enum_2.LabelEntityTypes.TASK)
             .in('mms_id', labelIds);
         if (error)
@@ -421,18 +422,20 @@ class TasksResource {
     }
     /**
      * Makes `labelIds` the task's whole label set. The join rows carry no audit of their own: the
-     * change is one UPDATE entry on the task, `labels: { old: [names], new: [names] }`, recorded
-     * only when the set actually moved - on a new task that entry is the record of the initial
-     * pinning. Only the difference is written, the new labels inserted before the dropped ones are
-     * deleted, so should the trigger still refuse one (a label deleted after `checkLabels`) the
-     * task's existing labels are untouched, and a label kept across an edit keeps its place.
+     * change is an UPDATE entry on the task, `labels: { old: [names], new: [names] }`, recorded
+     * only when the set actually moved - inside a request's audit batch it folds into the task's
+     * own entry for that save (`withAuditBatch`). Only the difference is written, the new labels
+     * inserted before the dropped ones are deleted, so should the trigger still refuse one (a label
+     * deleted after `checkLabels`) the task's existing labels are untouched, and a label kept
+     * across an edit keeps its place.
      */
     async setLabels(taskId, labelIds) {
+        const organizationId = (0, tenancy_1.requireOrganization)(this.auth);
         const { data: current, error: readError } = await this.supabase
             .from('task_labels')
             .select(PINNED_LABEL_SELECT)
             .eq('task_id', taskId)
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', organizationId)
             .order('created_at');
         if (readError)
             throw (0, errors_1.mapPostgrestError)(readError);
@@ -449,7 +452,7 @@ class TasksResource {
                 .insert(added.map((labelId) => ({
                 task_id: taskId,
                 label_id: labelId,
-                organization_id: this.auth.organization_id,
+                organization_id: organizationId,
                 created_by: this.auth.mms_id,
             })))
                 .select(PINNED_LABEL_SELECT);
@@ -462,12 +465,12 @@ class TasksResource {
                 .from('task_labels')
                 .delete()
                 .eq('task_id', taskId)
-                .eq('organization_id', this.auth.organization_id)
+                .eq('organization_id', organizationId)
                 .in('label_id', dropped.map((row) => row.label_id));
             if (error)
                 throw (0, errors_1.mapPostgrestError)(error);
         }
-        await this.audit.record({
+        await this.auditLog.record({
             action: enum_3.AuditTrailAction.UPDATE,
             entityType: enum_3.AuditTrailEntityType.TASKS,
             entityId: taskId,

package/dist/tenancy.d.ts

@@ -0,0 +1,13 @@
+import type { PostgrestFilterBuilder } from '@supabase/postgrest-js';
+/** A read filtered to the caller's organization, or left across every organization for staff. */
+export declare const scopeToOrganization: <Q extends PostgrestFilterBuilder<any, any, any, any, any, any, any>>(query: Q, actor: {
+    organization_id: string | null;
+}) => Q;
+/** The caller's organization id, for a write; staff have none and are refused with a 403. */
+export declare const requireOrganization: (actor: {
+    organization_id: string | null;
+}) => string;
+/** A list select, plus each row's organization on a staff read so the row says whose it is. */
+export declare const withOrganization: (select: string, actor: {
+    organization_id: string | null;
+}) => string;

package/dist/tenancy.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withOrganization = exports.requireOrganization = exports.scopeToOrganization = void 0;
+const errors_1 = require("./errors");
+// How a resource scopes itself to the caller's organization. A tenant (`AuthContext`) reads and
+// writes inside their own; staff (`StaffContext`, `organization_id: null`) read across every
+// organization, as their role's policies allow, and write nothing.
+/** A read filtered to the caller's organization, or left across every organization for staff. */
+const scopeToOrganization = (query, actor) => (actor.organization_id === null ? query : query.eq('organization_id', actor.organization_id));
+exports.scopeToOrganization = scopeToOrganization;
+/** The caller's organization id, for a write; staff have none and are refused with a 403. */
+const requireOrganization = (actor) => {
+    if (actor.organization_id === null) {
+        throw new errors_1.SupabaseClientError({
+            status: 403,
+            error: 'Permission Error',
+            message: 'Organization required',
+        });
+    }
+    return actor.organization_id;
+};
+exports.requireOrganization = requireOrganization;
+/** A list select, plus each row's organization on a staff read so the row says whose it is. */
+const withOrganization = (select, actor) => actor.organization_id === null ? `${select}, organization:organizations!organization_id(mms_id, name)` : select;
+exports.withOrganization = withOrganization;

package/dist/timesheets/timesheet-entries.js

@@ -59,6 +59,7 @@ class TimesheetEntriesResource {
         this.table = (0, audit_1.auditedTable)(supabase, auth, audit, {
             table: 'timesheet_entries',
             entityType: enum_1.AuditTrailEntityType.TIMESHEET_ENTRIES,
+            related: { entityType: enum_1.AuditTrailEntityType.TIMESHEETS, column: 'timesheet_id' },
         });
     }
     async getById(timesheetEntryId) {

package/dist/timesheets/timesheets.d.ts

@@ -2,7 +2,7 @@ import type { MmsList } from '@managemint-solutions/entities/common';
 import type { TimesheetEntity, TimesheetSummary } from '@managemint-solutions/entities/timesheets';
 import { TimesheetReviewDecision, TimesheetStatus } from '@managemint-solutions/entities/timesheets/enum';
 import type { AuthContext } from '../auth';
-import { type AuditResource } from '../audit';
+import { EntityAuditTrail, type AuditResource } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { GetTimesheetsDto } from './dto';
 /** What the entry path needs of the week an entry falls in: its id and whether it is still open. */
@@ -29,6 +29,8 @@ export declare class TimesheetsResource {
     private readonly supabase;
     private readonly auth;
     private readonly table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    readonly audit: EntityAuditTrail;
     constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
     list(query: GetTimesheetsDto, options?: ListOptions): Promise<MmsList<TimesheetSummary>>;
     /** The week with its entries, by date then start time. */

package/dist/timesheets/timesheets.js

@@ -27,6 +27,8 @@ class TimesheetsResource {
     supabase;
     auth;
     table;
+    /** This record's history - its own rows and the rows that hang off it. */
+    audit;
     constructor(supabase, auth, audit) {
         this.supabase = supabase;
         this.auth = auth;
@@ -34,6 +36,7 @@ class TimesheetsResource {
             table: 'timesheets',
             entityType: enum_1.AuditTrailEntityType.TIMESHEETS,
         });
+        this.audit = new audit_1.EntityAuditTrail(supabase, auth, enum_1.AuditTrailEntityType.TIMESHEETS);
     }
     async list(query, options = {}) {
         const page = query.page;

package/dist/user-api-credentials/dto.d.ts

@@ -0,0 +1,12 @@
+import type { CreateUserApiCredentialDto as CreateUserApiCredentialDtoType, MintEmulationTokenDto as MintEmulationTokenDtoType, UserApiCredentialIdDto as UserApiCredentialIdDtoType } from '@managemint-solutions/entities/user-api-credentials/dto';
+export declare class UserApiCredentialIdDto implements UserApiCredentialIdDtoType {
+    readonly credentialId: string;
+}
+export declare class CreateUserApiCredentialDto implements CreateUserApiCredentialDtoType {
+    readonly label: string;
+    readonly expires_at?: string | null;
+}
+export declare class MintEmulationTokenDto implements MintEmulationTokenDtoType {
+    readonly client_id: string;
+    readonly client_secret: string;
+}

package/dist/user-api-credentials/dto.js

@@ -0,0 +1,56 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MintEmulationTokenDto = exports.CreateUserApiCredentialDto = exports.UserApiCredentialIdDto = void 0;
+const class_validator_1 = require("class-validator");
+const validators_1 = require("../validators");
+class UserApiCredentialIdDto {
+    credentialId;
+}
+exports.UserApiCredentialIdDto = UserApiCredentialIdDto;
+__decorate([
+    (0, class_validator_1.IsUUID)('7', { message: 'Invalid credential ID format' }),
+    __metadata("design:type", String)
+], UserApiCredentialIdDto.prototype, "credentialId", void 0);
+class CreateUserApiCredentialDto {
+    label;
+    expires_at;
+}
+exports.CreateUserApiCredentialDto = CreateUserApiCredentialDto;
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Label is required' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Label is required' }),
+    (0, class_validator_1.MaxLength)(100, { message: 'Label cannot be longer than 100 characters' }),
+    __metadata("design:type", String)
+], CreateUserApiCredentialDto.prototype, "label", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsDateString)({}, { message: 'Expiry must be a valid ISO 8601 date string' }),
+    __metadata("design:type", Object)
+], CreateUserApiCredentialDto.prototype, "expires_at", void 0);
+class MintEmulationTokenDto {
+    client_id;
+    client_secret;
+}
+exports.MintEmulationTokenDto = MintEmulationTokenDto;
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Client ID is required' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Client ID is required' }),
+    (0, class_validator_1.MaxLength)(255, { message: 'Client ID cannot be longer than 255 characters' }),
+    __metadata("design:type", String)
+], MintEmulationTokenDto.prototype, "client_id", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Client secret is required' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Client secret is required' }),
+    (0, class_validator_1.MaxLength)(255, { message: 'Client secret cannot be longer than 255 characters' }),
+    __metadata("design:type", String)
+], MintEmulationTokenDto.prototype, "client_secret", void 0);

package/dist/user-api-credentials/index.d.ts

@@ -0,0 +1,47 @@
+import type { UserApiCredentialEntity } from '@managemint-solutions/entities/user-api-credentials';
+import { type OrganizationTableFactory } from '../audit';
+import type { TypedSupabaseClient } from '../client';
+export * from './dto';
+/** What `create` writes: the secret already hashed, and the staff member who issued it. */
+export type CreateUserApiCredentialRow = {
+    user_id: string;
+    organization_id: string;
+    client_id: string;
+    secret_hash: string;
+    label: string;
+    expires_at: string | null;
+    created_by: string;
+};
+/** The whole row, the secret hash included - what a mint is checked against. */
+export type UserApiCredentialRow = UserApiCredentialEntity & {
+    secret_hash: string;
+};
+/**
+ * Credentials as staff read them, on their own client, through the column grant that leaves the
+ * secret hash out. Tenant users have no grant at all.
+ */
+export declare class UserApiCredentialsReads {
+    private readonly supabase;
+    constructor(supabase: TypedSupabaseClient);
+    /** A user's credentials, newest first. */
+    listForUser(userId: string): Promise<UserApiCredentialEntity[]>;
+}
+/**
+ * The writes and the secret check, on the service client only: every write is the service
+ * role's, and nobody else may read the hash. A credential's writes are audited against its own
+ * organization as the system - the staff member who issued or revoked it is on the row itself
+ * (`created_by`, `revoked_by`), and is not a user an audit row can name.
+ */
+export declare class UserApiCredentialsResource {
+    private readonly supabase;
+    private readonly tableFor;
+    constructor(supabase: TypedSupabaseClient, tableFor: OrganizationTableFactory);
+    /** Issues a credential. Its `secret_hash` is redacted in the audit row and never returned. */
+    create(row: CreateUserApiCredentialRow): Promise<UserApiCredentialEntity>;
+    /** The credential a client id names, with its secret hash. Null when none does. */
+    findByClientId(clientId: string): Promise<UserApiCredentialRow | null>;
+    /** Revokes a live credential. Null when it was revoked already. */
+    revoke(credentialId: string, revokedBy: string): Promise<UserApiCredentialEntity | null>;
+    /** Stamps a successful mint, unaudited: when it was last used, not a change to the credential. */
+    markUsed(credentialId: string): Promise<void>;
+}

package/dist/user-api-credentials/index.js

@@ -0,0 +1,101 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserApiCredentialsResource = exports.UserApiCredentialsReads = void 0;
+const audit_1 = require("../audit");
+const errors_1 = require("../errors");
+__exportStar(require("./dto"), exports);
+// Exactly the columns the staff grant covers: never `secret_hash`, which only the mint reads.
+const CREDENTIAL_SELECT = 'mms_id, user_id, organization_id, client_id, label, created_at, created_by, expires_at, revoked_at, revoked_by, last_used_at';
+/** A written row as a reader sees it: without the secret hash. */
+const toCredential = (row) => {
+    const { secret_hash: _secretHash, ...credential } = row;
+    return credential;
+};
+/**
+ * Credentials as staff read them, on their own client, through the column grant that leaves the
+ * secret hash out. Tenant users have no grant at all.
+ */
+class UserApiCredentialsReads {
+    supabase;
+    constructor(supabase) {
+        this.supabase = supabase;
+    }
+    /** A user's credentials, newest first. */
+    async listForUser(userId) {
+        const { data, error } = await this.supabase
+            .from('user_api_credentials')
+            .select(CREDENTIAL_SELECT)
+            .eq('user_id', userId)
+            .order('created_at', { ascending: false });
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? []);
+    }
+}
+exports.UserApiCredentialsReads = UserApiCredentialsReads;
+/**
+ * The writes and the secret check, on the service client only: every write is the service
+ * role's, and nobody else may read the hash. A credential's writes are audited against its own
+ * organization as the system - the staff member who issued or revoked it is on the row itself
+ * (`created_by`, `revoked_by`), and is not a user an audit row can name.
+ */
+class UserApiCredentialsResource {
+    supabase;
+    tableFor;
+    constructor(supabase, tableFor) {
+        this.supabase = supabase;
+        this.tableFor = tableFor;
+    }
+    /** Issues a credential. Its `secret_hash` is redacted in the audit row and never returned. */
+    async create(row) {
+        return toCredential(await this.tableFor(row.organization_id).insert(row));
+    }
+    /** The credential a client id names, with its secret hash. Null when none does. */
+    async findByClientId(clientId) {
+        const { data, error } = await this.supabase
+            .from('user_api_credentials')
+            .select('*')
+            .eq('client_id', clientId)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data ? (0, audit_1.withoutInternalId)(data) : null;
+    }
+    /** Revokes a live credential. Null when it was revoked already. */
+    async revoke(credentialId, revokedBy) {
+        // The audited table is the credential's organization's, so that is read first.
+        const { data, error } = await this.supabase
+            .from('user_api_credentials')
+            .select('organization_id')
+            .eq('mms_id', credentialId)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        const row = await this.tableFor(data.organization_id).updateWhere(credentialId, (query) => query.is('revoked_at', null), { revoked_at: new Date().toISOString(), revoked_by: revokedBy });
+        return row ? toCredential(row) : null;
+    }
+    /** Stamps a successful mint, unaudited: when it was last used, not a change to the credential. */
+    async markUsed(credentialId) {
+        const { error } = await this.supabase
+            .from('user_api_credentials')
+            .update({ last_used_at: new Date().toISOString() })
+            .eq('mms_id', credentialId);
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+    }
+}
+exports.UserApiCredentialsResource = UserApiCredentialsResource;

package/dist/users/dto.d.ts

@@ -1,4 +1,4 @@
-import type { CreateUserDto as CreateUserDtoType, GetUsersDto as GetUsersDtoType, UpdateMyProfileDto as UpdateMyProfileDtoType, UpdateUserDto as UpdateUserDtoType, UserIdDto as UserIdDtoType } from '@managemint-solutions/entities/users/dto';
+import type { CreateUserDto as CreateUserDtoType, GetUsersDto as GetUsersDtoType, StaffGetUsersDto as StaffGetUsersDtoType, UpdateMyProfileDto as UpdateMyProfileDtoType, UpdateUserDto as UpdateUserDtoType, UserIdDto as UserIdDtoType } from '@managemint-solutions/entities/users/dto';
 import { EmergencyContactRelationship, EmploymentType } from '@managemint-solutions/entities/users/enum';
 export declare class UserIdDto implements UserIdDtoType {
     readonly userId: string;
@@ -28,6 +28,10 @@ export declare class GetUsersQueryDto implements Omit<GetUsersDtoType, 'active_i
     readonly active_in?: boolean[] | null;
     readonly manager_id?: string | null;
 }
+/** A staff read across organizations, optionally narrowed to one of them. */
+export declare class StaffGetUsersDto extends GetUsersQueryDto implements Omit<StaffGetUsersDtoType, 'active_in'> {
+    readonly organization_id?: string | null;
+}
 export declare class UpdateUserDto implements UpdateUserDtoType {
     readonly name: string;
     readonly surname: string;

package/dist/users/dto.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UpdateMyProfileDto = exports.UpdateUserDto = exports.GetUsersQueryDto = exports.AddUserDto = exports.UserIdDto = void 0;
+exports.UpdateMyProfileDto = exports.UpdateUserDto = exports.StaffGetUsersDto = exports.GetUsersQueryDto = exports.AddUserDto = exports.UserIdDto = void 0;
 const class_validator_1 = require("class-validator");
 const class_transformer_1 = require("class-transformer");
 const validators_1 = require("../validators");
@@ -51,7 +51,7 @@ __decorate([
 __decorate([
     (0, class_validator_1.IsString)({ message: 'Password is required' }),
     (0, class_validator_1.MinLength)(8, { message: 'Password must be at least 8 characters' }),
-    (0, class_validator_1.Matches)(/^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[!@#$%^&*])/, { message: 'Password must contain at least 1 uppercase letter, 1 lowercase letter, 1 number, and 1 special character (!@#$%^&*)' }),
+    (0, validators_1.MatchesPasswordRules)(),
     __metadata("design:type", String)
 ], AddUserDto.prototype, "password", void 0);
 __decorate([
@@ -134,6 +134,17 @@ __decorate([
     (0, class_validator_1.IsUUID)('4', { message: 'Invalid manager ID format' }),
     __metadata("design:type", Object)
 ], GetUsersQueryDto.prototype, "manager_id", void 0);
+/** A staff read across organizations, optionally narrowed to one of them. */
+class StaffGetUsersDto extends GetUsersQueryDto {
+    organization_id;
+}
+exports.StaffGetUsersDto = StaffGetUsersDto;
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsUUID)('7', { message: 'Invalid organization ID format' }),
+    __metadata("design:type", Object)
+], StaffGetUsersDto.prototype, "organization_id", void 0);
 class UpdateUserDto {
     name;
     surname;

package/dist/users/index.d.ts

@@ -1,6 +1,6 @@
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { UserIdentity, UserSummary } from '@managemint-solutions/entities/users';
-import { type AuditActor, type AuditResource, type AuditRow } from '../audit';
+import { type AuditResource, type AuditRow, EntityAuditTrail, type ResourceActor } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { GetUsersQueryDto } from './dto';
 export * from './dto';
@@ -24,8 +24,12 @@ export declare class UsersResource {
     private readonly supabase;
     private readonly auth;
     private readonly table;
-    constructor(supabase: TypedSupabaseClient, auth: AuditActor, audit: AuditResource);
-    list(query: GetUsersQueryDto): Promise<MmsList<UserSummary>>;
+    /** This record's history - its own rows and the rows that hang off it. */
+    readonly audit: EntityAuditTrail;
+    constructor(supabase: TypedSupabaseClient, auth: ResourceActor, audit: AuditResource);
+    list(query: GetUsersQueryDto & {
+        organization_id?: string | null;
+    }): Promise<MmsList<UserSummary>>;
     getRow(userId: string): Promise<UserRow>;
     /**
      * The public profile behind a `*_by` / `manager_id` column. `user_profiles` is a