@managemint-solutions/sdk 0.53.0 → 0.54.0

package/dist/organizations/index.d.ts

@@ -1,6 +1,9 @@
 import type { SeatReservation } from '@managemint-solutions/entities/billing';
-import { type AuditActor, type AuditResource, type AuditRow, EntityAuditTrail } from '../audit';
+import type { MmsList } from '@managemint-solutions/entities/common';
+import type { OrganizationSummary } from '@managemint-solutions/entities/organization';
+import { type AuditResource, type AuditRow, EntityAuditTrail, type ResourceActor } from '../audit';
 import type { TypedSupabaseClient } from '../client';
+import type { GetOrganizationsDto } from './dto';
 export * from './dto';
 /** The organizations row as `ORGANIZATION_SELECT` produces it, before the api shapes it. */
 export type OrganizationRow = Record<string, unknown> & {
@@ -20,10 +23,15 @@ export declare class OrganizationsResource {
     private readonly table;
     /** This record's history - its own rows and the rows that hang off it. */
     readonly audit: EntityAuditTrail;
-    constructor(supabase: TypedSupabaseClient, auth: AuditActor, audit: AuditResource);
+    constructor(supabase: TypedSupabaseClient, auth: ResourceActor, audit: AuditResource);
     getById(organizationId: string): Promise<OrganizationRow>;
-    /** The caller's own organization, from the auth context. */
+    /** The caller's own organization, from the auth context. Staff have none: a 403. */
     get(): Promise<OrganizationRow>;
+    /**
+     * Every organization the caller can read, newest first - all of them for staff, the caller's
+     * own for a tenant, as RLS decides. `search` matches the name, trading name and email.
+     */
+    list(query: GetOrganizationsDto): Promise<MmsList<OrganizationSummary>>;
     /**
      * The whole row, unprojected. Billing reads a different handful of columns for each of its
      * flows - provisioning, a module purchase, a seat charge - and they are all single-row

package/dist/organizations/index.js

@@ -18,6 +18,7 @@ exports.OrganizationSignupResource = exports.OrganizationsResource = void 0;
 const enum_1 = require("@managemint-solutions/entities/audit-trail/enum");
 const audit_1 = require("../audit");
 const errors_1 = require("../errors");
+const tenancy_1 = require("../tenancy");
 const transforms_1 = require("../transforms");
 __exportStar(require("./dto"), exports);
 // The subscription machinery on the row - what the billing flows and the Paystack webhooks
@@ -94,6 +95,8 @@ const ORGANIZATION_SELECT = `
         card_expiring_soon,
         pricebook_id
       `;
+// The public contract is the shared OrganizationSummary; `modules` stays the stored module keys.
+const ORGANIZATION_LIST_SELECT = 'mms_id, created_at, name, trading_name, email, billing_status, active_seat_count, paid_seat_count, modules';
 /**
  * The caller's own organization. Every method takes the id explicitly rather than reading it
  * off the auth context, because the signup and webhook paths operate on an organization that
@@ -121,9 +124,34 @@ class OrganizationsResource {
             throw (0, errors_1.mapPostgrestError)(error);
         return data;
     }
-    /** The caller's own organization, from the auth context. */
+    /** The caller's own organization, from the auth context. Staff have none: a 403. */
     async get() {
-        return this.getById(this.auth.organization_id);
+        return this.getById((0, tenancy_1.requireOrganization)(this.auth));
+    }
+    /**
+     * Every organization the caller can read, newest first - all of them for staff, the caller's
+     * own for a tenant, as RLS decides. `search` matches the name, trading name and email.
+     */
+    async list(query) {
+        const page = query.page;
+        const pageSize = query.page_size;
+        const offset = (page - 1) * pageSize;
+        const trimmedSearch = query.search?.trim();
+        // `order`/`range` return `this`, so the search can be reassigned onto the builder without a
+        // cast. Exact, not estimated, like invoices: there are tens of organizations, not tens of
+        // thousands, and the pager must not offer a page that is not there.
+        let organizationsQuery = this.supabase
+            .from('organizations')
+            .select(ORGANIZATION_LIST_SELECT, { count: 'exact' })
+            .order('created_at', { ascending: false })
+            .range(offset, offset + pageSize - 1);
+        if (trimmedSearch) {
+            organizationsQuery = organizationsQuery.or((0, transforms_1.orIlike)(['name', 'trading_name', 'email'], trimmedSearch));
+        }
+        const { data, error, count } = await organizationsQuery;
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (0, transforms_1.toMmsList)(data, page, pageSize, count);
     }
     /**
      * The whole row, unprojected. Billing reads a different handful of columns for each of its

package/dist/permissions/index.d.ts

@@ -7,6 +7,12 @@ export type PermissionFlags = {
     is_owner: boolean;
     is_admin: boolean;
 } & Record<string, boolean>;
+/**
+ * A guard's flag is interpolated into a select string, so it is checked against the shape a
+ * column name can take first - a flag never comes from a request, only from a route's own
+ * decorator, so anything else is a bug rather than a bad request.
+ */
+export declare const checkPermissionFlag: (flag: string) => void;
 /**
  * The `permissions` table. Rows are created by the `on_auth_user_created` trigger and deleted
  * with the user - INSERT and DELETE are `false` for `authenticated` - so this resource only
@@ -26,10 +32,6 @@ export declare class PermissionsResource {
      * The one lookup `PermissionsGuard` makes per gated request: the flag the route asked for,
      * plus the two that bypass it. Returns null when the caller has no permissions row, which the
      * guard treats as a denial.
-     *
-     * `flag` is interpolated into the select string, so it is checked against the shape a column
-     * name can take first - a flag never comes from a request, only from a route's own decorator,
-     * so anything else is a bug rather than a bad request.
      */
     flagsFor(userId: string, flag: string): Promise<PermissionFlags | null>;
     /** Whether a user owns the organization - the guard behind "you cannot deactivate the owner". */

package/dist/permissions/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PermissionsResource = void 0;
+exports.PermissionsResource = exports.checkPermissionFlag = void 0;
 const enum_1 = require("@managemint-solutions/entities/audit-trail/enum");
 const audit_1 = require("../audit");
 const errors_1 = require("../errors");
@@ -25,6 +25,21 @@ const PERMISSIONS_TABLE = {
     // A permissions change shows in the history of the user it belongs to.
     related: { entityType: enum_1.AuditTrailEntityType.USER, column: 'user_id' },
 };
+/**
+ * A guard's flag is interpolated into a select string, so it is checked against the shape a
+ * column name can take first - a flag never comes from a request, only from a route's own
+ * decorator, so anything else is a bug rather than a bad request.
+ */
+const checkPermissionFlag = (flag) => {
+    if (!/^[a-z][a-z0-9_]*$/.test(flag)) {
+        throw new errors_1.SupabaseClientError({
+            status: 500,
+            error: 'Internal Error',
+            message: 'Invalid permission flag',
+        });
+    }
+};
+exports.checkPermissionFlag = checkPermissionFlag;
 /**
  * The `permissions` table. Rows are created by the `on_auth_user_created` trigger and deleted
  * with the user - INSERT and DELETE are `false` for `authenticated` - so this resource only
@@ -58,19 +73,9 @@ class PermissionsResource {
      * The one lookup `PermissionsGuard` makes per gated request: the flag the route asked for,
      * plus the two that bypass it. Returns null when the caller has no permissions row, which the
      * guard treats as a denial.
-     *
-     * `flag` is interpolated into the select string, so it is checked against the shape a column
-     * name can take first - a flag never comes from a request, only from a route's own decorator,
-     * so anything else is a bug rather than a bad request.
      */
     async flagsFor(userId, flag) {
-        if (!/^[a-z][a-z0-9_]*$/.test(flag)) {
-            throw new errors_1.SupabaseClientError({
-                status: 500,
-                error: 'Internal Error',
-                message: 'Invalid permission flag',
-            });
-        }
+        (0, exports.checkPermissionFlag)(flag);
         const { data, error } = await this.supabase
             .from('permissions')
             .select(`is_owner, is_admin, ${flag}`)

package/dist/projects/dto.d.ts

@@ -1,4 +1,4 @@
-import type { CreateProjectDto as CreateProjectDtoType, GetProjectsDto as GetProjectsDtoType, ProjectIdDto as ProjectIdDtoType, UpdateProjectDto as UpdateProjectDtoType } from '@managemint-solutions/entities/projects/dto';
+import type { CreateProjectDto as CreateProjectDtoType, GetProjectsDto as GetProjectsDtoType, StaffGetProjectsDto as StaffGetProjectsDtoType, ProjectIdDto as ProjectIdDtoType, UpdateProjectDto as UpdateProjectDtoType } from '@managemint-solutions/entities/projects/dto';
 export declare class GetProjectsDto implements Omit<GetProjectsDtoType, 'status_id_in' | 'status_id_not_in'> {
     readonly search?: string | null;
     readonly page: number;
@@ -15,6 +15,10 @@ export declare class GetProjectsDto implements Omit<GetProjectsDtoType, 'status_
     readonly client_id?: string | null;
     readonly archive: boolean;
 }
+/** A staff read across organizations, optionally narrowed to one of them. */
+export declare class StaffGetProjectsDto extends GetProjectsDto implements Omit<StaffGetProjectsDtoType, 'status_id_in' | 'status_id_not_in'> {
+    readonly organization_id?: string | null;
+}
 export declare class ProjectIdDto implements ProjectIdDtoType {
     readonly projectId: string;
 }

package/dist/projects/dto.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UpdateProjectDto = exports.CreateProjectDto = exports.ProjectIdDto = exports.GetProjectsDto = void 0;
+exports.UpdateProjectDto = exports.CreateProjectDto = exports.ProjectIdDto = exports.StaffGetProjectsDto = exports.GetProjectsDto = void 0;
 const class_validator_1 = require("class-validator");
 const class_transformer_1 = require("class-transformer");
 const transforms_1 = require("../transforms");
@@ -132,6 +132,17 @@ __decorate([
     (0, class_validator_1.IsBoolean)({ message: 'Include archived must be a boolean' }),
     __metadata("design:type", Boolean)
 ], GetProjectsDto.prototype, "archive", void 0);
+/** A staff read across organizations, optionally narrowed to one of them. */
+class StaffGetProjectsDto extends GetProjectsDto {
+    organization_id;
+}
+exports.StaffGetProjectsDto = StaffGetProjectsDto;
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsUUID)('7', { message: 'Invalid organization ID format' }),
+    __metadata("design:type", Object)
+], StaffGetProjectsDto.prototype, "organization_id", void 0);
 class ProjectIdDto {
     projectId;
 }

package/dist/projects/index.d.ts

@@ -1,6 +1,6 @@
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { ProjectEntity, ProjectSummary } from '@managemint-solutions/entities/projects';
-import type { AuthContext } from '../auth';
+import type { ClientContext } from '../auth';
 import { EntityAuditTrail, type AuditResource } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { CreateProjectDto, GetProjectsDto, UpdateProjectDto } from './dto';
@@ -11,8 +11,10 @@ export declare class ProjectsResource {
     private readonly table;
     /** This record's history - its own rows and the rows that hang off it. */
     readonly audit: EntityAuditTrail;
-    constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
-    list(query: GetProjectsDto): Promise<MmsList<ProjectSummary>>;
+    constructor(supabase: TypedSupabaseClient, auth: ClientContext, audit: AuditResource);
+    list(query: GetProjectsDto & {
+        organization_id?: string | null;
+    }): Promise<MmsList<ProjectSummary>>;
     getById(projectId: string): Promise<ProjectEntity>;
     create(input: CreateProjectDto): Promise<ProjectEntity>;
     update(projectId: string, input: UpdateProjectDto): Promise<ProjectEntity>;

package/dist/projects/index.js

@@ -18,6 +18,7 @@ exports.ProjectsResource = void 0;
 const enum_1 = require("@managemint-solutions/entities/audit-trail/enum");
 const audit_1 = require("../audit");
 const errors_1 = require("../errors");
+const tenancy_1 = require("../tenancy");
 const transforms_1 = require("../transforms");
 __exportStar(require("./dto"), exports);
 // The public contract is the shared ProjectSummary / ProjectEntity from
@@ -97,14 +98,16 @@ class ProjectsResource {
         const trimmedSearch = query.search?.trim();
         // `order`/`range` return `this`, so the builder stays a filter builder and the conditional
         // filters below can be reassigned onto it without a cast.
-        let projectsQuery = this.supabase
+        let projectsQuery = (0, tenancy_1.scopeToOrganization)(this.supabase
             .from('projects')
-            .select(PROJECT_LIST_SELECT, { count: 'estimated' })
-            .eq('organization_id', this.auth.organization_id)
+            .select((0, tenancy_1.withOrganization)(PROJECT_LIST_SELECT, this.auth), { count: 'estimated' }), this.auth)
             .eq('archived', query.archive)
             .eq('deleted', false)
             .range(offset, offset + pageSize - 1)
             .order('created_at', { ascending: false });
+        if (query.organization_id) {
+            projectsQuery = projectsQuery.eq('organization_id', query.organization_id);
+        }
         if (trimmedSearch) {
             projectsQuery = projectsQuery.or((0, transforms_1.orIlike)(['name', 'specification'], trimmedSearch));
         }
@@ -147,10 +150,7 @@ class ProjectsResource {
         return (0, transforms_1.toMmsList)(data, page, pageSize, count);
     }
     async getById(projectId) {
-        const { data, error } = await this.supabase
-            .from('projects')
-            .select(PROJECT_DETAIL_SELECT)
-            .eq('organization_id', this.auth.organization_id)
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('projects').select(PROJECT_DETAIL_SELECT), this.auth)
             .eq('mms_id', projectId)
             .single();
         if (error)
@@ -182,7 +182,7 @@ class ProjectsResource {
             ...input,
             start_date: (0, transforms_1.toDateInput)(input.start_date),
             end_date: (0, transforms_1.toDateInput)(input.end_date),
-            organization_id: this.auth.organization_id,
+            organization_id: (0, tenancy_1.requireOrganization)(this.auth),
             created_by: this.auth.mms_id,
             created_at: new Date().toISOString(),
         });

package/dist/service-client/index.d.ts

@@ -4,6 +4,7 @@ import { BillingResource } from '../billing';
 import { InvoicesResource } from '../billing/invoices';
 import { ClientsResource } from '../clients';
 import { ConfigsResource } from '../configs';
+import { EmulationHandshakesResource } from '../emulation-handshakes';
 import { FeatureRequestsResource } from '../feature-requests';
 import { LeaveEntitlementsResource, LeaveRequestsResource, LeaveTypesResource } from '../leave';
 import { NotificationsOutboxResource } from '../notifications';
@@ -11,6 +12,8 @@ import { OrganizationInvitesResource } from '../organization-invites';
 import { OrganizationPaymentMethodsResource, type PaymentMethodLookupColumn } from '../organization-payment-methods';
 import { OrganizationsResource, OrganizationSignupResource } from '../organizations';
 import { PermissionsResource } from '../permissions';
+import { StaffPermissionsResource, StaffResource } from '../staff';
+import { UserApiCredentialsResource } from '../user-api-credentials';
 import { UsersResource } from '../users';
 import { WebhookEventsResource } from '../webhook-events';
 export type SupabaseServiceClientConfig = {
@@ -61,7 +64,8 @@ export declare class SupabaseOrganizationScope {
 /**
  * The client for work that has no caller and no RLS context to run under: inbound webhooks
  * (Paystack, Resend, the Supabase `send_email` hook), the notification queue worker, unauthenticated
- * signup, the website's feature-request intake, and the writes RLS reserves for the service role
+ * signup, the website's feature-request intake, the admin api's writes (staff, their flags, user
+ * api credentials, the emulation mint), and the writes RLS reserves for the service role
  * outright - the ledger, the outbox, the webhook event logs, `organizations` INSERT, `permissions`
  * INSERT/DELETE.
  *
@@ -78,7 +82,34 @@ export declare class SupabaseServiceClient {
     readonly signup: OrganizationSignupResource;
     readonly paystackEvents: WebhookEventsResource;
     readonly resendEvents: WebhookEventsResource;
+    readonly staff: StaffResource;
+    readonly staffPermissions: StaffPermissionsResource;
+    readonly userApiCredentials: UserApiCredentialsResource;
+    readonly emulationHandshakes: EmulationHandshakesResource;
     constructor(config: SupabaseServiceClientConfig);
+    /**
+     * A one-time `token_hash` that signs `email` in - the admin api verifies it itself, at once,
+     * through `SupabaseAuthClient.exchangeMagicLinkToken`. Nothing is sent: the link only exists
+     * to be verified.
+     */
+    mintMagicLink(email: string): Promise<{
+        token_hash: string;
+    }>;
+    /**
+     * The auth user behind a staff pre-registration (`staff.preRegister`), confirmed and with the
+     * `staff` role - which is what links the two (`handle_auth_user_role_set`).
+     */
+    createStaffAuthUser(input: {
+        email: string;
+        password: string;
+    }): Promise<{
+        id: string;
+    }>;
+    /**
+     * Bans or unbans an auth user, so a deactivated user or staff member cannot sign in or refresh.
+     * A ban has no "forever" in GoTrue; a hundred years is the usual stand-in.
+     */
+    setAuthUserBanned(userId: string, banned: boolean): Promise<void>;
     /**
      * Scope to one organization once it is known. `actorMmsId` stays `null` for system work -
      * `audit_logs.created_by` is nullable precisely so an unattributed write is still recorded.

package/dist/service-client/index.js

@@ -8,6 +8,7 @@ const billing_1 = require("../billing");
 const invoices_1 = require("../billing/invoices");
 const clients_1 = require("../clients");
 const configs_1 = require("../configs");
+const emulation_handshakes_1 = require("../emulation-handshakes");
 const feature_requests_1 = require("../feature-requests");
 const leave_1 = require("../leave");
 const notifications_1 = require("../notifications");
@@ -16,6 +17,8 @@ const organization_invites_1 = require("../organization-invites");
 const organization_payment_methods_1 = require("../organization-payment-methods");
 const organizations_1 = require("../organizations");
 const permissions_1 = require("../permissions");
+const staff_1 = require("../staff");
+const user_api_credentials_1 = require("../user-api-credentials");
 const users_1 = require("../users");
 const webhook_events_1 = require("../webhook-events");
 /**
@@ -91,7 +94,8 @@ exports.SupabaseOrganizationScope = SupabaseOrganizationScope;
 /**
  * The client for work that has no caller and no RLS context to run under: inbound webhooks
  * (Paystack, Resend, the Supabase `send_email` hook), the notification queue worker, unauthenticated
- * signup, the website's feature-request intake, and the writes RLS reserves for the service role
+ * signup, the website's feature-request intake, the admin api's writes (staff, their flags, user
+ * api credentials, the emulation mint), and the writes RLS reserves for the service role
  * outright - the ledger, the outbox, the webhook event logs, `organizations` INSERT, `permissions`
  * INSERT/DELETE.
  *
@@ -111,6 +115,10 @@ class SupabaseServiceClient {
     signup;
     paystackEvents;
     resendEvents;
+    staff;
+    staffPermissions;
+    userApiCredentials;
+    emulationHandshakes;
     constructor(config) {
         this.config = config;
         this.supabase = (0, auth_1.createRawClient)(config.url, config.serviceRoleKey);
@@ -125,6 +133,51 @@ class SupabaseServiceClient {
             table: 'notifications',
             entityType: enum_1.AuditTrailEntityType.NOTIFICATION,
         }));
+        this.staff = new staff_1.StaffResource(this.supabase);
+        this.staffPermissions = new staff_1.StaffPermissionsResource(this.supabase);
+        this.userApiCredentials = new user_api_credentials_1.UserApiCredentialsResource(this.supabase, (organizationId) => this.forOrganization(organizationId).table({
+            table: 'user_api_credentials',
+            entityType: enum_1.AuditTrailEntityType.USER_API_CREDENTIAL,
+            related: { entityType: enum_1.AuditTrailEntityType.USER, column: 'user_id' },
+        }));
+        this.emulationHandshakes = new emulation_handshakes_1.EmulationHandshakesResource(this.supabase);
+    }
+    /**
+     * A one-time `token_hash` that signs `email` in - the admin api verifies it itself, at once,
+     * through `SupabaseAuthClient.exchangeMagicLinkToken`. Nothing is sent: the link only exists
+     * to be verified.
+     */
+    async mintMagicLink(email) {
+        const { data, error } = await this.supabase.auth.admin.generateLink({ type: 'magiclink', email });
+        if (error)
+            throw (0, errors_1.mapAuthError)(error);
+        return { token_hash: data.properties.hashed_token };
+    }
+    /**
+     * The auth user behind a staff pre-registration (`staff.preRegister`), confirmed and with the
+     * `staff` role - which is what links the two (`handle_auth_user_role_set`).
+     */
+    async createStaffAuthUser(input) {
+        const { data, error } = await this.supabase.auth.admin.createUser({
+            email: input.email,
+            password: input.password,
+            email_confirm: true,
+            role: 'staff',
+        });
+        if (error)
+            throw (0, errors_1.mapAuthError)(error);
+        return { id: data.user.id };
+    }
+    /**
+     * Bans or unbans an auth user, so a deactivated user or staff member cannot sign in or refresh.
+     * A ban has no "forever" in GoTrue; a hundred years is the usual stand-in.
+     */
+    async setAuthUserBanned(userId, banned) {
+        const { error } = await this.supabase.auth.admin.updateUserById(userId, {
+            ban_duration: banned ? '876000h' : 'none',
+        });
+        if (error)
+            throw (0, errors_1.mapAuthError)(error);
     }
     /**
      * Scope to one organization once it is known. `actorMmsId` stays `null` for system work -

package/dist/staff/dto.d.ts

@@ -0,0 +1,14 @@
+import type { CreateStaffDto as CreateStaffDtoType, StaffIdDto as StaffIdDtoType, UpdateStaffPermissionsDto as UpdateStaffPermissionsDtoType } from '@managemint-solutions/entities/staff/dto';
+import { UpdatePermissionsDto } from '../permissions/dto';
+export declare class StaffIdDto implements StaffIdDtoType {
+    readonly staffId: string;
+}
+export declare class CreateStaffDto implements CreateStaffDtoType {
+    readonly email: string;
+    readonly name: string;
+    readonly password: string;
+}
+export declare class UpdateStaffPermissionsDto extends UpdatePermissionsDto implements UpdateStaffPermissionsDtoType {
+    readonly is_admin: boolean;
+    readonly view_dashboard: boolean;
+}

package/dist/staff/dto.js

@@ -0,0 +1,63 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UpdateStaffPermissionsDto = exports.CreateStaffDto = exports.StaffIdDto = void 0;
+const class_validator_1 = require("class-validator");
+const dto_1 = require("../permissions/dto");
+const validators_1 = require("../validators");
+class StaffIdDto {
+    // v4: a staff member's `mms_id` is their GoTrue auth uid, as a user's is (see UserIdDto).
+    staffId;
+}
+exports.StaffIdDto = StaffIdDto;
+__decorate([
+    (0, class_validator_1.IsUUID)('4', { message: 'Invalid staff ID format' }),
+    __metadata("design:type", String)
+], StaffIdDto.prototype, "staffId", void 0);
+// The email and password rules are AddUserDto's: a staff member is a GoTrue user like any other.
+class CreateStaffDto {
+    email;
+    name;
+    password;
+}
+exports.CreateStaffDto = CreateStaffDto;
+__decorate([
+    (0, class_validator_1.IsEmail)({}, { message: 'Invalid email address' }),
+    __metadata("design:type", String)
+], CreateStaffDto.prototype, "email", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Name is required' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Name is required' }),
+    (0, class_validator_1.MaxLength)(100, { message: 'Name cannot be longer than 100 characters' }),
+    __metadata("design:type", String)
+], CreateStaffDto.prototype, "name", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Password is required' }),
+    (0, class_validator_1.MinLength)(8, { message: 'Password must be at least 8 characters' }),
+    (0, validators_1.MatchesPasswordRules)(),
+    __metadata("design:type", String)
+], CreateStaffDto.prototype, "password", void 0);
+// The tenant flag set plus the two columns a staff row carries that it leaves out: admin, which
+// staff grant through the api (the service refuses self), and the dashboard flag, so a row read
+// back from GET can be sent as is. There is no owner.
+class UpdateStaffPermissionsDto extends dto_1.UpdatePermissionsDto {
+    is_admin;
+    view_dashboard;
+}
+exports.UpdateStaffPermissionsDto = UpdateStaffPermissionsDto;
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Admin must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdateStaffPermissionsDto.prototype, "is_admin", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'View Dashboard must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdateStaffPermissionsDto.prototype, "view_dashboard", void 0);

package/dist/staff/index.d.ts

@@ -0,0 +1,50 @@
+import type { StaffEntity, StaffPermissionsEntity } from '@managemint-solutions/entities/staff';
+import type { UpdateStaffPermissionsDto } from '@managemint-solutions/entities/staff/dto';
+import type { TypedSupabaseClient } from '../client';
+export * from './dto';
+/** Admin bypasses every individual flag, so the guard reads both at once. */
+type StaffPermissionFlags = {
+    is_admin: boolean;
+} & Record<string, boolean>;
+/**
+ * The `staff` table. Staff read it on their own client; every write is the service role's (staff
+ * hold SELECT only), so `preRegister`, `removePending` and `setActive` belong to the service
+ * client. Unaudited: an `audit_logs` row belongs to an organization, and staff have none.
+ */
+export declare class StaffResource {
+    private readonly supabase;
+    constructor(supabase: TypedSupabaseClient);
+    /** Every staff member, by name. A pending pre-registration is not one yet. */
+    list(): Promise<StaffEntity[]>;
+    getById(staffId: string): Promise<StaffEntity>;
+    /**
+     * The address, written before its auth user exists - the first half of creating a staff
+     * member. `mms_id` stays null until GoTrue creates the auth user with the `staff` role and
+     * `handle_auth_user_role_set` links the two.
+     */
+    preRegister(input: {
+        email: string;
+        name: string;
+        created_by: string;
+    }): Promise<void>;
+    /** Undoes a pre-registration whose auth user was never created. A linked row is never touched. */
+    removePending(email: string): Promise<void>;
+    /** Deactivates, stamping who and when, or reactivates, clearing them. */
+    setActive(staffId: string, active: boolean, by: string): Promise<StaffEntity>;
+}
+/**
+ * The `staff_permissions` table: one row per staff member, made by the role trigger alongside
+ * the link. Staff read it on their own client; `updateForStaff` is the service client's.
+ */
+export declare class StaffPermissionsResource {
+    private readonly supabase;
+    constructor(supabase: TypedSupabaseClient);
+    /**
+     * The one lookup the admin api's guard makes per gated request: the flag the route asked for,
+     * plus the admin bypass. Null when there is no row, which the guard treats as a denial.
+     */
+    flagsFor(staffId: string, flag: string): Promise<StaffPermissionFlags | null>;
+    /** The whole row. `*`: every flag, so a new flag column needs no select edit. */
+    getForStaff(staffId: string): Promise<StaffPermissionsEntity>;
+    updateForStaff(staffId: string, patch: UpdateStaffPermissionsDto, by: string): Promise<StaffPermissionsEntity>;
+}