@managemint-solutions/sdk 0.53.0 → 0.54.0

package/dist/user-api-credentials/index.js

@@ -0,0 +1,101 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserApiCredentialsResource = exports.UserApiCredentialsReads = void 0;
+const audit_1 = require("../audit");
+const errors_1 = require("../errors");
+__exportStar(require("./dto"), exports);
+// Exactly the columns the staff grant covers: never `secret_hash`, which only the mint reads.
+const CREDENTIAL_SELECT = 'mms_id, user_id, organization_id, client_id, label, created_at, created_by, expires_at, revoked_at, revoked_by, last_used_at';
+/** A written row as a reader sees it: without the secret hash. */
+const toCredential = (row) => {
+    const { secret_hash: _secretHash, ...credential } = row;
+    return credential;
+};
+/**
+ * Credentials as staff read them, on their own client, through the column grant that leaves the
+ * secret hash out. Tenant users have no grant at all.
+ */
+class UserApiCredentialsReads {
+    supabase;
+    constructor(supabase) {
+        this.supabase = supabase;
+    }
+    /** A user's credentials, newest first. */
+    async listForUser(userId) {
+        const { data, error } = await this.supabase
+            .from('user_api_credentials')
+            .select(CREDENTIAL_SELECT)
+            .eq('user_id', userId)
+            .order('created_at', { ascending: false });
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? []);
+    }
+}
+exports.UserApiCredentialsReads = UserApiCredentialsReads;
+/**
+ * The writes and the secret check, on the service client only: every write is the service
+ * role's, and nobody else may read the hash. A credential's writes are audited against its own
+ * organization as the system - the staff member who issued or revoked it is on the row itself
+ * (`created_by`, `revoked_by`), and is not a user an audit row can name.
+ */
+class UserApiCredentialsResource {
+    supabase;
+    tableFor;
+    constructor(supabase, tableFor) {
+        this.supabase = supabase;
+        this.tableFor = tableFor;
+    }
+    /** Issues a credential. Its `secret_hash` is redacted in the audit row and never returned. */
+    async create(row) {
+        return toCredential(await this.tableFor(row.organization_id).insert(row));
+    }
+    /** The credential a client id names, with its secret hash. Null when none does. */
+    async findByClientId(clientId) {
+        const { data, error } = await this.supabase
+            .from('user_api_credentials')
+            .select('*')
+            .eq('client_id', clientId)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data ? (0, audit_1.withoutInternalId)(data) : null;
+    }
+    /** Revokes a live credential. Null when it was revoked already. */
+    async revoke(credentialId, revokedBy) {
+        // The audited table is the credential's organization's, so that is read first.
+        const { data, error } = await this.supabase
+            .from('user_api_credentials')
+            .select('organization_id')
+            .eq('mms_id', credentialId)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        const row = await this.tableFor(data.organization_id).updateWhere(credentialId, (query) => query.is('revoked_at', null), { revoked_at: new Date().toISOString(), revoked_by: revokedBy });
+        return row ? toCredential(row) : null;
+    }
+    /** Stamps a successful mint, unaudited: when it was last used, not a change to the credential. */
+    async markUsed(credentialId) {
+        const { error } = await this.supabase
+            .from('user_api_credentials')
+            .update({ last_used_at: new Date().toISOString() })
+            .eq('mms_id', credentialId);
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+    }
+}
+exports.UserApiCredentialsResource = UserApiCredentialsResource;

package/dist/users/dto.d.ts

@@ -1,4 +1,4 @@
-import type { CreateUserDto as CreateUserDtoType, GetUsersDto as GetUsersDtoType, UpdateMyProfileDto as UpdateMyProfileDtoType, UpdateUserDto as UpdateUserDtoType, UserIdDto as UserIdDtoType } from '@managemint-solutions/entities/users/dto';
+import type { CreateUserDto as CreateUserDtoType, GetUsersDto as GetUsersDtoType, StaffGetUsersDto as StaffGetUsersDtoType, UpdateMyProfileDto as UpdateMyProfileDtoType, UpdateUserDto as UpdateUserDtoType, UserIdDto as UserIdDtoType } from '@managemint-solutions/entities/users/dto';
 import { EmergencyContactRelationship, EmploymentType } from '@managemint-solutions/entities/users/enum';
 export declare class UserIdDto implements UserIdDtoType {
     readonly userId: string;
@@ -28,6 +28,10 @@ export declare class GetUsersQueryDto implements Omit<GetUsersDtoType, 'active_i
     readonly active_in?: boolean[] | null;
     readonly manager_id?: string | null;
 }
+/** A staff read across organizations, optionally narrowed to one of them. */
+export declare class StaffGetUsersDto extends GetUsersQueryDto implements Omit<StaffGetUsersDtoType, 'active_in'> {
+    readonly organization_id?: string | null;
+}
 export declare class UpdateUserDto implements UpdateUserDtoType {
     readonly name: string;
     readonly surname: string;

package/dist/users/dto.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UpdateMyProfileDto = exports.UpdateUserDto = exports.GetUsersQueryDto = exports.AddUserDto = exports.UserIdDto = void 0;
+exports.UpdateMyProfileDto = exports.UpdateUserDto = exports.StaffGetUsersDto = exports.GetUsersQueryDto = exports.AddUserDto = exports.UserIdDto = void 0;
 const class_validator_1 = require("class-validator");
 const class_transformer_1 = require("class-transformer");
 const validators_1 = require("../validators");
@@ -51,7 +51,7 @@ __decorate([
 __decorate([
     (0, class_validator_1.IsString)({ message: 'Password is required' }),
     (0, class_validator_1.MinLength)(8, { message: 'Password must be at least 8 characters' }),
-    (0, class_validator_1.Matches)(/^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[!@#$%^&*])/, { message: 'Password must contain at least 1 uppercase letter, 1 lowercase letter, 1 number, and 1 special character (!@#$%^&*)' }),
+    (0, validators_1.MatchesPasswordRules)(),
     __metadata("design:type", String)
 ], AddUserDto.prototype, "password", void 0);
 __decorate([
@@ -134,6 +134,17 @@ __decorate([
     (0, class_validator_1.IsUUID)('4', { message: 'Invalid manager ID format' }),
     __metadata("design:type", Object)
 ], GetUsersQueryDto.prototype, "manager_id", void 0);
+/** A staff read across organizations, optionally narrowed to one of them. */
+class StaffGetUsersDto extends GetUsersQueryDto {
+    organization_id;
+}
+exports.StaffGetUsersDto = StaffGetUsersDto;
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsUUID)('7', { message: 'Invalid organization ID format' }),
+    __metadata("design:type", Object)
+], StaffGetUsersDto.prototype, "organization_id", void 0);
 class UpdateUserDto {
     name;
     surname;

package/dist/users/index.d.ts

@@ -1,6 +1,6 @@
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { UserIdentity, UserSummary } from '@managemint-solutions/entities/users';
-import { type AuditActor, type AuditResource, type AuditRow, EntityAuditTrail } from '../audit';
+import { type AuditResource, type AuditRow, EntityAuditTrail, type ResourceActor } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { GetUsersQueryDto } from './dto';
 export * from './dto';
@@ -26,8 +26,10 @@ export declare class UsersResource {
     private readonly table;
     /** This record's history - its own rows and the rows that hang off it. */
     readonly audit: EntityAuditTrail;
-    constructor(supabase: TypedSupabaseClient, auth: AuditActor, audit: AuditResource);
-    list(query: GetUsersQueryDto): Promise<MmsList<UserSummary>>;
+    constructor(supabase: TypedSupabaseClient, auth: ResourceActor, audit: AuditResource);
+    list(query: GetUsersQueryDto & {
+        organization_id?: string | null;
+    }): Promise<MmsList<UserSummary>>;
     getRow(userId: string): Promise<UserRow>;
     /**
      * The public profile behind a `*_by` / `manager_id` column. `user_profiles` is a

package/dist/users/index.js

@@ -20,6 +20,7 @@ const working_days_1 = require("../leave/working-days");
 const audit_1 = require("../audit");
 const errors_1 = require("../errors");
 const paths_1 = require("../supporting-files/paths");
+const tenancy_1 = require("../tenancy");
 const transforms_1 = require("../transforms");
 const paths_2 = require("./paths");
 __exportStar(require("./dto"), exports);
@@ -48,12 +49,14 @@ class UsersResource {
         const trimmedSearch = query.search?.trim();
         // `order`/`range` return `this`, so the builder stays a filter builder and the conditional
         // filters below can be reassigned onto it without a cast.
-        let usersQuery = this.supabase
+        let usersQuery = (0, tenancy_1.scopeToOrganization)(this.supabase
             .from('users')
-            .select(USER_LIST_SELECT, { count: 'estimated' })
-            .eq('organization_id', this.auth.organization_id)
+            .select((0, tenancy_1.withOrganization)(USER_LIST_SELECT, this.auth), { count: 'estimated' }), this.auth)
             .order('created_at', { ascending: false })
             .range(offset, offset + pageSize - 1);
+        if (query.organization_id) {
+            usersQuery = usersQuery.eq('organization_id', query.organization_id);
+        }
         // No filter shows everyone: inactive users must stay reachable so they can
         // be reactivated from their detail page.
         if (query.active_in && query.active_in.length > 0) {
@@ -72,12 +75,7 @@ class UsersResource {
         return (0, transforms_1.toMmsList)(data, page, pageSize, count);
     }
     async getRow(userId) {
-        const { data, error } = await this.supabase
-            .from('users')
-            .select('*')
-            .eq('mms_id', userId)
-            .eq('organization_id', this.auth.organization_id)
-            .single();
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('users').select('*').eq('mms_id', userId), this.auth).single();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
         return (0, audit_1.withoutInternalId)(data);
@@ -106,11 +104,7 @@ class UsersResource {
      * `active` is not consulted: a deactivated report's history stays visible to their manager.
      */
     async idsManagedBy(managerId) {
-        const { data, error } = await this.supabase
-            .from('users')
-            .select('mms_id')
-            .eq('organization_id', this.auth.organization_id)
-            .or(`manager_id.eq.${managerId},secondary_manager_id.eq.${managerId}`);
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('users').select('mms_id'), this.auth).or(`manager_id.eq.${managerId},secondary_manager_id.eq.${managerId}`);
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
         return (data ?? []).map((row) => row.mms_id);
@@ -120,10 +114,9 @@ class UsersResource {
      * are timestamps), and the working week. Everyone in the organization, or just `userIds`.
      */
     async employment(userIds) {
-        let employmentQuery = this.supabase
+        let employmentQuery = (0, tenancy_1.scopeToOrganization)(this.supabase
             .from('users')
-            .select('mms_id, name, surname, email, profile_image, active, start_date, end_date, working_days')
-            .eq('organization_id', this.auth.organization_id);
+            .select('mms_id, name, surname, email, profile_image, active, start_date, end_date, working_days'), this.auth);
         if (userIds) {
             employmentQuery = employmentQuery.in('mms_id', userIds);
         }
@@ -138,22 +131,13 @@ class UsersResource {
     }
     /** Seats in use. Counts rows rather than fetching them. */
     async activeCount() {
-        const { count, error } = await this.supabase
-            .from('users')
-            .select('mms_id', { count: 'exact', head: true })
-            .eq('organization_id', this.auth.organization_id)
-            .eq('active', true);
+        const { count, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('users').select('mms_id', { count: 'exact', head: true }), this.auth).eq('active', true);
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
         return count ?? 0;
     }
     async isActive(userId) {
-        const { data, error } = await this.supabase
-            .from('users')
-            .select('active')
-            .eq('mms_id', userId)
-            .eq('organization_id', this.auth.organization_id)
-            .single();
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('users').select('active').eq('mms_id', userId), this.auth).single();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
         return data.active;
@@ -179,7 +163,7 @@ class UsersResource {
      */
     async setProfileImage(userId, file) {
         const { name, extension } = (0, paths_1.splitFileName)((0, paths_1.sanitizeFileName)(file.name));
-        const path = (0, paths_2.profileImagePath)(this.auth.organization_id, userId, name, extension);
+        const path = (0, paths_2.profileImagePath)((0, tenancy_1.requireOrganization)(this.auth), userId, name, extension);
         const previous = (0, paths_2.profileImageObjectPath)((await this.getRow(userId)).profile_image);
         const { error } = await this.supabase.storage
             .from(paths_2.PROFILE_PICTURES_BUCKET)

package/dist/validators.d.ts

@@ -17,6 +17,8 @@ export declare const isClockTime: (value: unknown, allowEndOfDay?: boolean) => v
 export declare const IsClockTime: ({ allowEndOfDay, ...options }?: ValidationOptions & {
     allowEndOfDay?: boolean;
 }) => PropertyDecorator;
+/** The password rules every GoTrue account is held to: a tenant user's and a staff member's. */
+export declare const MatchesPasswordRules: () => PropertyDecorator;
 export declare function IsNullable(validationOptions?: ValidationOptions): PropertyDecorator;
 /**
  * An empty string from a cleared form field means "none". It becomes null before validation,

package/dist/validators.js

@@ -6,7 +6,7 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IsClockTime = exports.isClockTime = exports.IsCalendarDate = exports.isCalendarDate = void 0;
+exports.MatchesPasswordRules = exports.IsClockTime = exports.isClockTime = exports.IsCalendarDate = exports.isCalendarDate = void 0;
 exports.IsNullable = IsNullable;
 exports.EmptyToNull = EmptyToNull;
 const class_validator_1 = require("class-validator");
@@ -56,6 +56,11 @@ ClockTimeConstraint = __decorate([
  */
 const IsClockTime = ({ allowEndOfDay = false, ...options } = {}) => (0, class_validator_1.Validate)(ClockTimeConstraint, [allowEndOfDay], options);
 exports.IsClockTime = IsClockTime;
+/** The password rules every GoTrue account is held to: a tenant user's and a staff member's. */
+const MatchesPasswordRules = () => (0, class_validator_1.Matches)(/^(?=.*[A-Z])(?=.*[a-z])(?=.*\d)(?=.*[!@#$%^&*])/, {
+    message: 'Password must contain at least 1 uppercase letter, 1 lowercase letter, 1 number, and 1 special character (!@#$%^&*)',
+});
+exports.MatchesPasswordRules = MatchesPasswordRules;
 function IsNullable(validationOptions) {
     return (0, class_validator_1.ValidateIf)((_object, value) => value !== null, validationOptions);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@managemint-solutions/sdk",
-  "version": "0.53.0",
+  "version": "0.54.0",
   "description": "Typed Supabase data-access SDK for ManageMint Solutions",
   "license": "UNLICENSED",
   "author": "Scott Bebington <scottbebington@gmail.com>",
@@ -51,7 +51,7 @@
     "testEnvironment": "node"
   },
   "dependencies": {
-    "@managemint-solutions/entities": "^1.35.0"
+    "@managemint-solutions/entities": "^1.36.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11.0.0",