@managemint-solutions/sdk 0.54.0 → 0.56.0

package/dist/clients/index.js

@@ -121,15 +121,17 @@ class ClientsResource {
         return (0, transforms_1.toMmsList)(data, page, pageSize, count);
     }
     async getById(clientId) {
-        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('clients').select(CLIENT_DETAIL_SELECT), this.auth)
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('clients').select((0, tenancy_1.withOrganization)(CLIENT_DETAIL_SELECT, this.auth)), this.auth)
             .eq('mms_id', clientId)
             .single();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
+        // The select carries the staff embed, so its row type is not inferred from the string.
+        const row = data;
         // A soft-deleted client keeps its audit trail but gives up its details.
-        if (data.deleted) {
+        if (row.deleted) {
             return {
-                ...data,
+                ...row,
                 name: '',
                 email: '',
                 phone: '',

package/dist/emulation-handshakes/index.d.ts

@@ -6,8 +6,11 @@ import type { TypedSupabaseClient } from '../client';
 export declare class EmulationHandshakesResource {
     private readonly supabase;
     constructor(supabase: TypedSupabaseClient);
-    /** Opens a handshake for `userId`'s next sign-in, good for thirty seconds. Returns its id. */
-    open(userId: string, credentialId: string): Promise<number>;
+    /**
+     * Opens a handshake for `userId`'s next sign-in, good for thirty seconds. Returns its id. The
+     * credential is the one a public mint presented; a staff member's own mint has none.
+     */
+    open(userId: string, credentialId: string | null): Promise<number>;
     /** Deletes the handshake, spent or not, once the mint is over. */
     close(id: number): Promise<void>;
 }

package/dist/emulation-handshakes/index.js

@@ -11,7 +11,10 @@ class EmulationHandshakesResource {
     constructor(supabase) {
         this.supabase = supabase;
     }
-    /** Opens a handshake for `userId`'s next sign-in, good for thirty seconds. Returns its id. */
+    /**
+     * Opens a handshake for `userId`'s next sign-in, good for thirty seconds. Returns its id. The
+     * credential is the one a public mint presented; a staff member's own mint has none.
+     */
     async open(userId, credentialId) {
         const { data, error } = await this.supabase
             .from('emulation_handshakes')

package/dist/leads/index.js

@@ -165,16 +165,18 @@ class LeadsResource {
         return (0, transforms_1.toMmsList)(data, page, pageSize, count);
     }
     async getById(leadId) {
-        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('leads').select(LEAD_DETAIL_SELECT), this.auth)
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('leads').select((0, tenancy_1.withOrganization)(LEAD_DETAIL_SELECT, this.auth)), this.auth)
             .eq('mms_id', leadId)
             .single();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
+        // The select carries the staff embed, so its row type is not inferred from the string.
+        const row = data;
         // A soft-deleted lead keeps its audit trail but gives up its details. The client it became
         // stays, so a converted lead can still point at it.
-        if (data.deleted) {
+        if (row.deleted) {
             return {
-                ...data,
+                ...row,
                 name: '',
                 contact_person: null,
                 email: '',

package/dist/notes/index.d.ts

@@ -1,7 +1,7 @@
 import type { NoteEntity } from '@managemint-solutions/entities/notes';
 import type { AddNoteDto } from '@managemint-solutions/entities/notes/dto';
 import { NotesEntityTypes } from '@managemint-solutions/entities/notes/enum';
-import type { AuthContext } from '../auth';
+import type { ClientContext } from '../auth';
 import { type AuditResource } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 export * from './dto';
@@ -9,7 +9,7 @@ export declare class NotesResource {
     private readonly supabase;
     private readonly auth;
     private readonly table;
-    constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
+    constructor(supabase: TypedSupabaseClient, auth: ClientContext, audit: AuditResource);
     getById(noteId: string): Promise<NoteEntity>;
     list(entity: NotesEntityTypes, entityId: string): Promise<NoteEntity[]>;
     create(entity: NotesEntityTypes, entityId: string, input: AddNoteDto): Promise<NoteEntity>;

package/dist/notes/index.js

@@ -20,6 +20,7 @@ const enum_2 = require("@managemint-solutions/entities/audit-trail/enum");
 const audit_1 = require("../audit");
 const errors_1 = require("../errors");
 const won_1 = require("../leads/won");
+const tenancy_1 = require("../tenancy");
 __exportStar(require("./dto"), exports);
 // The public contract is the shared NoteEntity from @managemint-solutions/entities; the casts at
 // the returns declare the shape the select string below produces (the columns are defined in the
@@ -38,10 +39,7 @@ class NotesResource {
         });
     }
     async getById(noteId) {
-        const { data, error } = await this.supabase
-            .from('notes')
-            .select(NOTE_SELECT)
-            .eq('organization_id', this.auth.organization_id)
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('notes').select(NOTE_SELECT), this.auth)
             .eq('mms_id', noteId)
             .single();
         if (error)
@@ -49,10 +47,7 @@ class NotesResource {
         return data;
     }
     async list(entity, entityId) {
-        const { data, error } = await this.supabase
-            .from('notes')
-            .select(NOTE_SELECT)
-            .eq('organization_id', this.auth.organization_id)
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('notes').select(NOTE_SELECT), this.auth)
             .eq('entity_type', entity)
             .eq('entity_id', entityId)
             .order('created_at', { ascending: false });
@@ -61,14 +56,15 @@ class NotesResource {
         return data;
     }
     async create(entity, entityId, input) {
+        const organizationId = (0, tenancy_1.requireOrganization)(this.auth);
         if (entity === enum_1.NotesEntityTypes.LEAD) {
-            await (0, won_1.refuseWonLead)(this.supabase, this.auth.organization_id, entityId);
+            await (0, won_1.refuseWonLead)(this.supabase, organizationId, entityId);
         }
         const row = await this.table.insert({
             content: input.content,
             entity_type: entity,
             entity_id: entityId,
-            organization_id: this.auth.organization_id,
+            organization_id: organizationId,
             user_id: this.auth.mms_id,
         });
         return this.getById(row.mms_id);

package/dist/projects/index.js

@@ -150,15 +150,17 @@ class ProjectsResource {
         return (0, transforms_1.toMmsList)(data, page, pageSize, count);
     }
     async getById(projectId) {
-        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('projects').select(PROJECT_DETAIL_SELECT), this.auth)
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('projects').select((0, tenancy_1.withOrganization)(PROJECT_DETAIL_SELECT, this.auth)), this.auth)
             .eq('mms_id', projectId)
             .single();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
+        // The select carries the staff embed, so its row type is not inferred from the string.
+        const row = data;
         // A soft-deleted project keeps its creation audit but gives up its details.
-        if (data.deleted) {
+        if (row.deleted) {
             return {
-                ...data,
+                ...row,
                 name: '',
                 specification: null,
                 has_budget: false,

package/dist/service-client/index.d.ts

@@ -13,6 +13,7 @@ import { OrganizationPaymentMethodsResource, type PaymentMethodLookupColumn } fr
 import { OrganizationsResource, OrganizationSignupResource } from '../organizations';
 import { PermissionsResource } from '../permissions';
 import { StaffPermissionsResource, StaffResource } from '../staff';
+import { SupportingFilesResource } from '../supporting-files';
 import { UserApiCredentialsResource } from '../user-api-credentials';
 import { UsersResource } from '../users';
 import { WebhookEventsResource } from '../webhook-events';
@@ -41,6 +42,8 @@ export declare class SupabaseOrganizationScope {
     readonly organizations: OrganizationsResource;
     readonly paymentMethod: OrganizationPaymentMethodsResource;
     readonly permissions: PermissionsResource;
+    /** For the admin api's staff downloads: Storage's read policy names no staff, the service role passes it. */
+    readonly supportingFiles: SupportingFilesResource;
     readonly users: UsersResource;
     constructor(supabase: TypedSupabaseClient, actor: AuditActor, onAuditError?: AuditErrorHandler);
     /**

package/dist/service-client/index.js

@@ -18,6 +18,7 @@ const organization_payment_methods_1 = require("../organization-payment-methods"
 const organizations_1 = require("../organizations");
 const permissions_1 = require("../permissions");
 const staff_1 = require("../staff");
+const supporting_files_1 = require("../supporting-files");
 const user_api_credentials_1 = require("../user-api-credentials");
 const users_1 = require("../users");
 const webhook_events_1 = require("../webhook-events");
@@ -39,6 +40,8 @@ class SupabaseOrganizationScope {
     organizations;
     paymentMethod;
     permissions;
+    /** For the admin api's staff downloads: Storage's read policy names no staff, the service role passes it. */
+    supportingFiles;
     users;
     constructor(supabase, actor, onAuditError) {
         this.supabase = supabase;
@@ -54,6 +57,7 @@ class SupabaseOrganizationScope {
         this.organizations = new organizations_1.OrganizationsResource(supabase, actor, this.audit);
         this.paymentMethod = new organization_payment_methods_1.OrganizationPaymentMethodsResource(supabase, actor);
         this.permissions = new permissions_1.PermissionsResource(supabase, actor, this.audit);
+        this.supportingFiles = new supporting_files_1.SupportingFilesResource(supabase, actor, this.audit);
         this.users = new users_1.UsersResource(supabase, actor, this.audit);
     }
     /**

package/dist/staff-client.d.ts

@@ -1,11 +1,14 @@
 import { type StaffContext } from './auth';
 import { AuditResource } from './audit';
+import { AdditionalDetailsResource } from './additional-details';
 import type { SupabaseClientConfig, TypedSupabaseClient } from './client';
 import { ClientsResource } from './clients';
 import { LeadsResource } from './leads';
+import { NotesResource } from './notes';
 import { OrganizationsResource } from './organizations';
 import { ProjectsResource } from './projects';
 import { StaffPermissionsResource, StaffResource } from './staff';
+import { SupportingFilesResource } from './supporting-files';
 import { TasksResource } from './tasks';
 import { UserApiCredentialsReads } from './user-api-credentials';
 import { UsersResource } from './users';
@@ -22,14 +25,18 @@ export declare class SupabaseStaffClient {
     /** The staff member the token belongs to - the caller, for a service that records who acted. */
     readonly auth: StaffContext;
     readonly audit: AuditResource;
+    readonly additionalDetails: AdditionalDetailsResource;
     readonly clients: ClientsResource;
     readonly leads: LeadsResource;
+    readonly notes: NotesResource;
     readonly projects: ProjectsResource;
     readonly tasks: TasksResource;
     readonly users: UsersResource;
     readonly organizations: OrganizationsResource;
     readonly staff: StaffResource;
     readonly staffPermissions: StaffPermissionsResource;
+    /** Lists and parents only: Storage names no staff, so a download is signed on the service client. */
+    readonly supportingFiles: SupportingFilesResource;
     readonly userApiCredentials: UserApiCredentialsReads;
     constructor({ url, key, accessToken, auth, client }: SupabaseStaffClientConfig);
 }

package/dist/staff-client.js

@@ -6,9 +6,11 @@ const audit_1 = require("./audit");
 const additional_details_1 = require("./additional-details");
 const clients_1 = require("./clients");
 const leads_1 = require("./leads");
+const notes_1 = require("./notes");
 const organizations_1 = require("./organizations");
 const projects_1 = require("./projects");
 const staff_1 = require("./staff");
+const supporting_files_1 = require("./supporting-files");
 const tasks_1 = require("./tasks");
 const user_api_credentials_1 = require("./user-api-credentials");
 const users_1 = require("./users");
@@ -22,28 +24,34 @@ class SupabaseStaffClient {
     /** The staff member the token belongs to - the caller, for a service that records who acted. */
     auth;
     audit;
+    additionalDetails;
     clients;
     leads;
+    notes;
     projects;
     tasks;
     users;
     organizations;
     staff;
     staffPermissions;
+    /** Lists and parents only: Storage names no staff, so a download is signed on the service client. */
+    supportingFiles;
     userApiCredentials;
     constructor({ url, key, accessToken, auth, client }) {
         this.supabase = client ?? (0, auth_1.createRawClient)(url, key, accessToken);
         this.auth = auth;
         this.audit = new audit_1.AuditResource(this.supabase, auth);
         this.clients = new clients_1.ClientsResource(this.supabase, auth, this.audit);
-        const additionalDetails = new additional_details_1.AdditionalDetailsResource(this.supabase, auth, this.audit);
-        this.leads = new leads_1.LeadsResource(this.supabase, auth, this.audit, additionalDetails);
+        this.additionalDetails = new additional_details_1.AdditionalDetailsResource(this.supabase, auth, this.audit);
+        this.leads = new leads_1.LeadsResource(this.supabase, auth, this.audit, this.additionalDetails);
+        this.notes = new notes_1.NotesResource(this.supabase, auth, this.audit);
         this.projects = new projects_1.ProjectsResource(this.supabase, auth, this.audit);
         this.tasks = new tasks_1.TasksResource(this.supabase, auth, this.audit);
         this.users = new users_1.UsersResource(this.supabase, auth, this.audit);
         this.organizations = new organizations_1.OrganizationsResource(this.supabase, auth, this.audit);
         this.staff = new staff_1.StaffResource(this.supabase);
         this.staffPermissions = new staff_1.StaffPermissionsResource(this.supabase);
+        this.supportingFiles = new supporting_files_1.SupportingFilesResource(this.supabase, auth, this.audit);
         this.userApiCredentials = new user_api_credentials_1.UserApiCredentialsReads(this.supabase);
     }
 }

package/dist/supporting-files/index.d.ts

@@ -1,7 +1,6 @@
 import type { SupportingFileEntity, SupportingFilePresignedUrl, SupportingFileUploadTarget } from '@managemint-solutions/entities/supporting-files';
 import { SupportingFilesEntityTypes } from '@managemint-solutions/entities/supporting-files/enum';
-import type { AuthContext } from '../auth';
-import { type AuditResource } from '../audit';
+import { type AuditResource, type ResourceActor } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 export * from './dto';
 export * from './paths';
@@ -9,12 +8,21 @@ export declare class SupportingFilesResource {
     private readonly supabase;
     private readonly auth;
     private readonly table;
-    constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
+    constructor(supabase: TypedSupabaseClient, auth: ResourceActor, audit: AuditResource);
+    /**
+     * A short-lived download link. Storage checks the bucket's read policy as this client's
+     * caller, which names no staff - the admin api signs on the service client's organization
+     * scope instead.
+     */
     getPresignedUrl(supportingFileId: string): Promise<SupportingFilePresignedUrl>;
-    /** The record a file hangs off - what the api checks the caller can reach before a download or delete. */
+    /**
+     * The record a file hangs off, and its organization - what the api checks the caller can
+     * reach before a download or delete.
+     */
     getParent(supportingFileId: string): Promise<{
         entity_type: SupportingFilesEntityTypes;
         entity_id: string;
+        organization_id: string;
     }>;
     list(entity: SupportingFilesEntityTypes, entityId: string): Promise<SupportingFileEntity[]>;
     /**

package/dist/supporting-files/index.js

@@ -20,6 +20,7 @@ const enum_2 = require("@managemint-solutions/entities/audit-trail/enum");
 const audit_1 = require("../audit");
 const errors_1 = require("../errors");
 const won_1 = require("../leads/won");
+const tenancy_1 = require("../tenancy");
 const paths_1 = require("./paths");
 __exportStar(require("./dto"), exports);
 __exportStar(require("./paths"), exports);
@@ -60,41 +61,40 @@ class SupportingFilesResource {
             entityType: enum_2.AuditTrailEntityType.SUPPORTING_FILES,
         });
     }
+    /**
+     * A short-lived download link. Storage checks the bucket's read policy as this client's
+     * caller, which names no staff - the admin api signs on the service client's organization
+     * scope instead.
+     */
     async getPresignedUrl(supportingFileId) {
-        const { data, error } = await this.supabase
-            .from('supporting_files')
-            .select('name, extension, entity_type, entity_id')
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('supporting_files').select('organization_id, name, extension, entity_type, entity_id'), this.auth)
             .eq('mms_id', supportingFileId)
-            .eq('organization_id', this.auth.organization_id)
             .single();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
         const { data: signed, error: signedError } = await this.supabase.storage
             .from(BUCKET)
-            .createSignedUrl((0, paths_1.storagePath)(this.auth.organization_id, data.entity_type, data.entity_id, data.name, data.extension), SIGNED_URL_TTL_SECONDS);
+            .createSignedUrl((0, paths_1.storagePath)(data.organization_id, data.entity_type, data.entity_id, data.name, data.extension), SIGNED_URL_TTL_SECONDS);
         if (signedError)
             throw (0, errors_1.mapStorageError)(signedError);
         return { url: signed.signedUrl, ttl: SIGNED_URL_TTL_SECONDS };
     }
-    /** The record a file hangs off - what the api checks the caller can reach before a download or delete. */
+    /**
+     * The record a file hangs off, and its organization - what the api checks the caller can
+     * reach before a download or delete.
+     */
     async getParent(supportingFileId) {
-        const { data, error } = await this.supabase
-            .from('supporting_files')
-            .select('entity_type, entity_id')
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('supporting_files').select('entity_type, entity_id, organization_id'), this.auth)
             .eq('mms_id', supportingFileId)
-            .eq('organization_id', this.auth.organization_id)
             .single();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
         return data;
     }
     async list(entity, entityId) {
-        const { data, error } = await this.supabase
-            .from('supporting_files')
-            .select('mms_id, name, extension')
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('supporting_files').select('mms_id, name, extension'), this.auth)
             .eq('entity_type', entity)
             .eq('entity_id', entityId)
-            .eq('organization_id', this.auth.organization_id)
             .order('created_at', { ascending: false });
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
@@ -128,6 +128,7 @@ class SupportingFilesResource {
      * object was refreshed in place). Returns the record's whole list.
      */
     async record(entity, entityId, names) {
+        const organizationId = (0, tenancy_1.requireOrganization)(this.auth);
         const files = await this.prepare(entity, entityId, names);
         for (let index = 0; index < files.length; index += BATCH_SIZE) {
             await Promise.all(files.slice(index, index + BATCH_SIZE).map(async ({ name, extension, path }) => {
@@ -148,7 +149,7 @@ class SupportingFilesResource {
             .select('name, extension')
             .eq('entity_type', entity)
             .eq('entity_id', entityId)
-            .eq('organization_id', this.auth.organization_id);
+            .eq('organization_id', organizationId);
         if (existingError)
             throw (0, errors_1.mapPostgrestError)(existingError);
         const existingFileNames = existing.map(fileNameOf);
@@ -159,7 +160,7 @@ class SupportingFilesResource {
                 extension,
                 entity_type: entity,
                 entity_id: entityId,
-                organization_id: this.auth.organization_id,
+                organization_id: organizationId,
                 created_at: new Date().toISOString(),
                 created_by: this.auth.mms_id,
             })));
@@ -172,7 +173,7 @@ class SupportingFilesResource {
         const { error: storageError } = await this.supabase.storage
             .from(BUCKET)
             .remove([
-            (0, paths_1.storagePath)(this.auth.organization_id, data.entity_type, data.entity_id, data.name, data.extension),
+            (0, paths_1.storagePath)((0, tenancy_1.requireOrganization)(this.auth), data.entity_type, data.entity_id, data.name, data.extension),
         ]);
         if (storageError) {
             const fileName = fileNameOf({
@@ -188,8 +189,9 @@ class SupportingFilesResource {
      * are one key. A converted lead takes no new files.
      */
     async prepare(entity, entityId, names) {
+        const organizationId = (0, tenancy_1.requireOrganization)(this.auth);
         if (entity === enum_1.SupportingFilesEntityTypes.LEAD) {
-            await (0, won_1.refuseWonLead)(this.supabase, this.auth.organization_id, entityId);
+            await (0, won_1.refuseWonLead)(this.supabase, organizationId, entityId);
         }
         return names.map((fileName) => {
             const { name, extension } = (0, paths_1.splitFileName)((0, paths_1.sanitizeFileName)(fileName));
@@ -203,7 +205,7 @@ class SupportingFilesResource {
             return {
                 name,
                 extension: extension,
-                path: (0, paths_1.storagePath)(this.auth.organization_id, entity, entityId, name, extension),
+                path: (0, paths_1.storagePath)(organizationId, entity, entityId, name, extension),
             };
         });
     }

package/dist/tasks/index.js

@@ -221,7 +221,7 @@ class TasksResource {
         return (0, transforms_1.toMmsList)(rows, page, pageSize, count);
     }
     async getById(taskId) {
-        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('tasks').select(TASK_DETAIL_SELECT).eq('mms_id', taskId), this.auth)
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('tasks').select((0, tenancy_1.withOrganization)(TASK_DETAIL_SELECT, this.auth)).eq('mms_id', taskId), this.auth)
             .order('created_at', { referencedTable: 'links_out' })
             .order('created_at', { referencedTable: 'links_in' })
             .single();

package/dist/tenancy.d.ts

@@ -7,7 +7,7 @@ export declare const scopeToOrganization: <Q extends PostgrestFilterBuilder<any,
 export declare const requireOrganization: (actor: {
     organization_id: string | null;
 }) => string;
-/** A list select, plus each row's organization on a staff read so the row says whose it is. */
+/** A select, plus the row's organization on a staff read so the row says whose it is. */
 export declare const withOrganization: (select: string, actor: {
     organization_id: string | null;
 }) => string;

package/dist/tenancy.js

@@ -20,6 +20,6 @@ const requireOrganization = (actor) => {
     return actor.organization_id;
 };
 exports.requireOrganization = requireOrganization;
-/** A list select, plus each row's organization on a staff read so the row says whose it is. */
+/** A select, plus the row's organization on a staff read so the row says whose it is. */
 const withOrganization = (select, actor) => actor.organization_id === null ? `${select}, organization:organizations!organization_id(mms_id, name)` : select;
 exports.withOrganization = withOrganization;

package/dist/users/index.js

@@ -75,7 +75,7 @@ class UsersResource {
         return (0, transforms_1.toMmsList)(data, page, pageSize, count);
     }
     async getRow(userId) {
-        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('users').select('*').eq('mms_id', userId), this.auth).single();
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('users').select((0, tenancy_1.withOrganization)('*', this.auth)).eq('mms_id', userId), this.auth).single();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
         return (0, audit_1.withoutInternalId)(data);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@managemint-solutions/sdk",
-  "version": "0.54.0",
+  "version": "0.56.0",
   "description": "Typed Supabase data-access SDK for ManageMint Solutions",
   "license": "UNLICENSED",
   "author": "Scott Bebington <scottbebington@gmail.com>",
@@ -51,7 +51,7 @@
     "testEnvironment": "node"
   },
   "dependencies": {
-    "@managemint-solutions/entities": "^1.36.0"
+    "@managemint-solutions/entities": "^1.37.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11.0.0",