@managemint-solutions/sdk 0.55.0 → 0.56.0

package/dist/notes/index.d.ts

@@ -1,7 +1,7 @@
 import type { NoteEntity } from '@managemint-solutions/entities/notes';
 import type { AddNoteDto } from '@managemint-solutions/entities/notes/dto';
 import { NotesEntityTypes } from '@managemint-solutions/entities/notes/enum';
-import type { AuthContext } from '../auth';
+import type { ClientContext } from '../auth';
 import { type AuditResource } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 export * from './dto';
@@ -9,7 +9,7 @@ export declare class NotesResource {
     private readonly supabase;
     private readonly auth;
     private readonly table;
-    constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
+    constructor(supabase: TypedSupabaseClient, auth: ClientContext, audit: AuditResource);
     getById(noteId: string): Promise<NoteEntity>;
     list(entity: NotesEntityTypes, entityId: string): Promise<NoteEntity[]>;
     create(entity: NotesEntityTypes, entityId: string, input: AddNoteDto): Promise<NoteEntity>;

package/dist/notes/index.js

@@ -20,6 +20,7 @@ const enum_2 = require("@managemint-solutions/entities/audit-trail/enum");
 const audit_1 = require("../audit");
 const errors_1 = require("../errors");
 const won_1 = require("../leads/won");
+const tenancy_1 = require("../tenancy");
 __exportStar(require("./dto"), exports);
 // The public contract is the shared NoteEntity from @managemint-solutions/entities; the casts at
 // the returns declare the shape the select string below produces (the columns are defined in the
@@ -38,10 +39,7 @@ class NotesResource {
         });
     }
     async getById(noteId) {
-        const { data, error } = await this.supabase
-            .from('notes')
-            .select(NOTE_SELECT)
-            .eq('organization_id', this.auth.organization_id)
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('notes').select(NOTE_SELECT), this.auth)
             .eq('mms_id', noteId)
             .single();
         if (error)
@@ -49,10 +47,7 @@ class NotesResource {
         return data;
     }
     async list(entity, entityId) {
-        const { data, error } = await this.supabase
-            .from('notes')
-            .select(NOTE_SELECT)
-            .eq('organization_id', this.auth.organization_id)
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('notes').select(NOTE_SELECT), this.auth)
             .eq('entity_type', entity)
             .eq('entity_id', entityId)
             .order('created_at', { ascending: false });
@@ -61,14 +56,15 @@ class NotesResource {
         return data;
     }
     async create(entity, entityId, input) {
+        const organizationId = (0, tenancy_1.requireOrganization)(this.auth);
         if (entity === enum_1.NotesEntityTypes.LEAD) {
-            await (0, won_1.refuseWonLead)(this.supabase, this.auth.organization_id, entityId);
+            await (0, won_1.refuseWonLead)(this.supabase, organizationId, entityId);
         }
         const row = await this.table.insert({
             content: input.content,
             entity_type: entity,
             entity_id: entityId,
-            organization_id: this.auth.organization_id,
+            organization_id: organizationId,
             user_id: this.auth.mms_id,
         });
         return this.getById(row.mms_id);

package/dist/service-client/index.d.ts

@@ -13,6 +13,7 @@ import { OrganizationPaymentMethodsResource, type PaymentMethodLookupColumn } fr
 import { OrganizationsResource, OrganizationSignupResource } from '../organizations';
 import { PermissionsResource } from '../permissions';
 import { StaffPermissionsResource, StaffResource } from '../staff';
+import { SupportingFilesResource } from '../supporting-files';
 import { UserApiCredentialsResource } from '../user-api-credentials';
 import { UsersResource } from '../users';
 import { WebhookEventsResource } from '../webhook-events';
@@ -41,6 +42,8 @@ export declare class SupabaseOrganizationScope {
     readonly organizations: OrganizationsResource;
     readonly paymentMethod: OrganizationPaymentMethodsResource;
     readonly permissions: PermissionsResource;
+    /** For the admin api's staff downloads: Storage's read policy names no staff, the service role passes it. */
+    readonly supportingFiles: SupportingFilesResource;
     readonly users: UsersResource;
     constructor(supabase: TypedSupabaseClient, actor: AuditActor, onAuditError?: AuditErrorHandler);
     /**

package/dist/service-client/index.js

@@ -18,6 +18,7 @@ const organization_payment_methods_1 = require("../organization-payment-methods"
 const organizations_1 = require("../organizations");
 const permissions_1 = require("../permissions");
 const staff_1 = require("../staff");
+const supporting_files_1 = require("../supporting-files");
 const user_api_credentials_1 = require("../user-api-credentials");
 const users_1 = require("../users");
 const webhook_events_1 = require("../webhook-events");
@@ -39,6 +40,8 @@ class SupabaseOrganizationScope {
     organizations;
     paymentMethod;
     permissions;
+    /** For the admin api's staff downloads: Storage's read policy names no staff, the service role passes it. */
+    supportingFiles;
     users;
     constructor(supabase, actor, onAuditError) {
         this.supabase = supabase;
@@ -54,6 +57,7 @@ class SupabaseOrganizationScope {
         this.organizations = new organizations_1.OrganizationsResource(supabase, actor, this.audit);
         this.paymentMethod = new organization_payment_methods_1.OrganizationPaymentMethodsResource(supabase, actor);
         this.permissions = new permissions_1.PermissionsResource(supabase, actor, this.audit);
+        this.supportingFiles = new supporting_files_1.SupportingFilesResource(supabase, actor, this.audit);
         this.users = new users_1.UsersResource(supabase, actor, this.audit);
     }
     /**

package/dist/staff-client.d.ts

@@ -1,11 +1,14 @@
 import { type StaffContext } from './auth';
 import { AuditResource } from './audit';
+import { AdditionalDetailsResource } from './additional-details';
 import type { SupabaseClientConfig, TypedSupabaseClient } from './client';
 import { ClientsResource } from './clients';
 import { LeadsResource } from './leads';
+import { NotesResource } from './notes';
 import { OrganizationsResource } from './organizations';
 import { ProjectsResource } from './projects';
 import { StaffPermissionsResource, StaffResource } from './staff';
+import { SupportingFilesResource } from './supporting-files';
 import { TasksResource } from './tasks';
 import { UserApiCredentialsReads } from './user-api-credentials';
 import { UsersResource } from './users';
@@ -22,14 +25,18 @@ export declare class SupabaseStaffClient {
     /** The staff member the token belongs to - the caller, for a service that records who acted. */
     readonly auth: StaffContext;
     readonly audit: AuditResource;
+    readonly additionalDetails: AdditionalDetailsResource;
     readonly clients: ClientsResource;
     readonly leads: LeadsResource;
+    readonly notes: NotesResource;
     readonly projects: ProjectsResource;
     readonly tasks: TasksResource;
     readonly users: UsersResource;
     readonly organizations: OrganizationsResource;
     readonly staff: StaffResource;
     readonly staffPermissions: StaffPermissionsResource;
+    /** Lists and parents only: Storage names no staff, so a download is signed on the service client. */
+    readonly supportingFiles: SupportingFilesResource;
     readonly userApiCredentials: UserApiCredentialsReads;
     constructor({ url, key, accessToken, auth, client }: SupabaseStaffClientConfig);
 }

package/dist/staff-client.js

@@ -6,9 +6,11 @@ const audit_1 = require("./audit");
 const additional_details_1 = require("./additional-details");
 const clients_1 = require("./clients");
 const leads_1 = require("./leads");
+const notes_1 = require("./notes");
 const organizations_1 = require("./organizations");
 const projects_1 = require("./projects");
 const staff_1 = require("./staff");
+const supporting_files_1 = require("./supporting-files");
 const tasks_1 = require("./tasks");
 const user_api_credentials_1 = require("./user-api-credentials");
 const users_1 = require("./users");
@@ -22,28 +24,34 @@ class SupabaseStaffClient {
     /** The staff member the token belongs to - the caller, for a service that records who acted. */
     auth;
     audit;
+    additionalDetails;
     clients;
     leads;
+    notes;
     projects;
     tasks;
     users;
     organizations;
     staff;
     staffPermissions;
+    /** Lists and parents only: Storage names no staff, so a download is signed on the service client. */
+    supportingFiles;
     userApiCredentials;
     constructor({ url, key, accessToken, auth, client }) {
         this.supabase = client ?? (0, auth_1.createRawClient)(url, key, accessToken);
         this.auth = auth;
         this.audit = new audit_1.AuditResource(this.supabase, auth);
         this.clients = new clients_1.ClientsResource(this.supabase, auth, this.audit);
-        const additionalDetails = new additional_details_1.AdditionalDetailsResource(this.supabase, auth, this.audit);
-        this.leads = new leads_1.LeadsResource(this.supabase, auth, this.audit, additionalDetails);
+        this.additionalDetails = new additional_details_1.AdditionalDetailsResource(this.supabase, auth, this.audit);
+        this.leads = new leads_1.LeadsResource(this.supabase, auth, this.audit, this.additionalDetails);
+        this.notes = new notes_1.NotesResource(this.supabase, auth, this.audit);
         this.projects = new projects_1.ProjectsResource(this.supabase, auth, this.audit);
         this.tasks = new tasks_1.TasksResource(this.supabase, auth, this.audit);
         this.users = new users_1.UsersResource(this.supabase, auth, this.audit);
         this.organizations = new organizations_1.OrganizationsResource(this.supabase, auth, this.audit);
         this.staff = new staff_1.StaffResource(this.supabase);
         this.staffPermissions = new staff_1.StaffPermissionsResource(this.supabase);
+        this.supportingFiles = new supporting_files_1.SupportingFilesResource(this.supabase, auth, this.audit);
         this.userApiCredentials = new user_api_credentials_1.UserApiCredentialsReads(this.supabase);
     }
 }

package/dist/supporting-files/index.d.ts

@@ -1,7 +1,6 @@
 import type { SupportingFileEntity, SupportingFilePresignedUrl, SupportingFileUploadTarget } from '@managemint-solutions/entities/supporting-files';
 import { SupportingFilesEntityTypes } from '@managemint-solutions/entities/supporting-files/enum';
-import type { AuthContext } from '../auth';
-import { type AuditResource } from '../audit';
+import { type AuditResource, type ResourceActor } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 export * from './dto';
 export * from './paths';
@@ -9,12 +8,21 @@ export declare class SupportingFilesResource {
     private readonly supabase;
     private readonly auth;
     private readonly table;
-    constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
+    constructor(supabase: TypedSupabaseClient, auth: ResourceActor, audit: AuditResource);
+    /**
+     * A short-lived download link. Storage checks the bucket's read policy as this client's
+     * caller, which names no staff - the admin api signs on the service client's organization
+     * scope instead.
+     */
     getPresignedUrl(supportingFileId: string): Promise<SupportingFilePresignedUrl>;
-    /** The record a file hangs off - what the api checks the caller can reach before a download or delete. */
+    /**
+     * The record a file hangs off, and its organization - what the api checks the caller can
+     * reach before a download or delete.
+     */
     getParent(supportingFileId: string): Promise<{
         entity_type: SupportingFilesEntityTypes;
         entity_id: string;
+        organization_id: string;
     }>;
     list(entity: SupportingFilesEntityTypes, entityId: string): Promise<SupportingFileEntity[]>;
     /**

package/dist/supporting-files/index.js

@@ -20,6 +20,7 @@ const enum_2 = require("@managemint-solutions/entities/audit-trail/enum");
 const audit_1 = require("../audit");
 const errors_1 = require("../errors");
 const won_1 = require("../leads/won");
+const tenancy_1 = require("../tenancy");
 const paths_1 = require("./paths");
 __exportStar(require("./dto"), exports);
 __exportStar(require("./paths"), exports);
@@ -60,41 +61,40 @@ class SupportingFilesResource {
             entityType: enum_2.AuditTrailEntityType.SUPPORTING_FILES,
         });
     }
+    /**
+     * A short-lived download link. Storage checks the bucket's read policy as this client's
+     * caller, which names no staff - the admin api signs on the service client's organization
+     * scope instead.
+     */
     async getPresignedUrl(supportingFileId) {
-        const { data, error } = await this.supabase
-            .from('supporting_files')
-            .select('name, extension, entity_type, entity_id')
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('supporting_files').select('organization_id, name, extension, entity_type, entity_id'), this.auth)
             .eq('mms_id', supportingFileId)
-            .eq('organization_id', this.auth.organization_id)
             .single();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
         const { data: signed, error: signedError } = await this.supabase.storage
             .from(BUCKET)
-            .createSignedUrl((0, paths_1.storagePath)(this.auth.organization_id, data.entity_type, data.entity_id, data.name, data.extension), SIGNED_URL_TTL_SECONDS);
+            .createSignedUrl((0, paths_1.storagePath)(data.organization_id, data.entity_type, data.entity_id, data.name, data.extension), SIGNED_URL_TTL_SECONDS);
         if (signedError)
             throw (0, errors_1.mapStorageError)(signedError);
         return { url: signed.signedUrl, ttl: SIGNED_URL_TTL_SECONDS };
     }
-    /** The record a file hangs off - what the api checks the caller can reach before a download or delete. */
+    /**
+     * The record a file hangs off, and its organization - what the api checks the caller can
+     * reach before a download or delete.
+     */
     async getParent(supportingFileId) {
-        const { data, error } = await this.supabase
-            .from('supporting_files')
-            .select('entity_type, entity_id')
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('supporting_files').select('entity_type, entity_id, organization_id'), this.auth)
             .eq('mms_id', supportingFileId)
-            .eq('organization_id', this.auth.organization_id)
             .single();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
         return data;
     }
     async list(entity, entityId) {
-        const { data, error } = await this.supabase
-            .from('supporting_files')
-            .select('mms_id, name, extension')
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('supporting_files').select('mms_id, name, extension'), this.auth)
             .eq('entity_type', entity)
             .eq('entity_id', entityId)
-            .eq('organization_id', this.auth.organization_id)
             .order('created_at', { ascending: false });
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
@@ -128,6 +128,7 @@ class SupportingFilesResource {
      * object was refreshed in place). Returns the record's whole list.
      */
     async record(entity, entityId, names) {
+        const organizationId = (0, tenancy_1.requireOrganization)(this.auth);
         const files = await this.prepare(entity, entityId, names);
         for (let index = 0; index < files.length; index += BATCH_SIZE) {
             await Promise.all(files.slice(index, index + BATCH_SIZE).map(async ({ name, extension, path }) => {
@@ -148,7 +149,7 @@ class SupportingFilesResource {
             .select('name, extension')
             .eq('entity_type', entity)
             .eq('entity_id', entityId)
-            .eq('organization_id', this.auth.organization_id);
+            .eq('organization_id', organizationId);
         if (existingError)
             throw (0, errors_1.mapPostgrestError)(existingError);
         const existingFileNames = existing.map(fileNameOf);
@@ -159,7 +160,7 @@ class SupportingFilesResource {
                 extension,
                 entity_type: entity,
                 entity_id: entityId,
-                organization_id: this.auth.organization_id,
+                organization_id: organizationId,
                 created_at: new Date().toISOString(),
                 created_by: this.auth.mms_id,
             })));
@@ -172,7 +173,7 @@ class SupportingFilesResource {
         const { error: storageError } = await this.supabase.storage
             .from(BUCKET)
             .remove([
-            (0, paths_1.storagePath)(this.auth.organization_id, data.entity_type, data.entity_id, data.name, data.extension),
+            (0, paths_1.storagePath)((0, tenancy_1.requireOrganization)(this.auth), data.entity_type, data.entity_id, data.name, data.extension),
         ]);
         if (storageError) {
             const fileName = fileNameOf({
@@ -188,8 +189,9 @@ class SupportingFilesResource {
      * are one key. A converted lead takes no new files.
      */
     async prepare(entity, entityId, names) {
+        const organizationId = (0, tenancy_1.requireOrganization)(this.auth);
         if (entity === enum_1.SupportingFilesEntityTypes.LEAD) {
-            await (0, won_1.refuseWonLead)(this.supabase, this.auth.organization_id, entityId);
+            await (0, won_1.refuseWonLead)(this.supabase, organizationId, entityId);
         }
         return names.map((fileName) => {
             const { name, extension } = (0, paths_1.splitFileName)((0, paths_1.sanitizeFileName)(fileName));
@@ -203,7 +205,7 @@ class SupportingFilesResource {
             return {
                 name,
                 extension: extension,
-                path: (0, paths_1.storagePath)(this.auth.organization_id, entity, entityId, name, extension),
+                path: (0, paths_1.storagePath)(organizationId, entity, entityId, name, extension),
             };
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@managemint-solutions/sdk",
-  "version": "0.55.0",
+  "version": "0.56.0",
   "description": "Typed Supabase data-access SDK for ManageMint Solutions",
   "license": "UNLICENSED",
   "author": "Scott Bebington <scottbebington@gmail.com>",