@managemint-solutions/sdk 0.55.0 → 0.64.0

package/dist/payments/index.js

@@ -0,0 +1,137 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PaymentsResource = void 0;
+const enum_1 = require("@managemint-solutions/entities/payments/enum");
+const enum_2 = require("@managemint-solutions/entities/audit-trail/enum");
+const audit_1 = require("../audit");
+const errors_1 = require("../errors");
+const tenancy_1 = require("../tenancy");
+const transforms_1 = require("../transforms");
+const PAYMENT_SELECT = `
+        mms_id,
+        created_at,
+        created_by:user_profiles!created_by ${transforms_1.USER_PROFILE_EMBED},
+        direction,
+        status,
+        amount_minor,
+        currency,
+        method,
+        reference,
+        payer_email,
+        paid_at
+      `;
+/**
+ * `public.payments`: money received for a record, keyed by `entity_type` + `entity_id` like the
+ * visibility table. Read on the caller's client (RLS shows a payment while its record is
+ * readable); written on the service client's organization scope alone - members hold only a
+ * SELECT grant. A checkout starts as an `open` row (one per record, by a partial unique index)
+ * and is settled to `paid`. Each write is audited and, through its `entity_type`/`entity_id`,
+ * filed under the record it pays for.
+ */
+class PaymentsResource {
+    supabase;
+    actor;
+    table;
+    constructor(supabase, actor, audit) {
+        this.supabase = supabase;
+        this.actor = actor;
+        this.table = (0, audit_1.auditedTable)(supabase, actor, audit, {
+            table: 'payments',
+            entityType: enum_2.AuditTrailEntityType.PAYMENTS,
+        });
+    }
+    /** The money received for one record, oldest first - paid rows only. */
+    async list(entityType, entityId) {
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('payments').select(PAYMENT_SELECT), this.actor)
+            .eq('entity_type', entityType)
+            .eq('entity_id', entityId)
+            .eq('status', enum_1.PaymentStatus.PAID)
+            .order('paid_at', { ascending: true });
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data;
+    }
+    /** How many paid payments each of `entityIds` has - one query for a page of a list. */
+    async paidCounts(entityType, entityIds) {
+        if (entityIds.length === 0)
+            return {};
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('payments').select('entity_id'), this.actor)
+            .eq('entity_type', entityType)
+            .eq('status', enum_1.PaymentStatus.PAID)
+            .in('entity_id', entityIds);
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        const counts = {};
+        for (const { entity_id } of (data ?? [])) {
+            counts[entity_id] = (counts[entity_id] ?? 0) + 1;
+        }
+        return counts;
+    }
+    /**
+     * The ids of the organization's records of one kind with a settled payment, each once - the
+     * documents list's payment filter reads it before the page.
+     */
+    async paidEntityIds(entityType) {
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('payments').select('entity_id'), this.actor)
+            .eq('entity_type', entityType)
+            .eq('status', enum_1.PaymentStatus.PAID);
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return [...new Set((data ?? []).map((row) => row.entity_id))];
+    }
+    /** The record's open checkout, if one is under way. */
+    async findOpen(entityType, entityId) {
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('payments').select(`${PAYMENT_SELECT}, access_code`), this.actor)
+            .eq('entity_type', entityType)
+            .eq('entity_id', entityId)
+            .eq('status', enum_1.PaymentStatus.OPEN)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? null);
+    }
+    /** A payment by the provider's reference (unique), whatever its status. */
+    async findByReference(reference) {
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('payments').select(PAYMENT_SELECT), this.actor)
+            .eq('reference', reference)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? null);
+    }
+    /**
+     * Records one payment, by the actor (null for the system). A Paystack reference recorded
+     * already, or a second open checkout for the record, is refused by a unique index - 409 with
+     * `code` 23505.
+     */
+    async create(row) {
+        await this.table.insert({
+            ...row,
+            organization_id: (0, tenancy_1.requireOrganization)(this.actor),
+            created_by: this.actor.mms_id,
+            created_at: new Date().toISOString(),
+        });
+    }
+    /**
+     * Removes a payment marked by hand (EFT) from the record it pays for. False when it is not one -
+     * a Paystack payment is money Paystack holds, refunded there, never removed here.
+     */
+    async removeManual(paymentId, entityType, entityId) {
+        const removed = await this.table.removeWhere(paymentId, (query) => query.eq('entity_type', entityType).eq('entity_id', entityId).eq('method', enum_1.PaymentMethod.EFT));
+        return removed !== null;
+    }
+    /** Settles an open checkout. False when it is no longer open (settled or replaced first). */
+    async settle(paymentId, row) {
+        const settled = await this.table.updateWhere(paymentId, (query) => query.eq('status', enum_1.PaymentStatus.OPEN), {
+            ...row,
+            status: enum_1.PaymentStatus.PAID,
+        });
+        return settled !== null;
+    }
+    /** Drops an open checkout Paystack says failed, so a new one can open. False when it moved on. */
+    async removeOpen(paymentId) {
+        const removed = await this.table.removeWhere(paymentId, (query) => query.eq('status', enum_1.PaymentStatus.OPEN));
+        return removed !== null;
+    }
+}
+exports.PaymentsResource = PaymentsResource;

package/dist/permissions/dto.d.ts

@@ -20,6 +20,10 @@ export declare class UpdatePermissionsDto implements UpdatePermissionsDtoType {
     readonly read_timesheets: boolean;
     readonly update_timesheets: boolean;
     readonly delete_timesheets: boolean;
+    readonly create_documents: boolean;
+    readonly read_documents: boolean;
+    readonly update_documents: boolean;
+    readonly delete_documents: boolean;
     readonly create_leave: boolean;
     readonly read_leave: boolean;
     readonly update_leave: boolean;

package/dist/permissions/dto.js

@@ -42,14 +42,10 @@ class UpdatePermissionsDto {
     read_timesheets;
     update_timesheets;
     delete_timesheets;
-    // @IsBoolean({ message: 'Create Documents must be a boolean' })
-    // readonly create_documents!: boolean;
-    // @IsBoolean({ message: 'Read Documents must be a boolean' })
-    // readonly read_documents!: boolean;
-    // @IsBoolean({ message: 'Update Documents must be a boolean' })
-    // readonly update_documents!: boolean;
-    // @IsBoolean({ message: 'Delete Documents must be a boolean' })
-    // readonly delete_documents!: boolean;
+    create_documents;
+    read_documents;
+    update_documents;
+    delete_documents;
     create_leave;
     read_leave;
     update_leave;
@@ -192,6 +188,22 @@ __decorate([
     (0, class_validator_1.IsBoolean)({ message: 'Delete Timesheets must be a boolean' }),
     __metadata("design:type", Boolean)
 ], UpdatePermissionsDto.prototype, "delete_timesheets", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Create Documents must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "create_documents", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Read Documents must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "read_documents", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Update Documents must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "update_documents", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)({ message: 'Delete Documents must be a boolean' }),
+    __metadata("design:type", Boolean)
+], UpdatePermissionsDto.prototype, "delete_documents", void 0);
 __decorate([
     (0, class_validator_1.IsBoolean)({ message: 'Create Leave must be a boolean' }),
     __metadata("design:type", Boolean)

package/dist/service-client/index.d.ts

@@ -4,6 +4,7 @@ import { BillingResource } from '../billing';
 import { InvoicesResource } from '../billing/invoices';
 import { ClientsResource } from '../clients';
 import { ConfigsResource } from '../configs';
+import { DocumentsResource } from '../documents';
 import { EmulationHandshakesResource } from '../emulation-handshakes';
 import { FeatureRequestsResource } from '../feature-requests';
 import { LeaveEntitlementsResource, LeaveRequestsResource, LeaveTypesResource } from '../leave';
@@ -11,10 +12,13 @@ import { NotificationsOutboxResource } from '../notifications';
 import { OrganizationInvitesResource } from '../organization-invites';
 import { OrganizationPaymentMethodsResource, type PaymentMethodLookupColumn } from '../organization-payment-methods';
 import { OrganizationsResource, OrganizationSignupResource } from '../organizations';
+import { PaymentsResource } from '../payments';
 import { PermissionsResource } from '../permissions';
 import { StaffPermissionsResource, StaffResource } from '../staff';
+import { SupportingFilesResource } from '../supporting-files';
 import { UserApiCredentialsResource } from '../user-api-credentials';
 import { UsersResource } from '../users';
+import { VisibilityResource } from '../visibility';
 import { WebhookEventsResource } from '../webhook-events';
 export type SupabaseServiceClientConfig = {
     url: string;
@@ -33,6 +37,13 @@ export declare class SupabaseOrganizationScope {
     readonly actor: AuditActor;
     readonly audit: AuditResource;
     readonly billing: BillingResource;
+    /**
+     * For the public pay page, which has no caller (the document behind a pay link, and its PDF),
+     * the Paystack webhook, and the daily send cap, which counts private documents too.
+     */
+    readonly documents: DocumentsResource;
+    /** Money received: written here alone, by the Paystack webhook. */
+    readonly payments: PaymentsResource;
     readonly invoices: InvoicesResource;
     readonly invites: OrganizationInvitesResource;
     readonly leaveTypes: LeaveTypesResource;
@@ -41,7 +52,11 @@ export declare class SupabaseOrganizationScope {
     readonly organizations: OrganizationsResource;
     readonly paymentMethod: OrganizationPaymentMethodsResource;
     readonly permissions: PermissionsResource;
+    /** For the admin api's staff downloads: Storage's read policy names no staff, the service role passes it. */
+    readonly supportingFiles: SupportingFilesResource;
     readonly users: UsersResource;
+    /** Who private records are shared with: listed and written here, after the api's own checks. */
+    readonly visibility: VisibilityResource;
     constructor(supabase: TypedSupabaseClient, actor: AuditActor, onAuditError?: AuditErrorHandler);
     /**
      * An audited table bound to this organization and actor - the shape the api hand-rolls today
@@ -150,6 +165,26 @@ export declare class SupabaseServiceClient {
         user_id: string;
         organization_id: string;
     } | null>;
+    /**
+     * The recurring parents due a draft: not paused, not ended, `repeat_next_at` on or before
+     * `onOrBefore` (YYYY-MM-DD). Across every organization, like the leave rollover's tenants - the
+     * cron then works inside each row's own organization.
+     */
+    documentsDueForDraft(onOrBefore: string): Promise<{
+        mms_id: string;
+        organization_id: string;
+    }[]>;
+    /** The drafts due to issue: `issue_at` on or before `onOrBefore`, across every organization. */
+    documentsDueToIssue(onOrBefore: string): Promise<{
+        mms_id: string;
+        organization_id: string;
+    }[]>;
+    /**
+     * Which organization a document belongs to, by its id alone. Unscoped by necessity, like the
+     * calendar feed: a public pay link (whose signature the api has checked) names only the
+     * document, and the row is what says which tenant it belongs to.
+     */
+    findDocumentOrganization(documentId: string): Promise<string | null>;
     /**
      * Deletes every audit row written before `cutoff` and says how many went - the daily
      * retention cron. Every tenant at once: the period is the same for all of them. Batched by

package/dist/service-client/index.js

@@ -4,10 +4,12 @@ exports.createSupabaseServiceClient = exports.SupabaseServiceClient = exports.Su
 const auth_1 = require("../auth");
 const audit_1 = require("../audit");
 const enum_1 = require("@managemint-solutions/entities/audit-trail/enum");
+const enum_2 = require("@managemint-solutions/entities/documents/enum");
 const billing_1 = require("../billing");
 const invoices_1 = require("../billing/invoices");
 const clients_1 = require("../clients");
 const configs_1 = require("../configs");
+const documents_1 = require("../documents");
 const emulation_handshakes_1 = require("../emulation-handshakes");
 const feature_requests_1 = require("../feature-requests");
 const leave_1 = require("../leave");
@@ -16,10 +18,13 @@ const errors_1 = require("../errors");
 const organization_invites_1 = require("../organization-invites");
 const organization_payment_methods_1 = require("../organization-payment-methods");
 const organizations_1 = require("../organizations");
+const payments_1 = require("../payments");
 const permissions_1 = require("../permissions");
 const staff_1 = require("../staff");
+const supporting_files_1 = require("../supporting-files");
 const user_api_credentials_1 = require("../user-api-credentials");
 const users_1 = require("../users");
+const visibility_1 = require("../visibility");
 const webhook_events_1 = require("../webhook-events");
 /**
  * The organization-scoped half of the service client. Everything here is attributed to one
@@ -31,6 +36,13 @@ class SupabaseOrganizationScope {
     actor;
     audit;
     billing;
+    /**
+     * For the public pay page, which has no caller (the document behind a pay link, and its PDF),
+     * the Paystack webhook, and the daily send cap, which counts private documents too.
+     */
+    documents;
+    /** Money received: written here alone, by the Paystack webhook. */
+    payments;
     invoices;
     invites;
     leaveTypes;
@@ -39,12 +51,18 @@ class SupabaseOrganizationScope {
     organizations;
     paymentMethod;
     permissions;
+    /** For the admin api's staff downloads: Storage's read policy names no staff, the service role passes it. */
+    supportingFiles;
     users;
+    /** Who private records are shared with: listed and written here, after the api's own checks. */
+    visibility;
     constructor(supabase, actor, onAuditError) {
         this.supabase = supabase;
         this.actor = actor;
         this.audit = new audit_1.AuditResource(supabase, actor, onAuditError);
         this.billing = new billing_1.BillingResource(supabase, actor, this.audit);
+        this.documents = new documents_1.DocumentsResource(supabase, actor, this.audit);
+        this.payments = new payments_1.PaymentsResource(supabase, actor, this.audit);
         this.invoices = new invoices_1.InvoicesResource(supabase, actor, this.audit);
         this.invites = new organization_invites_1.OrganizationInvitesResource(supabase, actor);
         // The leave-year rollover writes next period's entitlements as the system (`mms_id: null`).
@@ -54,7 +72,9 @@ class SupabaseOrganizationScope {
         this.organizations = new organizations_1.OrganizationsResource(supabase, actor, this.audit);
         this.paymentMethod = new organization_payment_methods_1.OrganizationPaymentMethodsResource(supabase, actor);
         this.permissions = new permissions_1.PermissionsResource(supabase, actor, this.audit);
+        this.supportingFiles = new supporting_files_1.SupportingFilesResource(supabase, actor, this.audit);
         this.users = new users_1.UsersResource(supabase, actor, this.audit);
+        this.visibility = new visibility_1.VisibilityResource(supabase, actor, this.audit);
     }
     /**
      * An audited table bound to this organization and actor - the shape the api hand-rolls today
@@ -262,6 +282,50 @@ class SupabaseServiceClient {
             throw (0, errors_1.mapPostgrestError)(error);
         return (data ?? null);
     }
+    /**
+     * The recurring parents due a draft: not paused, not ended, `repeat_next_at` on or before
+     * `onOrBefore` (YYYY-MM-DD). Across every organization, like the leave rollover's tenants - the
+     * cron then works inside each row's own organization.
+     */
+    async documentsDueForDraft(onOrBefore) {
+        const { data, error } = await this.supabase
+            .from('documents')
+            .select('mms_id, organization_id')
+            .not('repeat', 'is', null)
+            .eq('repeat_paused', false)
+            .eq('status', enum_2.DocumentStatus.DRAFT)
+            .lte('repeat_next_at', onOrBefore);
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? []);
+    }
+    /** The drafts due to issue: `issue_at` on or before `onOrBefore`, across every organization. */
+    async documentsDueToIssue(onOrBefore) {
+        const { data, error } = await this.supabase
+            .from('documents')
+            .select('mms_id, organization_id')
+            .eq('status', enum_2.DocumentStatus.DRAFT)
+            .is('repeat', null)
+            .lte('issue_at', onOrBefore);
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? []);
+    }
+    /**
+     * Which organization a document belongs to, by its id alone. Unscoped by necessity, like the
+     * calendar feed: a public pay link (whose signature the api has checked) names only the
+     * document, and the row is what says which tenant it belongs to.
+     */
+    async findDocumentOrganization(documentId) {
+        const { data, error } = await this.supabase
+            .from('documents')
+            .select('organization_id')
+            .eq('mms_id', documentId)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data?.organization_id ?? null;
+    }
     /**
      * Deletes every audit row written before `cutoff` and says how many went - the daily
      * retention cron. Every tenant at once: the period is the same for all of them. Batched by

package/dist/staff-client.d.ts

@@ -1,11 +1,15 @@
 import { type StaffContext } from './auth';
 import { AuditResource } from './audit';
+import { AdditionalDetailsResource } from './additional-details';
 import type { SupabaseClientConfig, TypedSupabaseClient } from './client';
 import { ClientsResource } from './clients';
+import { DocumentsResource, DocumentTemplatesResource } from './documents';
 import { LeadsResource } from './leads';
+import { NotesResource } from './notes';
 import { OrganizationsResource } from './organizations';
 import { ProjectsResource } from './projects';
 import { StaffPermissionsResource, StaffResource } from './staff';
+import { SupportingFilesResource } from './supporting-files';
 import { TasksResource } from './tasks';
 import { UserApiCredentialsReads } from './user-api-credentials';
 import { UsersResource } from './users';
@@ -22,14 +26,20 @@ export declare class SupabaseStaffClient {
     /** The staff member the token belongs to - the caller, for a service that records who acted. */
     readonly auth: StaffContext;
     readonly audit: AuditResource;
+    readonly additionalDetails: AdditionalDetailsResource;
     readonly clients: ClientsResource;
     readonly leads: LeadsResource;
+    readonly notes: NotesResource;
     readonly projects: ProjectsResource;
     readonly tasks: TasksResource;
+    readonly documentTemplates: DocumentTemplatesResource;
+    readonly documents: DocumentsResource;
     readonly users: UsersResource;
     readonly organizations: OrganizationsResource;
     readonly staff: StaffResource;
     readonly staffPermissions: StaffPermissionsResource;
+    /** Lists and parents only: Storage names no staff, so a download is signed on the service client. */
+    readonly supportingFiles: SupportingFilesResource;
     readonly userApiCredentials: UserApiCredentialsReads;
     constructor({ url, key, accessToken, auth, client }: SupabaseStaffClientConfig);
 }

package/dist/staff-client.js

@@ -5,10 +5,13 @@ const auth_1 = require("./auth");
 const audit_1 = require("./audit");
 const additional_details_1 = require("./additional-details");
 const clients_1 = require("./clients");
+const documents_1 = require("./documents");
 const leads_1 = require("./leads");
+const notes_1 = require("./notes");
 const organizations_1 = require("./organizations");
 const projects_1 = require("./projects");
 const staff_1 = require("./staff");
+const supporting_files_1 = require("./supporting-files");
 const tasks_1 = require("./tasks");
 const user_api_credentials_1 = require("./user-api-credentials");
 const users_1 = require("./users");
@@ -22,28 +25,38 @@ class SupabaseStaffClient {
     /** The staff member the token belongs to - the caller, for a service that records who acted. */
     auth;
     audit;
+    additionalDetails;
     clients;
     leads;
+    notes;
     projects;
     tasks;
+    documentTemplates;
+    documents;
     users;
     organizations;
     staff;
     staffPermissions;
+    /** Lists and parents only: Storage names no staff, so a download is signed on the service client. */
+    supportingFiles;
     userApiCredentials;
     constructor({ url, key, accessToken, auth, client }) {
         this.supabase = client ?? (0, auth_1.createRawClient)(url, key, accessToken);
         this.auth = auth;
         this.audit = new audit_1.AuditResource(this.supabase, auth);
         this.clients = new clients_1.ClientsResource(this.supabase, auth, this.audit);
-        const additionalDetails = new additional_details_1.AdditionalDetailsResource(this.supabase, auth, this.audit);
-        this.leads = new leads_1.LeadsResource(this.supabase, auth, this.audit, additionalDetails);
+        this.additionalDetails = new additional_details_1.AdditionalDetailsResource(this.supabase, auth, this.audit);
+        this.leads = new leads_1.LeadsResource(this.supabase, auth, this.audit, this.additionalDetails);
+        this.notes = new notes_1.NotesResource(this.supabase, auth, this.audit);
         this.projects = new projects_1.ProjectsResource(this.supabase, auth, this.audit);
         this.tasks = new tasks_1.TasksResource(this.supabase, auth, this.audit);
+        this.documentTemplates = new documents_1.DocumentTemplatesResource(this.supabase, auth, this.audit);
+        this.documents = new documents_1.DocumentsResource(this.supabase, auth, this.audit);
         this.users = new users_1.UsersResource(this.supabase, auth, this.audit);
         this.organizations = new organizations_1.OrganizationsResource(this.supabase, auth, this.audit);
         this.staff = new staff_1.StaffResource(this.supabase);
         this.staffPermissions = new staff_1.StaffPermissionsResource(this.supabase);
+        this.supportingFiles = new supporting_files_1.SupportingFilesResource(this.supabase, auth, this.audit);
         this.userApiCredentials = new user_api_credentials_1.UserApiCredentialsReads(this.supabase);
     }
 }

package/dist/supporting-files/index.d.ts

@@ -1,7 +1,6 @@
 import type { SupportingFileEntity, SupportingFilePresignedUrl, SupportingFileUploadTarget } from '@managemint-solutions/entities/supporting-files';
 import { SupportingFilesEntityTypes } from '@managemint-solutions/entities/supporting-files/enum';
-import type { AuthContext } from '../auth';
-import { type AuditResource } from '../audit';
+import { type AuditResource, type ResourceActor } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 export * from './dto';
 export * from './paths';
@@ -9,12 +8,21 @@ export declare class SupportingFilesResource {
     private readonly supabase;
     private readonly auth;
     private readonly table;
-    constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
+    constructor(supabase: TypedSupabaseClient, auth: ResourceActor, audit: AuditResource);
+    /**
+     * A short-lived download link. Storage checks the bucket's read policy as this client's
+     * caller, which names no staff - the admin api signs on the service client's organization
+     * scope instead.
+     */
     getPresignedUrl(supportingFileId: string): Promise<SupportingFilePresignedUrl>;
-    /** The record a file hangs off - what the api checks the caller can reach before a download or delete. */
+    /**
+     * The record a file hangs off, and its organization - what the api checks the caller can
+     * reach before a download or delete.
+     */
     getParent(supportingFileId: string): Promise<{
         entity_type: SupportingFilesEntityTypes;
         entity_id: string;
+        organization_id: string;
     }>;
     list(entity: SupportingFilesEntityTypes, entityId: string): Promise<SupportingFileEntity[]>;
     /**

package/dist/supporting-files/index.js

@@ -20,11 +20,10 @@ const enum_2 = require("@managemint-solutions/entities/audit-trail/enum");
 const audit_1 = require("../audit");
 const errors_1 = require("../errors");
 const won_1 = require("../leads/won");
+const tenancy_1 = require("../tenancy");
 const paths_1 = require("./paths");
 __exportStar(require("./dto"), exports);
 __exportStar(require("./paths"), exports);
-/** Storage bucket every supporting file lives in. */
-const BUCKET = 'supporting-files';
 /** How long a presigned download URL stays valid. */
 const SIGNED_URL_TTL_SECONDS = 300;
 /** Storage calls per file (minting an upload URL, checking an object) run concurrently in batches of this size. */
@@ -60,41 +59,40 @@ class SupportingFilesResource {
             entityType: enum_2.AuditTrailEntityType.SUPPORTING_FILES,
         });
     }
+    /**
+     * A short-lived download link. Storage checks the bucket's read policy as this client's
+     * caller, which names no staff - the admin api signs on the service client's organization
+     * scope instead.
+     */
     async getPresignedUrl(supportingFileId) {
-        const { data, error } = await this.supabase
-            .from('supporting_files')
-            .select('name, extension, entity_type, entity_id')
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('supporting_files').select('organization_id, name, extension, entity_type, entity_id'), this.auth)
             .eq('mms_id', supportingFileId)
-            .eq('organization_id', this.auth.organization_id)
             .single();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
         const { data: signed, error: signedError } = await this.supabase.storage
-            .from(BUCKET)
-            .createSignedUrl((0, paths_1.storagePath)(this.auth.organization_id, data.entity_type, data.entity_id, data.name, data.extension), SIGNED_URL_TTL_SECONDS);
+            .from(paths_1.SUPPORTING_FILES_BUCKET)
+            .createSignedUrl((0, paths_1.storagePath)(data.organization_id, data.entity_type, data.entity_id, data.name, data.extension), SIGNED_URL_TTL_SECONDS);
         if (signedError)
             throw (0, errors_1.mapStorageError)(signedError);
         return { url: signed.signedUrl, ttl: SIGNED_URL_TTL_SECONDS };
     }
-    /** The record a file hangs off - what the api checks the caller can reach before a download or delete. */
+    /**
+     * The record a file hangs off, and its organization - what the api checks the caller can
+     * reach before a download or delete.
+     */
     async getParent(supportingFileId) {
-        const { data, error } = await this.supabase
-            .from('supporting_files')
-            .select('entity_type, entity_id')
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('supporting_files').select('entity_type, entity_id, organization_id'), this.auth)
             .eq('mms_id', supportingFileId)
-            .eq('organization_id', this.auth.organization_id)
             .single();
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
         return data;
     }
     async list(entity, entityId) {
-        const { data, error } = await this.supabase
-            .from('supporting_files')
-            .select('mms_id, name, extension')
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('supporting_files').select('mms_id, name, extension'), this.auth)
             .eq('entity_type', entity)
             .eq('entity_id', entityId)
-            .eq('organization_id', this.auth.organization_id)
             .order('created_at', { ascending: false });
         if (error)
             throw (0, errors_1.mapPostgrestError)(error);
@@ -112,7 +110,7 @@ class SupportingFilesResource {
         for (let index = 0; index < files.length; index += BATCH_SIZE) {
             targets.push(...(await Promise.all(files.slice(index, index + BATCH_SIZE).map(async ({ name, extension, path }) => {
                 const { data, error } = await this.supabase.storage
-                    .from(BUCKET)
+                    .from(paths_1.SUPPORTING_FILES_BUCKET)
                     .createSignedUploadUrl(path, { upsert: true });
                 if (error) {
                     throw (0, errors_1.mapStorageError)(error, `Failed to prepare upload: ${fileNameOf({ name, extension })}`);
@@ -128,12 +126,13 @@ class SupportingFilesResource {
      * object was refreshed in place). Returns the record's whole list.
      */
     async record(entity, entityId, names) {
+        const organizationId = (0, tenancy_1.requireOrganization)(this.auth);
         const files = await this.prepare(entity, entityId, names);
         for (let index = 0; index < files.length; index += BATCH_SIZE) {
             await Promise.all(files.slice(index, index + BATCH_SIZE).map(async ({ name, extension, path }) => {
                 // A missing object comes back as `data: false` (storage-js keeps the 404 in `error`);
                 // any other failure is thrown by storage-js itself.
-                const { data: present } = await this.supabase.storage.from(BUCKET).exists(path);
+                const { data: present } = await this.supabase.storage.from(paths_1.SUPPORTING_FILES_BUCKET).exists(path);
                 if (!present) {
                     throw new errors_1.SupabaseClientError({
                         status: 400,
@@ -148,7 +147,7 @@ class SupportingFilesResource {
             .select('name, extension')
             .eq('entity_type', entity)
             .eq('entity_id', entityId)
-            .eq('organization_id', this.auth.organization_id);
+            .eq('organization_id', organizationId);
         if (existingError)
             throw (0, errors_1.mapPostgrestError)(existingError);
         const existingFileNames = existing.map(fileNameOf);
@@ -159,7 +158,7 @@ class SupportingFilesResource {
                 extension,
                 entity_type: entity,
                 entity_id: entityId,
-                organization_id: this.auth.organization_id,
+                organization_id: organizationId,
                 created_at: new Date().toISOString(),
                 created_by: this.auth.mms_id,
             })));
@@ -170,9 +169,9 @@ class SupportingFilesResource {
         // The row goes first - the helper's pre-read hands back what the object path is built from.
         const data = await this.table.remove(supportingFileId);
         const { error: storageError } = await this.supabase.storage
-            .from(BUCKET)
+            .from(paths_1.SUPPORTING_FILES_BUCKET)
             .remove([
-            (0, paths_1.storagePath)(this.auth.organization_id, data.entity_type, data.entity_id, data.name, data.extension),
+            (0, paths_1.storagePath)((0, tenancy_1.requireOrganization)(this.auth), data.entity_type, data.entity_id, data.name, data.extension),
         ]);
         if (storageError) {
             const fileName = fileNameOf({
@@ -188,8 +187,9 @@ class SupportingFilesResource {
      * are one key. A converted lead takes no new files.
      */
     async prepare(entity, entityId, names) {
+        const organizationId = (0, tenancy_1.requireOrganization)(this.auth);
         if (entity === enum_1.SupportingFilesEntityTypes.LEAD) {
-            await (0, won_1.refuseWonLead)(this.supabase, this.auth.organization_id, entityId);
+            await (0, won_1.refuseWonLead)(this.supabase, organizationId, entityId);
         }
         return names.map((fileName) => {
             const { name, extension } = (0, paths_1.splitFileName)((0, paths_1.sanitizeFileName)(fileName));
@@ -203,7 +203,7 @@ class SupportingFilesResource {
             return {
                 name,
                 extension: extension,
-                path: (0, paths_1.storagePath)(this.auth.organization_id, entity, entityId, name, extension),
+                path: (0, paths_1.storagePath)(organizationId, entity, entityId, name, extension),
             };
         });
     }

package/dist/supporting-files/paths.d.ts

@@ -1,3 +1,5 @@
+/** Storage bucket every supporting file lives in, and every document image. */
+export declare const SUPPORTING_FILES_BUCKET = "supporting-files";
 /**
  * The client-supplied file name, checked before it is allowed anywhere near an object key.
  *