@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/identity/device-auth/tasks/device-code-cleanup.task.js

@@ -0,0 +1,58 @@
+"use strict";
+// =============================================================================
+// The nightly device-code cleanup scheduler (issue #353, epic #345)
+// =============================================================================
+//
+// ⚠ THIS TASK DELETES NOTHING. It enqueues a job, and
+// `device-auth/handlers/device-code-cleanup.handler.ts` does the work on a
+// worker slot. See that handler's header for why, and
+// `jobs/housekeeping.enqueue.ts` for the two guards in front of the enqueue.
+//
+// 2am, unchanged from before the conversion.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var DeviceCodeCleanupTask_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeviceCodeCleanupTask = void 0;
+const common_1 = require("@nestjs/common");
+const schedule_1 = require("@nestjs/schedule");
+const ports_1 = require("../../ports");
+const device_code_cleanup_handler_1 = require("../handlers/device-code-cleanup.handler");
+let DeviceCodeCleanupTask = DeviceCodeCleanupTask_1 = class DeviceCodeCleanupTask {
+    jobs;
+    logger = new common_1.Logger(DeviceCodeCleanupTask_1.name);
+    constructor(jobs) {
+        this.jobs = jobs;
+    }
+    async handleCleanup() {
+        await this.jobs.enqueueHousekeepingJob({
+            logger: this.logger,
+            type: device_code_cleanup_handler_1.DEVICE_CODE_CLEANUP_TYPE,
+            what: 'device code cleanup',
+        });
+    }
+};
+exports.DeviceCodeCleanupTask = DeviceCodeCleanupTask;
+__decorate([
+    (0, schedule_1.Cron)(schedule_1.CronExpression.EVERY_DAY_AT_2AM),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], DeviceCodeCleanupTask.prototype, "handleCleanup", null);
+exports.DeviceCodeCleanupTask = DeviceCodeCleanupTask = DeviceCodeCleanupTask_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(ports_1.IDENTITY_JOBS)),
+    __metadata("design:paramtypes", [Object])
+], DeviceCodeCleanupTask);
+//# sourceMappingURL=device-code-cleanup.task.js.map

package/dist/identity/device-auth/tasks/device-code-cleanup.task.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-code-cleanup.task.js","sourceRoot":"","sources":["../../../../src/identity/device-auth/tasks/device-code-cleanup.task.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,oEAAoE;AACpE,gFAAgF;AAChF,EAAE;AACF,sDAAsD;AACtD,2EAA2E;AAC3E,sDAAsD;AACtD,6EAA6E;AAC7E,EAAE;AACF,6CAA6C;AAC7C,gFAAgF;;;;;;;;;;;;;;;;AAEhF,2CAA4D;AAC5D,+CAAwD;AAExD,uCAAmE;AACnE,yFAAmF;AAG5E,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAIU;IAHzB,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAEjE,YAC0C,IAAsB;QAAtB,SAAI,GAAJ,IAAI,CAAkB;IAC7D,CAAC;IAGE,AAAN,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC;YACrC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,sDAAwB;YAC9B,IAAI,EAAE,qBAAqB;SAC5B,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAfY,sDAAqB;AAQ1B;IADL,IAAA,eAAI,EAAC,yBAAc,CAAC,gBAAgB,CAAC;;;;0DAOrC;gCAdU,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,qBAAa,CAAC,CAAA;;GAJb,qBAAqB,CAejC"}

package/dist/identity/extensions/user-extensions.d.ts

@@ -0,0 +1,263 @@
+import { type Registry } from '../../core/index';
+/**
+ * The JSON object an extension contributes. Typed as `object` so an interface or a
+ * class-free record both fit; the runtime check ({@link checkUserExtensionContribution})
+ * is what holds it to plain JSON.
+ */
+type Contribution = object;
+/**
+ * The default timeout of a current-user extension, in milliseconds. It runs on every `/auth/me`.
+ *
+ * @stability experimental
+ */
+export declare const DEFAULT_CURRENT_USER_EXTENSION_TIMEOUT_MS = 1500;
+/**
+ * The default timeout of a user-list extension, in milliseconds.
+ *
+ * @stability experimental
+ */
+export declare const DEFAULT_USER_LIST_EXTENSION_TIMEOUT_MS = 3000;
+/**
+ * The longest timeout an extension may ask for, in milliseconds.
+ *
+ * @stability experimental
+ */
+export declare const MAX_USER_EXTENSION_TIMEOUT_MS = 10000;
+/**
+ * What a current-user extension is told about the request.
+ *
+ * @stability experimental
+ */
+export interface CurrentUserExtensionContext {
+    /** The organization the session acts in (`null` when it acts in none). */
+    readonly orgId: string | null;
+    /** Aborted when the extension's timeout elapses; pass it to the I/O the extension starts. */
+    readonly signal: AbortSignal;
+}
+/**
+ * What a user-list extension is told about the request.
+ *
+ * @stability experimental
+ */
+export interface UserListExtensionContext {
+    /** The administrator who asked for the list, when known. */
+    readonly viewerId: string | null;
+    /** The organization the session acts in (`null` when it acts in none). */
+    readonly orgId: string | null;
+    /** Aborted when the extension's timeout elapses; pass it to the I/O the extension starts. */
+    readonly signal: AbortSignal;
+}
+/**
+ * One extension of `GET /api/auth/me`.
+ *
+ * @example
+ * ```ts
+ * registerCurrentUserExtension({
+ *   id: 'billing',
+ *   resolve: async (userId) => ({ plan: await plans.planOf(userId) }),
+ * });
+ * ```
+ *
+ * @stability experimental
+ */
+export interface CurrentUserExtension {
+    /** Lower-case id (`USER_EXTENSION_ID_PATTERN`); the key of the contribution under `extensions`. */
+    id: string;
+    /**
+     * The contribution for the signed-in user: a small JSON object, or
+     * `null` / `undefined` for none. Throwing skips this extension and is logged.
+     *
+     * @param userId - the signed-in user's id.
+     * @param ctx - the request context.
+     */
+    resolve(userId: string, ctx: CurrentUserExtensionContext): Promise<Contribution | null | undefined> | Contribution | null | undefined;
+    /**
+     * How long `resolve` may take before the extension is skipped.
+     *
+     * @defaultValue {@link DEFAULT_CURRENT_USER_EXTENSION_TIMEOUT_MS}
+     */
+    timeoutMs?: number;
+}
+/**
+ * One extension of each row of `GET /api/users`.
+ *
+ * @example
+ * ```ts
+ * registerUserListExtension({
+ *   id: 'billing',
+ *   // ONE query for the whole page, never one per row.
+ *   resolve: async (userIds) => new Map((await plans.forUsers(userIds)).map((p) => [p.userId, { plan: p.name }])),
+ * });
+ * ```
+ *
+ * @stability experimental
+ */
+export interface UserListExtension {
+    /** Lower-case id (`USER_EXTENSION_ID_PATTERN`); the key of the contribution under each row's `extensions`. */
+    id: string;
+    /**
+     * The contributions for the users of the page, as a `Map` from user id to a
+     * small JSON object. Called ONCE per request with every id of the page. A user
+     * missing from the map gets no contribution; an id that is not in `userIds` is
+     * ignored. Throwing skips this extension and is logged.
+     *
+     * @param userIds - the ids of the users on this page.
+     * @param ctx - the request context.
+     */
+    resolve(userIds: readonly string[], ctx: UserListExtensionContext): Promise<ReadonlyMap<string, Contribution | null | undefined>> | ReadonlyMap<string, Contribution | null | undefined>;
+    /**
+     * How long `resolve` may take before the extension is skipped.
+     *
+     * @defaultValue {@link DEFAULT_USER_LIST_EXTENSION_TIMEOUT_MS}
+     */
+    timeoutMs?: number;
+}
+/**
+ * The registered extensions of `GET /api/auth/me`, in registration order.
+ *
+ * @stability experimental
+ */
+export declare const currentUserExtensionRegistry: Registry<CurrentUserExtension>;
+/**
+ * The registered extensions of the rows of `GET /api/users`, in registration order.
+ *
+ * @stability experimental
+ */
+export declare const userListExtensionRegistry: Registry<UserListExtension>;
+/**
+ * Add a field group to `GET /api/auth/me`, under `extensions.<id>`.
+ *
+ * Call it once, at import time (before the application bootstraps), from
+ * `apps/api/src/app-registrations/identity.ts`. The slice resolves it on every
+ * request, bounds and checks what it returns (JSON only, no secrets, see the
+ * file header) and skips it, with a logged warning, when it throws or times out.
+ *
+ * @param extension - the id and the resolver.
+ * @throws RegistryError when the id is malformed or taken, the resolver is missing or the timeout is out of range, or the registry is frozen.
+ *
+ * @example
+ * ```ts
+ * registerCurrentUserExtension({ id: 'billing', resolve: async (userId) => ({ plan: 'pro' }) });
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export declare function registerCurrentUserExtension(extension: CurrentUserExtension): void;
+/**
+ * Add a field group to each row of `GET /api/users`, under `extensions.<id>`.
+ *
+ * The resolver is BATCHED: it receives every id of the page at once and answers
+ * a `Map`, so a list of 100 users costs the extension one query, not 100. The
+ * same bounds and checks as {@link registerCurrentUserExtension} apply per row.
+ *
+ * @param extension - the id and the batch resolver.
+ * @throws RegistryError when the id is malformed or taken, the resolver is missing or the timeout is out of range, or the registry is frozen.
+ *
+ * @example
+ * ```ts
+ * registerUserListExtension({
+ *   id: 'billing',
+ *   resolve: async (ids) => new Map((await plans.forUsers(ids)).map((p) => [p.userId, { plan: p.name }])),
+ * });
+ * ```
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export declare function registerUserListExtension(extension: UserListExtension): void;
+/**
+ * A contribution that passed {@link checkUserExtensionContribution}.
+ *
+ * @stability experimental
+ */
+export interface UserExtensionAccepted {
+    /** The check passed. */
+    ok: true;
+    /** A clean deep copy of the contribution, safe to merge into a payload. */
+    value: Record<string, unknown>;
+    /** Its size as JSON, in UTF-8 bytes. */
+    bytes: number;
+}
+/**
+ * A contribution that {@link checkUserExtensionContribution} refused.
+ *
+ * @stability experimental
+ */
+export interface UserExtensionRefused {
+    /** The check failed. */
+    ok: false;
+    /** Why, naming the offending path but never its value. */
+    reason: string;
+}
+/**
+ * The outcome of {@link checkUserExtensionContribution}.
+ *
+ * @stability experimental
+ */
+export type UserExtensionCheck = UserExtensionAccepted | UserExtensionRefused;
+/**
+ * Check one extension's contribution against the contract (JSON only, bounded,
+ * no secret) and return a clean deep copy of it. Exported for the conformance
+ * test and for an app that wants to check its own resolver; the slice calls it
+ * on every contribution.
+ *
+ * @param value - what the extension returned.
+ * @param maxBytes - the byte bound of the JSON (`USER_EXTENSION_LIMITS`).
+ * @returns the clean copy and its size, or why it was refused.
+ *
+ * @stability experimental
+ */
+export declare function checkUserExtensionContribution(value: unknown, maxBytes: number): UserExtensionCheck;
+/**
+ * Where a refusal or a failure is reported. `Logger` of `@nestjs/common` satisfies it.
+ *
+ * @stability experimental
+ */
+export interface UserExtensionLog {
+    /** Report a skipped extension. */
+    warn(message: string): void;
+}
+/**
+ * The most calls of one extension that may be running at once. A call that
+ * timed out is abandoned, not killed (JavaScript cannot), so an extension that
+ * hangs on every request would otherwise pile up work without bound; past this
+ * many unfinished calls it is skipped until some finish.
+ *
+ * @stability experimental
+ */
+export declare const MAX_IN_FLIGHT_PER_USER_EXTENSION = 16;
+/**
+ * Resolve every current-user extension for one user. Never throws: an extension
+ * that fails, times out or returns something the contract refuses is skipped and
+ * logged. Extensions run concurrently; the result keeps registration order.
+ *
+ * @param userId - the signed-in user.
+ * @param context - the organization the session acts in.
+ * @param log - where skipped extensions are reported. Default the slice's logger.
+ * @returns the `extensions` object, or `undefined` when no extension contributed.
+ *
+ * @stability experimental
+ */
+export declare function resolveCurrentUserExtensions(userId: string, context: {
+    orgId: string | null;
+}, log?: UserExtensionLog): Promise<Record<string, Record<string, unknown>> | undefined>;
+/**
+ * Resolve every user-list extension for one page of users, each extension called
+ * ONCE with the page's ids. Never throws: a failing, slow or refused extension is
+ * skipped (for the whole page, or for the one row whose contribution was refused)
+ * and logged.
+ *
+ * @param userIds - the ids of the users on the page.
+ * @param context - the requesting administrator and the organization.
+ * @param log - where skipped extensions are reported. Default the slice's logger.
+ * @returns a map from user id to that user's `extensions`; users with none are absent.
+ *
+ * @stability experimental
+ */
+export declare function resolveUserListExtensions(userIds: readonly string[], context: {
+    viewerId: string | null;
+    orgId: string | null;
+}, log?: UserExtensionLog): Promise<Map<string, Record<string, Record<string, unknown>>>>;
+export {};
+//# sourceMappingURL=user-extensions.d.ts.map

package/dist/identity/extensions/user-extensions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-extensions.d.ts","sourceRoot":"","sources":["../../../src/identity/extensions/user-extensions.ts"],"names":[],"mappings":"AAkDA,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAEjE;;;;GAIG;AACH,KAAK,YAAY,GAAG,MAAM,CAAC;AAE3B;;;;GAIG;AACH,eAAO,MAAM,yCAAyC,OAAO,CAAC;AAC9D;;;;GAIG;AACH,eAAO,MAAM,sCAAsC,OAAO,CAAC;AAC3D;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AAEpD;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,0EAA0E;IAC1E,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,6FAA6F;IAC7F,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,oBAAoB;IACnC,mGAAmG;IACnG,EAAE,EAAE,MAAM,CAAC;IACX;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,2BAA2B,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,GAAG,SAAS,CAAC,GAAG,YAAY,GAAG,IAAI,GAAG,SAAS,CAAC;IACtI;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBAAiB;IAChC,8GAA8G;IAC9G,EAAE,EAAE,MAAM,CAAC;IACX;;;;;;;;OAQG;IACH,OAAO,CACL,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,GAAG,EAAE,wBAAwB,GAC5B,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACxH;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAYD;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,EAAE,QAAQ,CAAC,oBAAoB,CAKtE,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,iBAAiB,CAKhE,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,oBAAoB,GAAG,IAAI,CAElF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAE5E;AAsGD;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,wBAAwB;IACxB,EAAE,EAAE,IAAI,CAAC;IACT,2EAA2E;IAC3E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,wBAAwB;IACxB,EAAE,EAAE,KAAK,CAAC;IACV,0DAA0D;IAC1D,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;AAE9E;;;;;;;;;;;GAWG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,kBAAkB,CAOnG;AAMD;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kCAAkC;IAClC,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AA4BD;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC,KAAK,CAAC;AA2CnD;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EACjC,GAAG,GAAE,gBAA6B,GACjC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAoC9D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,OAAO,EAAE;IAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC1D,GAAG,GAAE,gBAA6B,GACjC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAqD/D"}