@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/identity/organizations/org-admin.common.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TENANCY_SINGLE_ORG_REASON = exports.LAST_ORG_ADMIN_REASON = void 0;
+exports.requireActiveOrgId = requireActiveOrgId;
+exports.orgRoleRank = orgRoleRank;
+exports.lastOrgAdminConflict = lastOrgAdminConflict;
+exports.lockOrganization = lockOrganization;
+exports.writeAudit = writeAudit;
+exports.signInUrlFrom = signInUrlFrom;
+const common_1 = require("@nestjs/common");
+const identity_constants_1 = require("../identity.constants");
+// =============================================================================
+// Shared rules of the org administration API (#726, PP-6.7)
+// =============================================================================
+/**
+ * The organization an `/api/org/*` request acts on: the ACTIVE org of the
+ * request's principal, which the guard took from the signed token (or the
+ * PAT's / device session's binding) and checked is an active membership.
+ *
+ * NEVER an org id from the path, the query or the body: that is the
+ * confused-deputy hole this API is shaped to avoid (an admin of org A naming
+ * org B). A principal with no active org (a system-scoped node credential)
+ * is refused.
+ */
+function requireActiveOrgId(principal) {
+    const orgId = principal && 'activeOrgId' in principal ? principal.activeOrgId : undefined;
+    if (!orgId) {
+        throw new common_1.ForbiddenException('This credential is not bound to an organization');
+    }
+    return orgId;
+}
+/**
+ * Org role precedence, highest first: an invitation never DOWNGRADES an
+ * existing membership (`org_admin`, then `contributor`, then `viewer`). A role this
+ * list does not know (an app's own org role) ranks lowest.
+ */
+const ORG_ROLE_RANK = {
+    [identity_constants_1.ORG_ADMIN_ROLE]: 3,
+    contributor: 2,
+    viewer: 1,
+};
+/** The rank of an org role name (0 for a role the platform does not rank). */
+function orgRoleRank(roleName) {
+    return roleName ? (ORG_ROLE_RANK[roleName] ?? 0) : 0;
+}
+/** `details.reason` of the 409 refusing to remove the last active org admin. */
+exports.LAST_ORG_ADMIN_REASON = 'LAST_ORG_ADMIN';
+/** `details.reason` of the 409 refusing to create an organization in single mode. */
+exports.TENANCY_SINGLE_ORG_REASON = 'TENANCY_SINGLE_ORG';
+/** The 409 for an action that would leave the organization without an active `org_admin`. */
+function lastOrgAdminConflict() {
+    return new common_1.ConflictException({
+        message: 'This would leave the organization without an active administrator. Make another member an org_admin first.',
+        details: { reason: exports.LAST_ORG_ADMIN_REASON },
+    });
+}
+/**
+ * Serializes the membership writes of one organization for the rest of the
+ * transaction (`SELECT ... FOR UPDATE` on its `organizations` row), so two
+ * administrators demoting each other at once cannot both pass the last-admin
+ * check. The lock is released when the transaction ends.
+ */
+async function lockOrganization(tx, orgId) {
+    await tx.$queryRaw `SELECT id FROM organizations WHERE id = ${orgId}::uuid FOR UPDATE`;
+}
+/** Writes one audit row inside the caller's transaction. */
+async function writeAudit(tx, actorUserId, action, targetType, targetId, meta) {
+    await tx.auditEvent.create({
+        data: { actorUserId, action, targetType, targetId, meta: meta },
+    });
+}
+/** The absolute sign-in URL for an invitation's CTA, or `undefined` without `APP_URL`. */
+function signInUrlFrom(appUrl) {
+    return appUrl ? `${appUrl.replace(/\/+$/, '')}/login` : undefined;
+}
+//# sourceMappingURL=org-admin.common.js.map

package/dist/identity/organizations/org-admin.common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-admin.common.js","sourceRoot":"","sources":["../../../src/identity/organizations/org-admin.common.ts"],"names":[],"mappings":";;;AAoBA,gDAMC;AAcD,kCAEC;AASD,oDAMC;AAQD,4CAEC;AAGD,gCAWC;AAGD,sCAEC;AAtFD,2CAAuE;AAGvE,8DAAuD;AAGvD,gFAAgF;AAChF,4DAA4D;AAC5D,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAAC,SAAgC;IACjE,MAAM,KAAK,GAAG,SAAS,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,2BAAkB,CAAC,iDAAiD,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,aAAa,GAAqC;IACtD,CAAC,mCAAc,CAAC,EAAE,CAAC;IACnB,WAAW,EAAE,CAAC;IACd,MAAM,EAAE,CAAC;CACV,CAAC;AAEF,8EAA8E;AAC9E,SAAgB,WAAW,CAAC,QAAmC;IAC7D,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,gFAAgF;AACnE,QAAA,qBAAqB,GAAG,gBAAgB,CAAC;AAEtD,qFAAqF;AACxE,QAAA,yBAAyB,GAAG,oBAAoB,CAAC;AAE9D,6FAA6F;AAC7F,SAAgB,oBAAoB;IAClC,OAAO,IAAI,0BAAiB,CAAC;QAC3B,OAAO,EACL,4GAA4G;QAC9G,OAAO,EAAE,EAAE,MAAM,EAAE,6BAAqB,EAAE;KAC3C,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACI,KAAK,UAAU,gBAAgB,CAAC,EAAc,EAAE,KAAa;IAClE,MAAM,EAAE,CAAC,SAAS,CAAA,2CAA2C,KAAK,mBAAmB,CAAC;AACxF,CAAC;AAED,4DAA4D;AACrD,KAAK,UAAU,UAAU,CAC9B,EAAc,EACd,WAA0B,EAC1B,MAAc,EACd,UAAkB,EAClB,QAAgB,EAChB,IAA6B;IAE7B,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QACzB,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE;KAChE,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,SAAgB,aAAa,CAAC,MAA0B;IACtD,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC"}

package/dist/identity/organizations/org-invites.controller.d.ts

@@ -0,0 +1,21 @@
+import type { Principal } from '../../core/index';
+import { OrgInvitesService } from './org-invites.service';
+import { CreateOrgInviteDto, OrgInviteListQueryDto } from './dto/org-invite.dto';
+/**
+ * Invitations to the caller's ACTIVE organization (#726, PP-6.7). Every
+ * route acts on `principal.activeOrgId`; no route takes an org id.
+ */
+export declare class OrgInvitesController {
+    private readonly invites;
+    constructor(invites: OrgInvitesService);
+    list(query: OrgInviteListQueryDto, principal: Principal): Promise<{
+        items: import("./org-invites.service").OrgInviteView[];
+        total: number;
+        page: number;
+        pageSize: number;
+        totalPages: number;
+    }>;
+    create(dto: CreateOrgInviteDto, principal: Principal): Promise<import("./org-invites.service").OrgInviteView>;
+    revoke(id: string, principal: Principal): Promise<void>;
+}
+//# sourceMappingURL=org-invites.controller.d.ts.map

package/dist/identity/organizations/org-invites.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-invites.controller.d.ts","sourceRoot":"","sources":["../../../src/identity/organizations/org-invites.controller.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAMlD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EAEtB,MAAM,sBAAsB,CAAC;AAE9B;;;GAGG;AACH,qBAEa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,iBAAiB;IAcjD,IAAI,CAAU,KAAK,EAAE,qBAAqB,EAAsB,SAAS,EAAE,SAAS;;;;;;;IAiBpF,MAAM,CAAS,GAAG,EAAE,kBAAkB,EAAsB,SAAS,EAAE,SAAS;IAkBhF,MAAM,CACkB,EAAE,EAAE,MAAM,EAClB,SAAS,EAAE,SAAS,GACvC,OAAO,CAAC,IAAI,CAAC;CAGjB"}

package/dist/identity/organizations/org-invites.controller.js

@@ -0,0 +1,107 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgInvitesController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const auth_decorator_1 = require("../auth/decorators/auth.decorator");
+const current_principal_decorator_1 = require("../auth/decorators/current-principal.decorator");
+const index_1 = require("../../core/index");
+const identity_constants_1 = require("../identity.constants");
+const org_invites_service_1 = require("./org-invites.service");
+const org_admin_common_1 = require("./org-admin.common");
+const org_invite_dto_1 = require("./dto/org-invite.dto");
+/**
+ * Invitations to the caller's ACTIVE organization (#726, PP-6.7). Every
+ * route acts on `principal.activeOrgId`; no route takes an org id.
+ */
+let OrgInvitesController = class OrgInvitesController {
+    invites;
+    constructor(invites) {
+        this.invites = invites;
+    }
+    async list(query, principal) {
+        return this.invites.list((0, org_admin_common_1.requireActiveOrgId)(principal), query);
+    }
+    async create(dto, principal) {
+        return this.invites.create(principal.userId, (0, org_admin_common_1.requireActiveOrgId)(principal), dto);
+    }
+    async revoke(id, principal) {
+        await this.invites.revoke(principal.userId, (0, org_admin_common_1.requireActiveOrgId)(principal), id);
+    }
+};
+exports.OrgInvitesController = OrgInvitesController;
+__decorate([
+    (0, common_1.Get)(),
+    (0, auth_decorator_1.Auth)({ permissions: [identity_constants_1.PERMISSIONS.ORG_INVITES_READ] }),
+    (0, swagger_1.ApiOperation)({
+        summary: "List the active organization's invitations",
+        description: 'Pending, accepted, revoked and expired invitations, newest first. Pending invitations past their ' +
+            'expiry are marked `expired` when this list is read.',
+    }),
+    (0, swagger_1.ApiQuery)({ name: 'page', required: false, type: Number }),
+    (0, swagger_1.ApiQuery)({ name: 'pageSize', required: false, type: Number }),
+    (0, swagger_1.ApiQuery)({ name: 'status', required: false, enum: ['all', 'pending', 'accepted', 'revoked', 'expired'] }),
+    (0, index_1.ApiDataResponse)(org_invite_dto_1.OrgInviteResponseDto, { pagination: 'flat', description: 'Paginated invitations' }),
+    __param(0, (0, common_1.Query)()),
+    __param(1, (0, current_principal_decorator_1.CurrentPrincipal)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [org_invite_dto_1.OrgInviteListQueryDto, Object]),
+    __metadata("design:returntype", Promise)
+], OrgInvitesController.prototype, "list", null);
+__decorate([
+    (0, common_1.Post)(),
+    (0, auth_decorator_1.Auth)({ permissions: [identity_constants_1.PERMISSIONS.ORG_INVITES_WRITE] }),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Invite someone to the active organization',
+        description: 'Creates (or renews) a pending invitation with an org role, valid for 14 days, and adds the address to ' +
+            'the allowlist so the invitee can sign in. Signing in with that address accepts it. The `org.invitation` ' +
+            'email goes to the invitee after the write commits; the notes are never sent. Re-inviting a pending ' +
+            'address updates its role; an address that already accepted, or is already a member, is a 409. Writes ' +
+            'the `org:invite_created` audit event.',
+    }),
+    (0, index_1.ApiDataResponse)(org_invite_dto_1.OrgInviteResponseDto, { status: 201, description: 'The invitation' }),
+    (0, swagger_1.ApiResponse)({ status: 409, description: 'Already a member, or the invitation was already accepted' }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, current_principal_decorator_1.CurrentPrincipal)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [org_invite_dto_1.CreateOrgInviteDto, Object]),
+    __metadata("design:returntype", Promise)
+], OrgInvitesController.prototype, "create", null);
+__decorate([
+    (0, common_1.Delete)(':id'),
+    (0, auth_decorator_1.Auth)({ permissions: [identity_constants_1.PERMISSIONS.ORG_INVITES_WRITE] }),
+    (0, common_1.HttpCode)(common_1.HttpStatus.NO_CONTENT),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Revoke an invitation',
+        description: 'Marks a pending invitation of the active organization `revoked` (a no-op for a revoked or expired ' +
+            'one). An accepted invitation cannot be revoked (409): remove the member instead. Writes the ' +
+            '`org:invite_revoked` audit event.',
+    }),
+    (0, swagger_1.ApiParam)({ name: 'id', type: String, format: 'uuid' }),
+    (0, swagger_1.ApiResponse)({ status: 204, description: 'Invitation revoked' }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'No such invitation in the active organization' }),
+    (0, swagger_1.ApiResponse)({ status: 409, description: 'The invitation was already accepted' }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __param(1, (0, current_principal_decorator_1.CurrentPrincipal)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, Object]),
+    __metadata("design:returntype", Promise)
+], OrgInvitesController.prototype, "revoke", null);
+exports.OrgInvitesController = OrgInvitesController = __decorate([
+    (0, swagger_1.ApiTags)('Organizations'),
+    (0, common_1.Controller)('org/invites'),
+    __metadata("design:paramtypes", [org_invites_service_1.OrgInvitesService])
+], OrgInvitesController);
+//# sourceMappingURL=org-invites.controller.js.map

package/dist/identity/organizations/org-invites.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-invites.controller.js","sourceRoot":"","sources":["../../../src/identity/organizations/org-invites.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,6CAAyF;AAGzF,sEAAyD;AACzD,gGAAkF;AAClF,4CAAmD;AACnD,8DAAoD;AACpD,+DAA0D;AAC1D,yDAAwD;AACxD,yDAI8B;AAE9B;;;GAGG;AAGI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IACF;IAA7B,YAA6B,OAA0B;QAA1B,YAAO,GAAP,OAAO,CAAmB;IAAG,CAAC;IAcrD,AAAN,KAAK,CAAC,IAAI,CAAU,KAA4B,EAAsB,SAAoB;QACxF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAA,qCAAkB,EAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC;IAeK,AAAN,KAAK,CAAC,MAAM,CAAS,GAAuB,EAAsB,SAAoB;QACpF,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,qCAAkB,EAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;IAgBK,AAAN,KAAK,CAAC,MAAM,CACkB,EAAU,EAClB,SAAoB;QAExC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,IAAA,qCAAkB,EAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,CAAC;CACF,CAAA;AAxDY,oDAAoB;AAezB;IAZL,IAAA,YAAG,GAAE;IACL,IAAA,qBAAI,EAAC,EAAE,WAAW,EAAE,CAAC,gCAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC;IACrD,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,4CAA4C;QACrD,WAAW,EACT,mGAAmG;YACnG,qDAAqD;KACxD,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACzD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC7D,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;IACzG,IAAA,uBAAe,EAAC,qCAAoB,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;IACxF,WAAA,IAAA,cAAK,GAAE,CAAA;IAAgC,WAAA,IAAA,8CAAgB,GAAE,CAAA;;qCAA1C,sCAAqB;;gDAE/C;AAeK;IAbL,IAAA,aAAI,GAAE;IACN,IAAA,qBAAI,EAAC,EAAE,WAAW,EAAE,CAAC,gCAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACtD,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,wGAAwG;YACxG,0GAA0G;YAC1G,qGAAqG;YACrG,uGAAuG;YACvG,uCAAuC;KAC1C,CAAC;IACD,IAAA,uBAAe,EAAC,qCAAoB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;IACrF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IACxF,WAAA,IAAA,aAAI,GAAE,CAAA;IAA2B,WAAA,IAAA,8CAAgB,GAAE,CAAA;;qCAAvC,mCAAkB;;kDAE3C;AAgBK;IAdL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,qBAAI,EAAC,EAAE,WAAW,EAAE,CAAC,gCAAW,CAAC,iBAAiB,CAAC,EAAE,CAAC;IACtD,IAAA,iBAAQ,EAAC,mBAAU,CAAC,UAAU,CAAC;IAC/B,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EACT,oGAAoG;YACpG,8FAA8F;YAC9F,mCAAmC;KACtC,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACtD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAC/D,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;IAC1F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;IAE9E,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAC1B,WAAA,IAAA,8CAAgB,GAAE,CAAA;;;;kDAGpB;+BAvDU,oBAAoB;IAFhC,IAAA,iBAAO,EAAC,eAAe,CAAC;IACxB,IAAA,mBAAU,EAAC,aAAa,CAAC;qCAEc,uCAAiB;GAD5C,oBAAoB,CAwDhC"}

package/dist/identity/organizations/org-invites.service.d.ts

@@ -0,0 +1,128 @@
+import { ConfigService } from '@nestjs/config';
+import type { IdentityPrisma } from '../ports';
+import { type IdentityMetrics, type IdentityNotifier, type OrgInvitationNotice } from '../ports';
+import type { CreateOrgInviteDto, OrgInviteListQueryDto } from './dto/org-invite.dto';
+import type { IdentityInviteRow, IdentityTx } from '../data/identity-db';
+import type { OrgInviteStatus } from '@marinoscar/platform-contract/identity';
+/** How long an invitation stays claimable; re-inviting renews it. */
+export declare const ORG_INVITE_TTL_DAYS = 14;
+/** Audit actions this service writes. */
+export declare const ORG_INVITE_AUDIT: {
+    readonly CREATED: "org:invite_created";
+    readonly REVOKED: "org:invite_revoked";
+};
+type InviteWithRelations = IdentityInviteRow & {
+    role: {
+        name: string;
+    } | null;
+    invitedBy: {
+        id: string;
+        email: string;
+    } | null;
+    acceptedBy: {
+        id: string;
+        email: string;
+    } | null;
+};
+/** One invitation as the API returns it. */
+export interface OrgInviteView {
+    id: string;
+    email: string;
+    role: string;
+    status: OrgInviteStatus;
+    notes: string | null;
+    expiresAt: Date | null;
+    createdAt: Date;
+    acceptedAt: Date | null;
+    invitedBy: {
+        id: string;
+        email: string;
+    } | null;
+    acceptedBy: {
+        id: string;
+        email: string;
+    } | null;
+}
+/** What {@link OrgInvitesService.writeInvite} needs. */
+export interface WriteInviteInput {
+    orgId: string;
+    email: string;
+    roleName: string;
+    invitedById: string;
+    notes?: string;
+}
+/** The email to send once the transaction that wrote an invite has committed. */
+export interface PendingInvitation {
+    invite: IdentityInviteRow;
+    payload: OrgInvitationNotice;
+}
+/**
+ * Invitations to the ACTIVE organization (#726, PP-6.7): list, create (or
+ * renew) and revoke.
+ *
+ * - The org id always comes from the caller's principal (the controller
+ *   resolves it with `requireActiveOrgId`), never from the request.
+ * - Creating an invitation also upserts the `allowed_emails` row, so the
+ *   invitee can sign in (the MemoriaHub `CirclesService.createInvite`
+ *   precedent), audited as the allowlist service audits its own adds.
+ * - The `org.invitation` email goes to the invitee only, through
+ *   `notifyAddress`, AFTER the transaction commits and outside it (CLAUDE.md
+ *   invariant). No invitation token exists, so none can be logged: the
+ *   invitation is claimed by signing in with the invited address
+ *   (`OrganizationsService.claimPendingInvites`).
+ * - Expired invitations are marked `expired` lazily, when the list is read.
+ *
+ * @internal
+ */
+export declare class OrgInvitesService {
+    private readonly prisma;
+    private readonly notifications;
+    private readonly config;
+    private readonly metrics;
+    private readonly logger;
+    constructor(prisma: IdentityPrisma, notifications: IdentityNotifier, config: ConfigService, metrics?: IdentityMetrics);
+    /** The organization's invitations, newest first, after marking lapsed ones `expired`. */
+    list(orgId: string, query: OrgInviteListQueryDto): Promise<{
+        items: OrgInviteView[];
+        total: number;
+        page: number;
+        pageSize: number;
+        totalPages: number;
+    }>;
+    /**
+     * Invite `dto.email` to the organization with `dto.roleName`.
+     *
+     * Re-inviting an address whose invitation is pending (or revoked, or
+     * expired) renews that row: new role, new expiry, status `pending`.
+     * Re-inviting an ACCEPTED invitation (`INVITE_ACCEPTED`), or any address
+     * that is already a member (`ALREADY_MEMBER`), is a 409: change the
+     * member's role instead. An accepted invitation whose member has since been
+     * removed is renewed.
+     */
+    create(actorUserId: string, orgId: string, dto: CreateOrgInviteDto): Promise<OrgInviteView>;
+    /**
+     * Writes (or renews) one invitation and its allowlist entry inside the
+     * caller's transaction, with their audit rows. Sends nothing: the caller
+     * passes the result to {@link dispatchInvitation} after the commit.
+     */
+    writeInvite(tx: IdentityTx, input: WriteInviteInput): Promise<PendingInvitation>;
+    /**
+     * Sends the `org.invitation` email for an invitation whose transaction has
+     * COMMITTED, and counts it. Never inside a transaction; `notifyAddress`
+     * never rejects, so a mail outage cannot fail the request. The invite's
+     * notes are not in the payload.
+     */
+    dispatchInvitation(pending: PendingInvitation): Promise<void>;
+    /**
+     * Revoke a pending invitation of the organization. Revoking a revoked or
+     * expired one is a no-op; an accepted one is a 409 (remove the member
+     * instead). An id of another organization is a 404, like a missing one.
+     */
+    revoke(actorUserId: string, orgId: string, inviteId: string): Promise<void>;
+    /** Marks the organization's lapsed pending invitations `expired`. */
+    private expireLapsed;
+}
+/** The API view of an invitation (`role` falls back to the default org role, as a NULL `role_id` means). */
+export declare function toInviteView(row: InviteWithRelations): OrgInviteView;
+export {};
+//# sourceMappingURL=org-invites.service.d.ts.map

package/dist/identity/organizations/org-invites.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-invites.service.d.ts","sourceRoot":"","sources":["../../../src/identity/organizations/org-invites.service.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAI/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAIL,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACzB,MAAM,UAAU,CAAC;AAKlB,OAAO,KAAK,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,KAAK,EAAE,iBAAiB,EAAqB,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAE9E,qEAAqE;AACrE,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC,yCAAyC;AACzC,eAAO,MAAM,gBAAgB;;;CAGnB,CAAC;AAWX,KAAK,mBAAmB,GAAG,iBAAiB,GAAG;IAC7C,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC9B,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChD,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAClD,CAAC;AAEF,4CAA4C;AAC5C,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;IACxB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAChD,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAClD;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,iFAAiF;AACjF,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,iBAAiB,CAAC;IAC1B,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBACa,iBAAiB;IAID,OAAO,CAAC,QAAQ,CAAC,MAAM;IACrB,OAAO,CAAC,QAAQ,CAAC,aAAa;IACzD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;gBAGjB,MAAM,EAAE,cAAc,EACpB,aAAa,EAAE,gBAAgB,EAC1D,MAAM,EAAE,aAAa,EAErB,OAAO,GAAE,eAAuC;IAGnE,yFAAyF;IACnF,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB;;;;;;;IA4BtD;;;;;;;;;OASG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,GAAG,OAAO,CAAC,aAAa,CAAC;IAwBjG;;;;OAIG;IACG,WAAW,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IA+FtF;;;;;OAKG;IACG,kBAAkB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;IAMnE;;;;OAIG;IACG,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgCjF,qEAAqE;YACvD,YAAY;CAM3B;AAED,4GAA4G;AAC5G,wBAAgB,YAAY,CAAC,GAAG,EAAE,mBAAmB,GAAG,aAAa,CAapE"}

package/dist/identity/organizations/org-invites.service.js

@@ -0,0 +1,294 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var OrgInvitesService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrgInvitesService = exports.ORG_INVITE_AUDIT = exports.ORG_INVITE_TTL_DAYS = void 0;
+exports.toInviteView = toInviteView;
+const common_1 = require("@nestjs/common");
+const config_1 = require("@nestjs/config");
+const api_1 = require("@opentelemetry/api");
+const index_1 = require("../../core/index");
+const ports_1 = require("../ports");
+const index_2 = require("../../core/index");
+const identity_constants_1 = require("../identity.constants");
+const role_catalog_1 = require("../roles/role-catalog");
+const org_admin_common_1 = require("./org-admin.common");
+/** How long an invitation stays claimable; re-inviting renews it. */
+exports.ORG_INVITE_TTL_DAYS = 14;
+/** Audit actions this service writes. */
+exports.ORG_INVITE_AUDIT = {
+    CREATED: 'org:invite_created',
+    REVOKED: 'org:invite_revoked',
+};
+/** The allowlist service's own audit action, reused for the entry an invite adds. */
+const ALLOWLIST_ADD_AUDIT = 'allowlist:add';
+const INVITE_INCLUDE = {
+    role: { select: { name: true } },
+    invitedBy: { select: { id: true, email: true } },
+    acceptedBy: { select: { id: true, email: true } },
+};
+/**
+ * Invitations to the ACTIVE organization (#726, PP-6.7): list, create (or
+ * renew) and revoke.
+ *
+ * - The org id always comes from the caller's principal (the controller
+ *   resolves it with `requireActiveOrgId`), never from the request.
+ * - Creating an invitation also upserts the `allowed_emails` row, so the
+ *   invitee can sign in (the MemoriaHub `CirclesService.createInvite`
+ *   precedent), audited as the allowlist service audits its own adds.
+ * - The `org.invitation` email goes to the invitee only, through
+ *   `notifyAddress`, AFTER the transaction commits and outside it (CLAUDE.md
+ *   invariant). No invitation token exists, so none can be logged: the
+ *   invitation is claimed by signing in with the invited address
+ *   (`OrganizationsService.claimPendingInvites`).
+ * - Expired invitations are marked `expired` lazily, when the list is read.
+ *
+ * @internal
+ */
+let OrgInvitesService = OrgInvitesService_1 = class OrgInvitesService {
+    prisma;
+    notifications;
+    config;
+    metrics;
+    logger = new common_1.Logger(OrgInvitesService_1.name);
+    constructor(prisma, notifications, config, metrics = ports_1.NOOP_IDENTITY_METRICS) {
+        this.prisma = prisma;
+        this.notifications = notifications;
+        this.config = config;
+        this.metrics = metrics;
+    }
+    /** The organization's invitations, newest first, after marking lapsed ones `expired`. */
+    async list(orgId, query) {
+        api_1.trace.getActiveSpan()?.setAttribute('org.id', orgId);
+        await this.expireLapsed(orgId);
+        const where = {
+            orgId,
+            ...(query.status !== 'all' ? { status: query.status } : {}),
+        };
+        const [rows, total] = await Promise.all([
+            this.prisma.invite.findMany({
+                where,
+                include: INVITE_INCLUDE,
+                orderBy: { createdAt: 'desc' },
+                skip: (query.page - 1) * query.pageSize,
+                take: query.pageSize,
+            }),
+            this.prisma.invite.count({ where }),
+        ]);
+        return {
+            items: rows.map((row) => toInviteView(row)),
+            total,
+            page: query.page,
+            pageSize: query.pageSize,
+            totalPages: Math.ceil(total / query.pageSize),
+        };
+    }
+    /**
+     * Invite `dto.email` to the organization with `dto.roleName`.
+     *
+     * Re-inviting an address whose invitation is pending (or revoked, or
+     * expired) renews that row: new role, new expiry, status `pending`.
+     * Re-inviting an ACCEPTED invitation (`INVITE_ACCEPTED`), or any address
+     * that is already a member (`ALREADY_MEMBER`), is a 409: change the
+     * member's role instead. An accepted invitation whose member has since been
+     * removed is renewed.
+     */
+    async create(actorUserId, orgId, dto) {
+        api_1.trace.getActiveSpan()?.setAttribute('org.id', orgId);
+        const pending = await this.prisma.$transaction((tx) => this.writeInvite(tx, {
+            orgId,
+            email: dto.email,
+            roleName: dto.roleName,
+            invitedById: actorUserId,
+            ...(dto.notes !== undefined ? { notes: dto.notes } : {}),
+        }));
+        // Committed: the invitation and the allowlist entry are real, so the
+        // email can promise a sign-in that works.
+        await this.dispatchInvitation(pending);
+        const invite = await this.prisma.invite.findUniqueOrThrow({
+            where: { id: pending.invite.id },
+            include: INVITE_INCLUDE,
+        });
+        return toInviteView(invite);
+    }
+    /**
+     * Writes (or renews) one invitation and its allowlist entry inside the
+     * caller's transaction, with their audit rows. Sends nothing: the caller
+     * passes the result to {@link dispatchInvitation} after the commit.
+     */
+    async writeInvite(tx, input) {
+        const { orgId, email, roleName, invitedById } = input;
+        // Fail closed before any read: an unknown role, a system role (`admin`) or a
+        // role registered `assignable: false` can never be put on an invitation.
+        (0, role_catalog_1.assertRoleAssignable)(roleName, 'org');
+        const [org, role, inviter] = await Promise.all([
+            tx.organization.findUnique({ where: { id: orgId }, select: { id: true, name: true } }),
+            tx.role.findUnique({ where: { name: roleName }, select: { id: true, name: true, scope: true } }),
+            tx.user.findUnique({
+                where: { id: invitedById },
+                select: { email: true, displayName: true, providerDisplayName: true },
+            }),
+        ]);
+        if (!org) {
+            throw new common_1.NotFoundException('Organization not found');
+        }
+        if (!role || role.scope !== 'org') {
+            throw new index_2.DatabaseSeedException(`Org role "${roleName}"`, 'npm run prisma:seed');
+        }
+        const [member, existing] = await Promise.all([
+            tx.membership.findFirst({ where: { orgId, user: { email } }, select: { id: true } }),
+            tx.invite.findUnique({
+                where: { orgId_email: { orgId, email } },
+                select: { id: true, status: true },
+            }),
+        ]);
+        if (member && existing?.status === 'accepted') {
+            throw new common_1.ConflictException({
+                message: `The invitation for ${email} was already accepted; change the member's role instead`,
+                details: { reason: 'INVITE_ACCEPTED' },
+            });
+        }
+        if (member) {
+            throw new common_1.ConflictException({
+                message: `${email} is already a member of this organization; change their role instead`,
+                details: { reason: 'ALREADY_MEMBER' },
+            });
+        }
+        // An accepted invitation whose invitee has since been REMOVED is renewed
+        // like any other: otherwise a removed member could never be invited back.
+        const expiresAt = new Date(Date.now() + exports.ORG_INVITE_TTL_DAYS * 24 * 60 * 60 * 1000);
+        const fields = {
+            status: 'pending',
+            roleId: role.id,
+            invitedById,
+            expiresAt,
+            notes: input.notes ?? null,
+            acceptedById: null,
+            acceptedAt: null,
+        };
+        const invite = await tx.invite.upsert({
+            where: { orgId_email: { orgId, email } },
+            update: fields,
+            create: { orgId, email, ...fields },
+        });
+        // The invitee must be able to sign in. An existing entry (claimed or
+        // not) already lets them, and is left exactly as it is.
+        const allowed = await tx.allowedEmail.findUnique({ where: { email }, select: { id: true } });
+        if (!allowed) {
+            const entry = await tx.allowedEmail.create({
+                data: { email, addedById: invitedById, notes: `Invited to organization ${org.name}` },
+            });
+            await (0, org_admin_common_1.writeAudit)(tx, invitedById, ALLOWLIST_ADD_AUDIT, 'allowed_email', entry.id, {
+                email,
+                source: 'org_invite',
+                orgId,
+            });
+        }
+        await (0, org_admin_common_1.writeAudit)(tx, invitedById, exports.ORG_INVITE_AUDIT.CREATED, 'org_invite', invite.id, {
+            orgId,
+            email,
+            role: role.name,
+            renewed: existing !== null,
+        });
+        const invitedBy = inviter?.displayName || inviter?.providerDisplayName || inviter?.email;
+        const signInUrl = (0, org_admin_common_1.signInUrlFrom)(this.config.get('appUrl'));
+        return {
+            invite,
+            payload: {
+                recipientEmail: email,
+                orgName: org.name,
+                roleName: role.name,
+                ...(invitedBy ? { invitedBy } : {}),
+                ...(signInUrl ? { signInUrl } : {}),
+            },
+        };
+    }
+    /**
+     * Sends the `org.invitation` email for an invitation whose transaction has
+     * COMMITTED, and counts it. Never inside a transaction; `notifyAddress`
+     * never rejects, so a mail outage cannot fail the request. The invite's
+     * notes are not in the payload.
+     */
+    async dispatchInvitation(pending) {
+        this.metrics.add('orgInvitesCreated');
+        this.logger.log(`Organization invitation ${pending.invite.id} written for org ${pending.invite.orgId}`);
+        await this.notifications.orgInvitation(pending.payload.recipientEmail, pending.payload);
+    }
+    /**
+     * Revoke a pending invitation of the organization. Revoking a revoked or
+     * expired one is a no-op; an accepted one is a 409 (remove the member
+     * instead). An id of another organization is a 404, like a missing one.
+     */
+    async revoke(actorUserId, orgId, inviteId) {
+        api_1.trace.getActiveSpan()?.setAttribute('org.id', orgId);
+        const invite = await this.prisma.invite.findFirst({
+            where: { id: inviteId, orgId },
+            select: { id: true, status: true, email: true },
+        });
+        if (!invite) {
+            throw new common_1.NotFoundException('Invitation not found');
+        }
+        if (invite.status === 'accepted') {
+            throw new common_1.ConflictException({
+                message: 'An accepted invitation cannot be revoked; remove the member instead',
+                details: { reason: 'INVITE_ACCEPTED' },
+            });
+        }
+        if (invite.status !== 'pending') {
+            return;
+        }
+        await this.prisma.$transaction(async (tx) => {
+            await tx.invite.updateMany({
+                where: { id: invite.id, status: 'pending' },
+                data: { status: 'revoked' },
+            });
+            await (0, org_admin_common_1.writeAudit)(tx, actorUserId, exports.ORG_INVITE_AUDIT.REVOKED, 'org_invite', invite.id, {
+                orgId,
+                email: invite.email,
+            });
+        });
+    }
+    /** Marks the organization's lapsed pending invitations `expired`. */
+    async expireLapsed(orgId) {
+        await this.prisma.invite.updateMany({
+            where: { orgId, status: 'pending', expiresAt: { lt: new Date() } },
+            data: { status: 'expired' },
+        });
+    }
+};
+exports.OrgInvitesService = OrgInvitesService;
+exports.OrgInvitesService = OrgInvitesService = OrgInvitesService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(index_1.PLATFORM_PRISMA)),
+    __param(1, (0, common_1.Inject)(ports_1.IDENTITY_NOTIFIER)),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(ports_1.IDENTITY_METRICS)),
+    __metadata("design:paramtypes", [Object, Object, config_1.ConfigService, Object])
+], OrgInvitesService);
+/** The API view of an invitation (`role` falls back to the default org role, as a NULL `role_id` means). */
+function toInviteView(row) {
+    return {
+        id: row.id,
+        email: row.email,
+        role: row.role?.name ?? identity_constants_1.DEFAULT_ORG_ROLE,
+        status: row.status,
+        notes: row.notes,
+        expiresAt: row.expiresAt,
+        createdAt: row.createdAt,
+        acceptedAt: row.acceptedAt,
+        invitedBy: row.invitedBy ?? null,
+        acceptedBy: row.acceptedBy ?? null,
+    };
+}
+//# sourceMappingURL=org-invites.service.js.map