@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.11

package/dist/identity/organizations/organizations.metrics.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORGANIZATIONS_APP_METRICS = void 0;
+/**
+ * The two organization-administration counters, as app-metric declarations the
+ * app registers with its metric registry (`registerAppMetrics`). No attributes:
+ * an org id on a metric label is unbounded cardinality and a tenant identifier.
+ *
+ * @stability stable
+ */
+exports.ORGANIZATIONS_APP_METRICS = [
+    {
+        key: 'orgInvitesCreated',
+        name: 'app.org.invites_created',
+        kind: 'counter',
+        unit: '{invite}',
+        description: 'Organization invitations created or renewed (an organization creation\'s first-admin invitation included).',
+    },
+    {
+        key: 'orgMembersRemoved',
+        name: 'app.org.members_removed',
+        kind: 'counter',
+        unit: '{member}',
+        description: 'Members removed from an organization by an organization administrator.',
+    },
+];
+//# sourceMappingURL=organizations.metrics.js.map

package/dist/identity/organizations/organizations.metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.metrics.js","sourceRoot":"","sources":["../../../src/identity/organizations/organizations.metrics.ts"],"names":[],"mappings":";;;AA6BA;;;;;;GAMG;AACU,QAAA,yBAAyB,GAGlC;IACF;QACE,GAAG,EAAE,mBAAmB;QACxB,IAAI,EAAE,yBAAyB;QAC/B,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,4GAA4G;KAC1H;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,IAAI,EAAE,yBAAyB;QAC/B,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,UAAU;QAChB,WAAW,EAAE,wEAAwE;KACtF;CACF,CAAC"}

package/dist/identity/organizations/organizations.module.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Organizations (PP-6.1). Switch-org (PP-6.4) is `POST /api/auth/switch-org`
+ * in `AuthModule`.
+ *
+ * Tenancy mode (PP-6.2): `TenancyService`, the parsed `TENANCY_MODE` the
+ * sign-in path asks, and the `tenancy.mode` doctor check.
+ *
+ * Org administration (PP-6.7, #726): the active organization's members
+ * (`/api/org/members`) and invitations (`/api/org/invites`), and the
+ * deployment's organizations (`/api/admin/organizations`). Global; mounted by
+ * `IdentityModule.forRoot()`.
+ *
+ * @stability experimental
+ */
+export declare class OrganizationsModule {
+}
+//# sourceMappingURL=organizations.module.d.ts.map

package/dist/identity/organizations/organizations.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.module.d.ts","sourceRoot":"","sources":["../../../src/identity/organizations/organizations.module.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;;;GAaG;AAIH,qBAiBa,mBAAmB;CAAG"}

package/dist/identity/organizations/organizations.module.js

@@ -0,0 +1,60 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrganizationsModule = void 0;
+const common_1 = require("@nestjs/common");
+const principal_cache_module_1 = require("../auth/principal-cache/principal-cache.module");
+const organizations_service_1 = require("./organizations.service");
+const tenancy_service_1 = require("./tenancy.service");
+const tenancy_mode_doctor_check_1 = require("./doctor/tenancy-mode.doctor-check");
+const org_members_service_1 = require("./org-members.service");
+const org_invites_service_1 = require("./org-invites.service");
+const organizations_admin_service_1 = require("./organizations-admin.service");
+const org_members_controller_1 = require("./org-members.controller");
+const org_invites_controller_1 = require("./org-invites.controller");
+const organizations_admin_controller_1 = require("./organizations-admin.controller");
+/**
+ * Organizations (PP-6.1). Switch-org (PP-6.4) is `POST /api/auth/switch-org`
+ * in `AuthModule`.
+ *
+ * Tenancy mode (PP-6.2): `TenancyService`, the parsed `TENANCY_MODE` the
+ * sign-in path asks, and the `tenancy.mode` doctor check.
+ *
+ * Org administration (PP-6.7, #726): the active organization's members
+ * (`/api/org/members`) and invitations (`/api/org/invites`), and the
+ * deployment's organizations (`/api/admin/organizations`). Global; mounted by
+ * `IdentityModule.forRoot()`.
+ *
+ * @stability experimental
+ */
+// GLOBAL (#727): `AuthService` and the test login use OrganizationsService and
+// TenancyService without an import edge, so `IdentityModule.forRoot()` can mount
+// it after the host modules (the app's old discovery order).
+let OrganizationsModule = class OrganizationsModule {
+};
+exports.OrganizationsModule = OrganizationsModule;
+exports.OrganizationsModule = OrganizationsModule = __decorate([
+    (0, common_1.Global)(),
+    (0, common_1.Module)({
+        // PP-6.4 (#724): membership mutations invalidate the principal cache.
+        // #726: invitations are emailed through the notification dispatcher.
+        // The database and the notifier are the app's global host ports.
+        imports: [principal_cache_module_1.PrincipalCacheModule],
+        controllers: [org_members_controller_1.OrgMembersController, org_invites_controller_1.OrgInvitesController, organizations_admin_controller_1.OrganizationsAdminController],
+        providers: [
+            organizations_service_1.OrganizationsService,
+            tenancy_service_1.TenancyService,
+            tenancy_mode_doctor_check_1.TenancyModeDoctorCheck,
+            org_members_service_1.OrgMembersService,
+            org_invites_service_1.OrgInvitesService,
+            organizations_admin_service_1.OrganizationsAdminService,
+        ],
+        exports: [organizations_service_1.OrganizationsService, tenancy_service_1.TenancyService],
+    })
+], OrganizationsModule);
+//# sourceMappingURL=organizations.module.js.map

package/dist/identity/organizations/organizations.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.module.js","sourceRoot":"","sources":["../../../src/identity/organizations/organizations.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAgD;AAChD,2FAAsF;AACtF,mEAA+D;AAC/D,uDAAmD;AACnD,kFAA4E;AAC5E,+DAA0D;AAC1D,+DAA0D;AAC1D,+EAA0E;AAC1E,qEAAgE;AAChE,qEAAgE;AAChE,qFAAgF;AAEhF;;;;;;;;;;;;;GAaG;AACH,+EAA+E;AAC/E,iFAAiF;AACjF,6DAA6D;AAkBtD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAAG,CAAA;AAAtB,kDAAmB;8BAAnB,mBAAmB;IAjB/B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACN,sEAAsE;QACtE,qEAAqE;QACrE,iEAAiE;QACjE,OAAO,EAAE,CAAC,6CAAoB,CAAC;QAC/B,WAAW,EAAE,CAAC,6CAAoB,EAAE,6CAAoB,EAAE,6DAA4B,CAAC;QACvF,SAAS,EAAE;YACT,4CAAoB;YACpB,gCAAc;YACd,kDAAsB;YACtB,uCAAiB;YACjB,uCAAiB;YACjB,uDAAyB;SAC1B;QACD,OAAO,EAAE,CAAC,4CAAoB,EAAE,gCAAc,CAAC;KAChD,CAAC;GACW,mBAAmB,CAAG"}

package/dist/identity/organizations/organizations.permissions.d.ts

@@ -0,0 +1,23 @@
+import type { IdentityPermissionDeclaration as PermissionDeclaration } from '../identity.permissions';
+/**
+ * The permissions of organizations: the active organization's members and invitations (org) and the deployment's organizations (system), with descriptions and default grants, keyed by
+ * the `PERMISSIONS` constant name the reference app derives from them.
+ * Register them with the app's permission registry.
+ *
+ * @stability stable
+ */
+export declare const ORGANIZATIONS_PERMISSIONS: {
+    /** `org_members:read`: view the members of the organization and their organization roles. */
+    readonly ORG_MEMBERS_READ: PermissionDeclaration<'org_members:read'>;
+    /** `org_members:write`: change organization members: their organization role, suspend or remove them. */
+    readonly ORG_MEMBERS_WRITE: PermissionDeclaration<'org_members:write'>;
+    /** `org_invites:read`: view pending and past invitations to the organization. */
+    readonly ORG_INVITES_READ: PermissionDeclaration<'org_invites:read'>;
+    /** `org_invites:write`: invite people to the organization and revoke invitations. */
+    readonly ORG_INVITES_WRITE: PermissionDeclaration<'org_invites:write'>;
+    /** `organizations:read`: list the deployment's organizations and their member counts. */
+    readonly ORGANIZATIONS_READ: PermissionDeclaration<'organizations:read'>;
+    /** `organizations:write`: create organizations (with a first administrator invitation) and rename them. */
+    readonly ORGANIZATIONS_WRITE: PermissionDeclaration<'organizations:write'>;
+};
+//# sourceMappingURL=organizations.permissions.d.ts.map

package/dist/identity/organizations/organizations.permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.permissions.d.ts","sourceRoot":"","sources":["../../../src/identity/organizations/organizations.permissions.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,6BAA6B,IAAI,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEtG;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,EAAE;IACtC,6FAA6F;IAC7F,QAAQ,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;IACrE,yGAAyG;IACzG,QAAQ,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IACvE,iFAAiF;IACjF,QAAQ,CAAC,gBAAgB,EAAE,qBAAqB,CAAC,kBAAkB,CAAC,CAAC;IACrE,qFAAqF;IACrF,QAAQ,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,mBAAmB,CAAC,CAAC;IACvE,yFAAyF;IACzF,QAAQ,CAAC,kBAAkB,EAAE,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;IACzE,2GAA2G;IAC3G,QAAQ,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;CAsC5E,CAAC"}

package/dist/identity/organizations/organizations.permissions.js

@@ -0,0 +1,76 @@
+"use strict";
+// =============================================================================
+// Organization permissions (issue #723, PP-6.3)
+// =============================================================================
+//
+// Pure data: the organization surface's permissions and their default role
+// grants. Imports only types and has no side effect;
+// the manifest slice (`registerPlatformPermissions()`) registers it, and
+// `common/constants/roles.constants.ts` derives `PERMISSIONS` from it. After a
+// change, run `npm run catalog:permissions --workspace=api` and commit the
+// regenerated `prisma/catalog/permissions.json`. Recipe:
+// common/permissions/README.md.
+//
+// ORG SCOPE, ORG ADMIN ONLY. These gate one organization's own membership: who
+// is in it, with which org role, and who is invited. They are declared here and
+// seeded; `org-members.controller.ts` and `org-invites.controller.ts` (#726)
+// enforce them, and the `Organization` settings card uses these exact
+// strings. A customer's organization administrator holds them through the
+// `org_admin` membership role without becoming a deployment operator: none of
+// them is a system permission, and the system `admin` role does not hold them
+// (an administrator's own `org_admin` membership does).
+//
+// SYSTEM SCOPE, ADMIN ONLY (#726). `organizations:read` / `organizations:write`
+// gate the deployment's LIST of organizations (`/api/admin/organizations`):
+// creating one and renaming one. That is a deployment operator's question,
+// not a customer org admin's, so they are system permissions held by the
+// system `admin` role; no org role may hold them (the registry refuses it).
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ORGANIZATIONS_PERMISSIONS = void 0;
+/**
+ * The permissions of organizations: the active organization's members and invitations (org) and the deployment's organizations (system), with descriptions and default grants, keyed by
+ * the `PERMISSIONS` constant name the reference app derives from them.
+ * Register them with the app's permission registry.
+ *
+ * @stability stable
+ */
+exports.ORGANIZATIONS_PERMISSIONS = {
+    ORG_MEMBERS_READ: {
+        id: 'org_members:read',
+        description: 'View the members of the organization and their organization roles',
+        scope: 'org',
+        defaultGrants: ['org_admin'],
+    },
+    ORG_MEMBERS_WRITE: {
+        id: 'org_members:write',
+        description: 'Change organization members: their organization role, suspend or remove them',
+        scope: 'org',
+        defaultGrants: ['org_admin'],
+    },
+    ORG_INVITES_READ: {
+        id: 'org_invites:read',
+        description: 'View pending and past invitations to the organization',
+        scope: 'org',
+        defaultGrants: ['org_admin'],
+    },
+    ORG_INVITES_WRITE: {
+        id: 'org_invites:write',
+        description: 'Invite people to the organization and revoke invitations',
+        scope: 'org',
+        defaultGrants: ['org_admin'],
+    },
+    ORGANIZATIONS_READ: {
+        id: 'organizations:read',
+        description: "List the deployment's organizations and their member counts",
+        scope: 'system',
+        defaultGrants: ['admin'],
+    },
+    ORGANIZATIONS_WRITE: {
+        id: 'organizations:write',
+        description: 'Create organizations (with a first administrator invitation) and rename them',
+        scope: 'system',
+        defaultGrants: ['admin'],
+    },
+};
+//# sourceMappingURL=organizations.permissions.js.map

package/dist/identity/organizations/organizations.permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.permissions.js","sourceRoot":"","sources":["../../../src/identity/organizations/organizations.permissions.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,gDAAgD;AAChD,gFAAgF;AAChF,EAAE;AACF,2EAA2E;AAC3E,qDAAqD;AACrD,yEAAyE;AACzE,+EAA+E;AAC/E,2EAA2E;AAC3E,yDAAyD;AACzD,gCAAgC;AAChC,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,6EAA6E;AAC7E,sEAAsE;AACtE,0EAA0E;AAC1E,8EAA8E;AAC9E,8EAA8E;AAC9E,wDAAwD;AACxD,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,gFAAgF;;;AAIhF;;;;;;GAMG;AACU,QAAA,yBAAyB,GAalC;IACF,gBAAgB,EAAE;QAChB,EAAE,EAAE,kBAAkB;QACtB,WAAW,EAAE,mEAAmE;QAChF,KAAK,EAAE,KAAK;QACZ,aAAa,EAAE,CAAC,WAAW,CAAC;KAC7B;IACD,iBAAiB,EAAE;QACjB,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,8EAA8E;QAC3F,KAAK,EAAE,KAAK;QACZ,aAAa,EAAE,CAAC,WAAW,CAAC;KAC7B;IACD,gBAAgB,EAAE;QAChB,EAAE,EAAE,kBAAkB;QACtB,WAAW,EAAE,uDAAuD;QACpE,KAAK,EAAE,KAAK;QACZ,aAAa,EAAE,CAAC,WAAW,CAAC;KAC7B;IACD,iBAAiB,EAAE;QACjB,EAAE,EAAE,mBAAmB;QACvB,WAAW,EAAE,0DAA0D;QACvE,KAAK,EAAE,KAAK;QACZ,aAAa,EAAE,CAAC,WAAW,CAAC;KAC7B;IACD,kBAAkB,EAAE;QAClB,EAAE,EAAE,oBAAoB;QACxB,WAAW,EAAE,6DAA6D;QAC1E,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,CAAC,OAAO,CAAC;KACzB;IACD,mBAAmB,EAAE;QACnB,EAAE,EAAE,qBAAqB;QACzB,WAAW,EAAE,8EAA8E;QAC3F,KAAK,EAAE,QAAQ;QACf,aAAa,EAAE,CAAC,OAAO,CAAC;KACzB;CACF,CAAC"}

package/dist/identity/organizations/organizations.service.d.ts

@@ -0,0 +1,173 @@
+import type { IdentityPrisma } from '../ports';
+import { PrincipalCache } from '../auth/principal-cache/principal-cache.service';
+import { EventEmitter2 } from '@nestjs/event-emitter';
+import { type ResolvedIdentityModuleOptions } from '../identity.options';
+/** The audit action an invitation claimed at sign-in writes (#726). */
+export declare const ORG_INVITE_ACCEPTED_AUDIT = "org:invite_accepted";
+import type { TenancyMode } from '../../core/index';
+import type { IdentityMembershipRow as Membership, IdentityOrganizationRow as Organization, IdentityTx } from '../data/identity-db';
+import type { OrgMemberStatus as MembershipStatus } from '@marinoscar/platform-contract/identity';
+/**
+ * Organizations, the tenancy foundation (PP-6.1, ADR 0001).
+ *
+ * Read helpers, the write path new users go through, the membership
+ * mutations (#724) and the invitation claim at sign-in (#726). There are no
+ * HTTP routes here: switch-org lives in `AuthController` (PP-6.4), and the
+ * org administration API (#726) in `OrgMembersService`, `OrgInvitesService`
+ * and `OrganizationsAdminService` beside this file. The
+ * `organizations`, `memberships` and `org_invites` tables are identity tables,
+ * read across organizations at login and guarded here, not by RLS (ADR 0002).
+ *
+ * PRINCIPAL CACHE (#724). A membership carries the org role and decides
+ * whether an org-bound credential is still honoured, so every mutation here
+ * that can change either calls `principalCache.invalidateUser` AFTER its write
+ * commits (never inside a caller's transaction). `ensureMembership` is the
+ * exception: it runs inside the caller's transaction, and the caller
+ * invalidates after it commits.
+ *
+ * @internal
+ */
+export declare class OrganizationsService {
+    private readonly prisma;
+    private readonly principalCache;
+    private readonly identityOptions;
+    private readonly events?;
+    constructor(prisma: IdentityPrisma, principalCache: PrincipalCache, identityOptions?: ResolvedIdentityModuleOptions, events?: EventEmitter2 | undefined);
+    private readonly logger;
+    /**
+     * The deployment's default organization: the single row with `isDefault`,
+     * kept unique by `organizations_default_uniq_idx`.
+     *
+     * @throws {@link DefaultOrganizationMissingException} when neither the
+     * migration backfill nor the seed has created it.
+     */
+    getDefaultOrg(): Promise<Organization>;
+    /**
+     * The user's active memberships, each with its organization, most recently
+     * used first (never-used last). Suspended memberships are excluded.
+     */
+    listActiveMemberships(userId: string): Promise<Array<Membership & {
+        org: Organization;
+    }>>;
+    /**
+     * Make the user a member of the organization with the given org role,
+     * idempotently (upsert on `orgId_userId`). An existing membership is left
+     * exactly as it is, role included: a suspended member stays suspended, and
+     * a member whose role an administrator changed keeps it.
+     *
+     * Takes the caller's transaction client so a sign-up creates the user and the
+     * membership atomically. Writes no audit event: the user-creation path does
+     * not audit, and admin-initiated membership changes (PP-6.8) will. The
+     * caller invalidates the principal cache after its transaction commits.
+     *
+     * @param roleId - the org-scoped role of a NEW membership (PP-6.3):
+     *   `DEFAULT_ORG_ROLE` for an ordinary sign-up, `ORG_ADMIN_ROLE` for the
+     *   initial administrator.
+     */
+    ensureMembership(tx: IdentityTx, orgId: string, userId: string, roleId: string): Promise<Membership>;
+    /**
+     * The sign-in self-heal (PP-6.2, #722): make sure an EXISTING user is a
+     * member of the default organization, writing only when the row is missing.
+     *
+     * Reads first, so the common case (the member is already there) costs one
+     * indexed read and no write on every sign-in. The write is still the
+     * idempotent `ensureMembership` upsert, so two concurrent sign-ins cannot
+     * produce a duplicate (the `orgId_userId` unique key decides). A suspended
+     * membership is left suspended: this restores a missing row, never a
+     * revoked one.
+     *
+     * @param roleName - the org role a RESTORED membership gets (PP-6.3, #723):
+     *   `DEFAULT_ORG_ROLE` by default, `ORG_ADMIN_ROLE` for a system
+     *   administrator. An existing membership keeps its role.
+     * @returns the default organization's id, and whether a membership was created.
+     * @throws {@link DefaultOrganizationMissingException} when the default org is missing.
+     * @throws `DatabaseSeedException` when the role row is missing (seed not run).
+     */
+    ensureDefaultOrgMembership(userId: string, roleName?: string): Promise<{
+        orgId: string;
+        created: boolean;
+    }>;
+    /**
+     * Record that the user just started acting in `orgId` (sign-in or
+     * switch-org, #724): `lastActiveAt` picks the org of the next multi-mode
+     * sign-in. A missing membership is not an error (nothing to touch).
+     *
+     * Does NOT invalidate the principal cache: `lastActiveAt` changes neither a
+     * role nor whether a credential is honoured; it only feeds the sign-in
+     * choice, which reads the database.
+     */
+    touchMembership(orgId: string, userId: string): Promise<void>;
+    /**
+     * Remove the user from the organization (#724). Their credentials bound to
+     * it (access tokens, refresh tokens, PATs, device sessions) stop working:
+     * at once on this replica, within event-bus latency elsewhere, and within
+     * the principal cache TTL at worst.
+     *
+     * @throws NotFoundException when there is no such membership.
+     */
+    removeMembership(orgId: string, userId: string): Promise<void>;
+    /**
+     * Suspend or reactivate a membership (#724). A suspended membership grants
+     * nothing and its org-bound credentials are refused until it is active
+     * again.
+     *
+     * @throws NotFoundException when there is no such membership.
+     */
+    setMembershipStatus(orgId: string, userId: string, status: MembershipStatus): Promise<Membership>;
+    /**
+     * Change the member's org role (#724).
+     *
+     * @throws NotFoundException when there is no such membership.
+     * @throws `DatabaseSeedException` when the role row is missing (seed not run).
+     */
+    setMembershipRole(orgId: string, userId: string, roleName: string): Promise<Membership>;
+    /**
+     * The organization a new sign-in acts in (#724), the one rule every token
+     * issuer applies (`AuthService`, `TestAuthService`):
+     *
+     * - single mode: the default organization, unless the loaded graph shows
+     *   the user's default-org membership suspended;
+     * - multi mode: the active membership with the latest `lastActiveAt` (ties:
+     *   the oldest), from the graph when it has one, else from the database.
+     *
+     * @param user - the user, with its memberships when they are loaded.
+     * @returns the org id, or `null` when the user has no organization to act in
+     *   (or the default organization is missing: fail closed).
+     */
+    signInOrgId(user: {
+        id: string;
+        memberships?: ReadonlyArray<{
+            orgId: string;
+            status: MembershipStatus;
+            lastActiveAt: Date | null;
+            createdAt?: Date;
+        }> | null;
+    }, mode: TenancyMode): Promise<string | null>;
+    /**
+     * Claim the user's pending invitations at sign-in (#726, PP-6.7; the
+     * MemoriaHub `claimPendingCircleInvites` precedent). `AuthService` calls it
+     * before the multi-mode "no organization" check, so an invitee's first
+     * sign-in finds the membership the invitation grants.
+     *
+     * For each PENDING invitation addressed to `email`:
+     * - lapsed (`expiresAt` passed): marked `expired`, nothing granted (lazy
+     *   expiry);
+     * - otherwise, in its own transaction: the membership is created with the
+     *   invitation's org role (a NULL role means `DEFAULT_ORG_ROLE`), or an
+     *   existing one is UPGRADED to it, never downgraded (`org_admin`, then
+     *   `contributor`, then `viewer`); a suspended membership stays suspended
+     *   (reactivating is an administrator's decision); and the invitation is
+     *   marked `accepted` (`acceptedById`, `acceptedAt`) conditionally, so two
+     *   concurrent sign-ins cannot both claim it.
+     *
+     * Invalidates the principal cache once, after the last commit, when
+     * anything was granted.
+     *
+     * @param email - the signing-in address, lower-cased.
+     * @returns how many invitations were accepted.
+     */
+    claimPendingInvites(userId: string, email: string): Promise<number>;
+    /** How many active (not suspended) memberships the user holds, in any org. */
+    countActiveMemberships(userId: string): Promise<number>;
+}
+//# sourceMappingURL=organizations.service.d.ts.map

package/dist/identity/organizations/organizations.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.service.d.ts","sourceRoot":"","sources":["../../../src/identity/organizations/organizations.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AAGjF,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAA8C,KAAK,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAKrH,uEAAuE;AACvE,eAAO,MAAM,yBAAyB,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAEV,qBAAqB,IAAI,UAAU,EACnC,uBAAuB,IAAI,YAAY,EACvC,UAAU,EACX,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,eAAe,IAAI,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAElG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBACa,oBAAoB;IAEJ,OAAO,CAAC,QAAQ,CAAC,MAAM;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAEpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBALM,MAAM,EAAE,cAAc,EAC/C,cAAc,EAAE,cAAc,EAE9B,eAAe,GAAE,6BAAwD,EAE7D,MAAM,CAAC,EAAE,aAAa,YAAA;IAGrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;IAEhE;;;;;;OAMG;IACG,aAAa,IAAI,OAAO,CAAC,YAAY,CAAC;IAU5C;;;OAGG;IACG,qBAAqB,CACzB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG;QAAE,GAAG,EAAE,YAAY,CAAA;KAAE,CAAC,CAAC;IAWrD;;;;;;;;;;;;;;OAcG;IACG,gBAAgB,CACpB,EAAE,EAAE,UAAU,EACd,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,UAAU,CAAC;IAQtB;;;;;;;;;;;;;;;;;OAiBG;IACG,0BAA0B,CAC9B,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,MAA4C,GACrD,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAsB/C;;;;;;;;OAQG;IACG,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOnE;;;;;;;OAOG;IACG,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQpE;;;;;;OAMG;IACG,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,UAAU,CAAC;IAgBtB;;;;;OAKG;IACG,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB7F;;;;;;;;;;;;OAYG;IACG,WAAW,CACf,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,WAAW,CAAC,EAAE,aAAa,CAAC;YAC1B,KAAK,EAAE,MAAM,CAAC;YACd,MAAM,EAAE,gBAAgB,CAAC;YACzB,YAAY,EAAE,IAAI,GAAG,IAAI,CAAC;YAC1B,SAAS,CAAC,EAAE,IAAI,CAAC;SAClB,CAAC,GAAG,IAAI,CAAC;KACX,EACD,IAAI,EAAE,WAAW,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAwBzB;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA6GzE,8EAA8E;IACxE,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;CAK9D"}