@mostajs/rbac 2.3.4 → 2.4.0

package/dist/lib/account-resolver.d.ts

@@ -0,0 +1,24 @@
+import type { IDialect } from '@mostajs/orm';
+export interface ResolveAccountOptions {
+    /** Override the auto-create account name (default: "<userEmail>-<type>"). */
+    name?: string;
+    /** Account type for lookup + auto-create (default: 'personal'). */
+    type?: string;
+    /** Plan to assign on auto-create (default: 'free'). */
+    plan?: string;
+    /** Status on auto-create (default: 'active'). */
+    status?: string;
+    /** Disable auto-create — return null if not found. */
+    noAutoCreate?: boolean;
+}
+/**
+ * Resolve (or auto-create) the Account owned by `userId`. Returns the
+ * account ID, or null if `noAutoCreate` and not found.
+ *
+ * Lookup order:
+ *   1. accounts WHERE owner=userId AND type=options.type
+ *   2. accounts WHERE owner=userId (any type — first match)
+ *   3. CREATE account (unless noAutoCreate=true)
+ */
+export declare function resolveUserAccountId(dialect: IDialect, userId: string, userEmail?: string, options?: ResolveAccountOptions): Promise<string | null>;
+//# sourceMappingURL=account-resolver.d.ts.map

package/dist/lib/account-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-resolver.d.ts","sourceRoot":"","sources":["../../lib/account-resolver.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAG5C,MAAM,WAAW,qBAAqB;IACpC,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,iDAAiD;IACjD,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sDAAsD;IACtD,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,QAAQ,EACjB,MAAM,EAAE,MAAM,EACd,SAAS,CAAC,EAAE,MAAM,EAClB,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAuBxB"}

package/dist/lib/account-resolver.js

@@ -0,0 +1,41 @@
+// @mostajs/rbac — Account resolver
+//
+// Resolves the personal Account owned by a User. The Account is the
+// boundary entity for API keys, projects, billing, subscriptions —
+// User is just identity. Centralizes the lookup-or-create pattern so
+// portals (Octocloud, future tenants UIs) don't reimplement it.
+//
+// Author: Dr Hamid MADANI <drmdh@msn.com>
+import { AccountRepository } from '../repositories/account.repository.js';
+/**
+ * Resolve (or auto-create) the Account owned by `userId`. Returns the
+ * account ID, or null if `noAutoCreate` and not found.
+ *
+ * Lookup order:
+ *   1. accounts WHERE owner=userId AND type=options.type
+ *   2. accounts WHERE owner=userId (any type — first match)
+ *   3. CREATE account (unless noAutoCreate=true)
+ */
+export async function resolveUserAccountId(dialect, userId, userEmail, options = {}) {
+    const accountRepo = new AccountRepository(dialect);
+    const type = options.type || 'personal';
+    const status = options.status || 'active';
+    const plan = options.plan || 'free';
+    const existing = await accountRepo.findOne({ owner: userId, type });
+    if (existing === null || existing === void 0 ? void 0 : existing.id)
+        return existing.id;
+    // Fallback : owner has an account of a different type (e.g. 'system',
+    // 'trial') — pick the first match rather than auto-creating a duplicate.
+    const any = await accountRepo.findOne({ owner: userId });
+    if (any === null || any === void 0 ? void 0 : any.id)
+        return any.id;
+    if (options.noAutoCreate)
+        return null;
+    const created = await accountRepo.create({
+        name: options.name || `${userEmail || userId}-${type}`,
+        type, plan, status,
+        owner: userId,
+    });
+    return created.id;
+}
+//# sourceMappingURL=account-resolver.js.map

package/dist/lib/account-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-resolver.js","sourceRoot":"","sources":["../../lib/account-resolver.ts"],"names":[],"mappings":"AAAA,mCAAmC;AACnC,EAAE;AACF,oEAAoE;AACpE,mEAAmE;AACnE,qEAAqE;AACrE,gEAAgE;AAChE,EAAE;AACF,0CAA0C;AAG1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAA;AAetE;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAiB,EACjB,MAAc,EACd,SAAkB,EAClB,UAAiC,EAAE;IAEnC,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAElD,MAAM,IAAI,GAAK,OAAO,CAAC,IAAI,IAAM,UAAU,CAAA;IAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAA;IACzC,MAAM,IAAI,GAAK,OAAO,CAAC,IAAI,IAAM,MAAM,CAAA;IAEvC,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAS,CAAC,CAAA;IAC1E,IAAK,QAAgB,aAAhB,QAAQ,uBAAR,QAAQ,CAAU,EAAE;QAAE,OAAQ,QAAgB,CAAC,EAAE,CAAA;IAEtD,sEAAsE;IACtE,yEAAyE;IACzE,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAS,CAAC,CAAA;IAC/D,IAAK,GAAW,aAAX,GAAG,uBAAH,GAAG,CAAU,EAAE;QAAE,OAAQ,GAAW,CAAC,EAAE,CAAA;IAE5C,IAAI,OAAO,CAAC,YAAY;QAAE,OAAO,IAAI,CAAA;IAErC,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC;QACvC,IAAI,EAAI,OAAO,CAAC,IAAI,IAAI,GAAG,SAAS,IAAI,MAAM,IAAI,IAAI,EAAE;QACxD,IAAI,EAAE,IAAI,EAAE,MAAM;QAClB,KAAK,EAAG,MAAM;KACR,CAAC,CAAA;IACT,OAAQ,OAAe,CAAC,EAAE,CAAA;AAC5B,CAAC"}

package/dist/lib/repos-factory.js

@@ -1,12 +1,12 @@
 // repos-factory.ts — Centralized repository factory
-// Uses @mostajs/octoswitcher to get the right dialect (ORM or NET)
+// Uses @mostajs/data-plug to get the right dialect (ORM or NET)
 // Author: Dr Hamid MADANI drmdh@msn.com
 let _cached = null;
 /** Get RBAC repositories — dialect resolved by octoswitcher (ORM or NET) */
 export async function getRbacRepos() {
     if (_cached)
         return _cached;
-    const { getDialect } = await import('@mostajs/octoswitcher');
+    const { getDialect } = await import('@mostajs/data-plug');
     const { registerSchemas } = await import('@mostajs/orm');
     const { UserSchema } = await import('../schemas/user.schema.js');
     const { RoleSchema } = await import('../schemas/role.schema.js');

package/dist/lib/repos-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"repos-factory.js","sourceRoot":"","sources":["../../lib/repos-factory.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,mEAAmE;AACnE,wCAAwC;AA6ExC,IAAI,OAAO,GAAqB,IAAI,CAAC;AAErC,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;IAC7D,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACjE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACjE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;IAC7E,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,0CAA0C,CAAC,CAAC;IAC9F,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;IAC9E,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;IAC9E,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,0CAA0C,CAAC,CAAC;IAC1F,MAAM,EAAE,4BAA4B,EAAE,GAAG,MAAM,MAAM,CAAC,mDAAmD,CAAC,CAAC;IAE3G,eAAe,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IACnC,2FAA2F;IAC3F,IAAI,OAAQ,OAAe,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACtD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACvD,MAAO,OAAe,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,GAAG;QACR,KAAK,EAAE,IAAI,cAAc,CAAC,OAAc,CAAoB;QAC5D,KAAK,EAAE,IAAI,cAAc,CAAC,OAAc,CAAoB;QAC5D,WAAW,EAAE,IAAI,oBAAoB,CAAC,OAAc,CAA0B;QAC9E,UAAU,EAAE,IAAI,4BAA4B,CAAC,OAAc,CAAkC;KAC9F,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,cAAc,KAAW,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC"}
+{"version":3,"file":"repos-factory.js","sourceRoot":"","sources":["../../lib/repos-factory.ts"],"names":[],"mappings":"AAAA,oDAAoD;AACpD,gEAAgE;AAChE,wCAAwC;AA6ExC,IAAI,OAAO,GAAqB,IAAI,CAAC;AAErC,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAE5B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC1D,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;IACzD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACjE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;IACjE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;IAC7E,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,0CAA0C,CAAC,CAAC;IAC9F,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;IAC9E,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;IAC9E,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,0CAA0C,CAAC,CAAC;IAC1F,MAAM,EAAE,4BAA4B,EAAE,GAAG,MAAM,MAAM,CAAC,mDAAmD,CAAC,CAAC;IAE3G,eAAe,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,gBAAgB,EAAE,wBAAwB,CAAC,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,MAAM,UAAU,EAAE,CAAC;IACnC,2FAA2F;IAC3F,IAAI,OAAQ,OAAe,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACtD,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QACvD,MAAO,OAAe,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,GAAG;QACR,KAAK,EAAE,IAAI,cAAc,CAAC,OAAc,CAAoB;QAC5D,KAAK,EAAE,IAAI,cAAc,CAAC,OAAc,CAAoB;QAC5D,WAAW,EAAE,IAAI,oBAAoB,CAAC,OAAc,CAA0B;QAC9E,UAAU,EAAE,IAAI,4BAA4B,CAAC,OAAc,CAAkC;KAC9F,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,cAAc,KAAW,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC"}

package/dist/repositories/account.repository.d.ts

@@ -7,5 +7,19 @@ export declare class AccountRepository extends BaseRepository<AccountDTO> {
     findByOwner(userId: string): Promise<AccountDTO | null>;
     /** Find the unique system account by type — useful for the 'trial' shared playground */
     findByType(type: string): Promise<AccountDTO | null>;
+    /** Find direct children of a parent account (1 level). */
+    findChildren(parentId: string): Promise<AccountDTO[]>;
+    /**
+     * Expand a parent account ID into the set of "tenant accounts" :
+     * the parent itself + all its direct children. Used by the row-level
+     * scoping middleware (mosta-net) to filter account-scoped entities.
+     *
+     * Returns an array of account IDs.
+     *
+     * Note : 1 niveau seulement pour l'instant. Si on adopte une vraie
+     * récursivité (forêt profonde), implémenter un CTE récursif (postgres
+     * `WITH RECURSIVE`) ou itérer ici.
+     */
+    expandTenant(parentId: string): Promise<string[]>;
 }
 //# sourceMappingURL=account.repository.d.ts.map

package/dist/repositories/account.repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.repository.d.ts","sourceRoot":"","sources":["../../repositories/account.repository.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEhD,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,UAAU,CAAC;gBACnD,OAAO,EAAE,QAAQ;IAI7B,6DAA6D;IACvD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAI7D,wFAAwF;IAClF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;CAG3D"}
+{"version":3,"file":"account.repository.d.ts","sourceRoot":"","sources":["../../repositories/account.repository.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEhD,qBAAa,iBAAkB,SAAQ,cAAc,CAAC,UAAU,CAAC;gBACnD,OAAO,EAAE,QAAQ;IAI7B,6DAA6D;IACvD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAI7D,wFAAwF;IAClF,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAI1D,0DAA0D;IACpD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAI3D;;;;;;;;;;OAUG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAIxD"}

package/dist/repositories/account.repository.js

@@ -14,5 +14,24 @@ export class AccountRepository extends BaseRepository {
     async findByType(type) {
         return this.findOne({ type });
     }
+    /** Find direct children of a parent account (1 level). */
+    async findChildren(parentId) {
+        return this.findAll({ parent: parentId });
+    }
+    /**
+     * Expand a parent account ID into the set of "tenant accounts" :
+     * the parent itself + all its direct children. Used by the row-level
+     * scoping middleware (mosta-net) to filter account-scoped entities.
+     *
+     * Returns an array of account IDs.
+     *
+     * Note : 1 niveau seulement pour l'instant. Si on adopte une vraie
+     * récursivité (forêt profonde), implémenter un CTE récursif (postgres
+     * `WITH RECURSIVE`) ou itérer ici.
+     */
+    async expandTenant(parentId) {
+        const children = await this.findChildren(parentId);
+        return [parentId, ...children.map((c) => c.id)];
+    }
 }
 //# sourceMappingURL=account.repository.js.map

package/dist/repositories/account.repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.repository.js","sourceRoot":"","sources":["../../repositories/account.repository.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAIzD,MAAM,OAAO,iBAAkB,SAAQ,cAA0B;IAC/D,YAAY,OAAiB;QAC3B,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IAC/B,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACxC,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/B,CAAC;CACF"}
+{"version":3,"file":"account.repository.js","sourceRoot":"","sources":["../../repositories/account.repository.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAIzD,MAAM,OAAO,iBAAkB,SAAQ,cAA0B;IAC/D,YAAY,OAAiB;QAC3B,KAAK,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IAC/B,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;IACxC,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/B,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAS,CAAC,CAAA;IAClD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAA;QAClD,OAAO,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACtD,CAAC;CACF"}

package/dist/schemas/account.schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.schema.d.ts","sourceRoot":"","sources":["../../schemas/account.schema.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD,eAAO,MAAM,aAAa,EAAE,YAuB3B,CAAA"}
+{"version":3,"file":"account.schema.d.ts","sourceRoot":"","sources":["../../schemas/account.schema.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEhD,eAAO,MAAM,aAAa,EAAE,YAyB3B,CAAA"}

package/dist/schemas/account.schema.js

@@ -1,7 +1,25 @@
 // @mostajs/rbac — Account Entity Schema
-// Multi-tenant container referenced as target:'Account' by ApiKey, Project,
+//
+// Multi-tenant container référencé comme target:'Account' par ApiKey, Project,
 // Subscription, Invoice, UsageLog (across mosta-api-keys, mosta-project-life,
 // mosta-subscriptions-plan).
+//
+// Hiérarchie (depuis 2.4.0, modèle β multi-tenant) :
+//   - `parent` (nullable many-to-one Account → Account) permet de modéliser
+//     une forêt de comptes : un Account 'portal' (octocloud-amia) en racine,
+//     les Accounts 'personal' des users qui s'inscrivent ont parent=portal.
+//   - Les modules consomateurs (mosta-net Octonet) utilisent ce parent comme
+//     frontière de cloisonnement : une apikey rattachée à un portal Account
+//     voit uniquement les données dont l'`account` ∈ {portal} ∪ {children
+//     de portal}.
+//
+// Types existants :
+//   - personal     : compte personnel d'un user
+//   - organization : équipe/société (futur)
+//   - trial        : sandbox transient (T1 /try)
+//   - system       : compte système (public-demo, services internes)
+//   - portal       : tenant racine d'un octocloud (ajouté en 2.4.0)
+//
 // Author: Dr Hamid MADANI drmdh@msn.com
 export const AccountSchema = {
     name: 'Account',
@@ -9,7 +27,7 @@ export const AccountSchema = {
     timestamps: true,
     fields: {
         name: { type: 'string', required: true, trim: true },
-        type: { type: 'string', enum: ['personal', 'organization', 'trial', 'system'], default: 'personal' },
+        type: { type: 'string', enum: ['personal', 'organization', 'trial', 'system', 'portal'], default: 'personal' },
         plan: { type: 'string', default: 'free' },
         status: { type: 'string', enum: ['active', 'suspended', 'deleted'], default: 'active' },
         stripeCustomerId: { type: 'string' },
@@ -17,11 +35,13 @@ export const AccountSchema = {
     },
     relations: {
         owner: { type: 'many-to-one', target: 'User', required: true },
+        parent: { type: 'many-to-one', target: 'Account', required: false },
         members: { type: 'many-to-many', target: 'User', through: 'account_members' },
     },
     indexes: [
         { fields: { type: 'asc' } },
         { fields: { status: 'asc' } },
+        { fields: { parent: 'asc' } },
     ],
 };
 //# sourceMappingURL=account.schema.js.map

package/dist/schemas/account.schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"account.schema.js","sourceRoot":"","sources":["../../schemas/account.schema.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,4EAA4E;AAC5E,8EAA8E;AAC9E,6BAA6B;AAC7B,wCAAwC;AAIxC,MAAM,CAAC,MAAM,aAAa,GAAiB;IACzC,IAAI,EAAE,SAAS;IACf,UAAU,EAAE,UAAU;IACtB,UAAU,EAAE,IAAI;IAEhB,MAAM,EAAE;QACN,IAAI,EAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;QAChE,IAAI,EAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE;QAChH,IAAI,EAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;QACrD,MAAM,EAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;QACjG,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACpC,QAAQ,EAAU,EAAE,IAAI,EAAE,MAAM,EAAE;KACnC;IAED,SAAS,EAAE;QACT,KAAK,EAAI,EAAE,IAAI,EAAE,aAAa,EAAG,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;QACjE,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE;KAC9E;IAED,OAAO,EAAE;QACP,EAAE,MAAM,EAAE,EAAE,IAAI,EAAI,KAAK,EAAE,EAAE;QAC7B,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;KAC9B;CACF,CAAA"}
+{"version":3,"file":"account.schema.js","sourceRoot":"","sources":["../../schemas/account.schema.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,6BAA6B;AAC7B,EAAE;AACF,qDAAqD;AACrD,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,0EAA0E;AAC1E,kBAAkB;AAClB,EAAE;AACF,oBAAoB;AACpB,gDAAgD;AAChD,4CAA4C;AAC5C,iDAAiD;AACjD,qEAAqE;AACrE,oEAAoE;AACpE,EAAE;AACF,wCAAwC;AAIxC,MAAM,CAAC,MAAM,aAAa,GAAiB;IACzC,IAAI,EAAE,SAAS;IACf,UAAU,EAAE,UAAU;IACtB,UAAU,EAAE,IAAI;IAEhB,MAAM,EAAE;QACN,IAAI,EAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;QAChE,IAAI,EAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE;QAC1H,IAAI,EAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE;QACrD,MAAM,EAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE;QACjG,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACpC,QAAQ,EAAU,EAAE,IAAI,EAAE,MAAM,EAAE;KACnC;IAED,SAAS,EAAE;QACT,KAAK,EAAI,EAAE,IAAI,EAAE,aAAa,EAAG,MAAM,EAAE,MAAM,EAAK,QAAQ,EAAE,IAAI,EAAE;QACpE,MAAM,EAAG,EAAE,IAAI,EAAE,aAAa,EAAG,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE;QACrE,OAAO,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAK,OAAO,EAAE,iBAAiB,EAAE;KACjF;IAED,OAAO,EAAE;QACP,EAAE,MAAM,EAAE,EAAE,IAAI,EAAI,KAAK,EAAE,EAAE;QAC7B,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;QAC7B,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;KAC9B;CACF,CAAA"}

package/dist/server.d.ts

@@ -14,6 +14,8 @@ export { OCTONET_RBAC_SEED, OCTONET_PERMS } from './seeds/octonet';
 export { hasPermission, matchesPermission } from './helpers/permissions';
 export { createAdmin } from './lib/create-admin';
 export type { CreateAdminOptions, CreateAdminResult } from './lib/create-admin';
+export { resolveUserAccountId } from './lib/account-resolver';
+export type { ResolveAccountOptions } from './lib/account-resolver';
 export { getSchemas, moduleInfo } from './lib/module-info';
 export { getPermissionsForRoleFromDB } from './lib/permissions-server';
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../server.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAGxD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAA;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAA;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAA;AAGrE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAGtD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAGlE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAGxE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAG/E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAG1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../server.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAGxD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAA;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAA;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAA;AAGrE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAC1C,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAGtD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAGlE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAGxE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAChD,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AAI/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAC7D,YAAY,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAGnE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAG1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA"}

package/dist/server.js

@@ -22,6 +22,9 @@ export { OCTONET_RBAC_SEED, OCTONET_PERMS } from './seeds/octonet.js';
 export { hasPermission, matchesPermission } from './helpers/permissions.js';
 // Create admin (depends on repos → ORM + bcrypt)
 export { createAdmin } from './lib/create-admin.js';
+// Account resolver — lookup-or-create the personal Account for a User.
+// Centralized so portals (Octocloud, etc.) don't reimplement it.
+export { resolveUserAccountId } from './lib/account-resolver.js';
 // Module info (schemas, seeds, metadata — for setup discovery)
 export { getSchemas, moduleInfo } from './lib/module-info.js';
 // Server-side permission DB lookup (depends on repos → ORM)
@@ -31,4 +34,26 @@ export { getPermissionsForRoleFromDB } from './lib/permissions-server.js';
 //   import { createUsersHandler } from '@mostajs/rbac/api/users'
 // This keeps '@mostajs/rbac/server' Next-free for pure backend runtimes
 // (Fastify, Express, raw Node) like Octonet.
+// API handler factories
+//export { createUsersHandler } from './api/users.js'
+//export { createUsersIdHandler } from './api/users-id.js'
+//export { createRolesHandler } from './api/roles.js'
+//export { createRolesIdHandler } from './api/roles-id.js'
+//export { createPermissionsHandler } from './api/permissions.js'
+//export { createPermissionsIdHandler } from './api/permissions-id.js'
+//export { createMatrixHandler } from './api/matrix.js'
+//export { createCategoriesHandler } from './api/categories.js'
+//export { createCategoriesIdHandler } from './api/categories-id.js'
+//export { createSeedHandler } from './api/seed.js'
+// Re-//export config types
+//export type { UsersHandlerConfig } from './api/users.js'
+//export type { UsersIdHandlerConfig } from './api/users-id.js'
+//export type { RolesHandlerConfig } from './api/roles.js'
+//export type { RolesIdHandlerConfig } from './api/roles-id.js'
+//export type { PermissionsHandlerConfig } from './api/permissions.js'
+//export type { PermissionsIdHandlerConfig } from './api/permissions-id.js'
+//export type { MatrixHandlerConfig } from './api/matrix.js'
+//export type { CategoriesHandlerConfig } from './api/categories.js'
+//export type { CategoriesIdHandlerConfig } from './api/categories-id.js'
+//export type { SeedHandlerConfig } from './api/seed.js'
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../server.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,6DAA6D;AAC7D,mEAAmE;AAEnE,wEAAwE;AACxE,kEAAkE;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAExD,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAA;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAA;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAA;AAErE,qCAAqC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAG1C,yEAAyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAElE,8BAA8B;AAC9B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAExE,iDAAiD;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAGhD,+DAA+D;AAC/D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE1D,4DAA4D;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AAEtE,0EAA0E;AAC1E,6EAA6E;AAC7E,iEAAiE;AACjE,wEAAwE;AACxE,6CAA6C"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../server.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,6DAA6D;AAC7D,mEAAmE;AAEnE,wEAAwE;AACxE,kEAAkE;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AAExD,wCAAwC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAA;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAA;AAC5F,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAA;AAErE,qCAAqC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAA;AAG1C,yEAAyE;AACzE,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAElE,8BAA8B;AAC9B,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AAExE,iDAAiD;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AAGhD,uEAAuE;AACvE,iEAAiE;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAA;AAG7D,+DAA+D;AAC/D,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE1D,4DAA4D;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAA;AAEtE,0EAA0E;AAC1E,6EAA6E;AAC7E,iEAAiE;AACjE,wEAAwE;AACxE,6CAA6C;AAK7C,wBAAwB;AACxB,kDAAkD;AAClD,uDAAuD;AACvD,kDAAkD;AAClD,uDAAuD;AACvD,8DAA8D;AAC9D,mEAAmE;AACnE,oDAAoD;AACpD,4DAA4D;AAC5D,iEAAiE;AACjE,gDAAgD;AAEhD,2BAA2B;AAC3B,uDAAuD;AACvD,4DAA4D;AAC5D,uDAAuD;AACvD,4DAA4D;AAC5D,mEAAmE;AACnE,wEAAwE;AACxE,yDAAyD;AACzD,iEAAiE;AACjE,sEAAsE;AACtE,qDAAqD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mostajs/rbac",
-  "version": "2.3.4",
+  "version": "2.4.0",
   "description": "RBAC — User/Role/Permission schemas, repos, management UI, API handlers",
   "author": "Dr Hamid MADANI <drmdh@msn.com>",
   "license": "AGPL-3.0-or-later",
@@ -193,7 +193,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@mostajs/octoswitcher": "^1.0.0",
+    "@mostajs/data-plug": "^1.0.0",
     "@mostajs/orm": "^1.0.0",
     "bcryptjs": "^3.0.3",
     "class-variance-authority": "^0.7.0",