@neohm/nestend 2.0.4 → 3.0.0

package/README.md

@@ -84,14 +84,15 @@ app.useGlobalInterceptors(
 
 | Area              | Key exports                                                                                                                                               | Notes                                                                                                                                                                                                                                    |
 | ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Entities          | `RootEntity`, `CommonEntity`, `UserEntity`, `SystemRoleEntity`, ...                                                                                       | uuid PK, soft deletes, `created_by`, jsonb `attributes`; entity-level `findOneOrNew`, `softDelete`, `hardDelete`, `restore`, `paginate` statics                                                                                          |
-| Migrations        | `CreateSysUsersTable...` (16 files), `MigrationUtility`, `SeederUtility`                                                                                  | fluent `this.string()`, `this.numeric()`, `addRecord()` seeding                                                                                                                                                                          |
+| Entities          | `RootEntity`, `CommonEntity`, `CommonAdminEntity`, `UserEntity`, `AdminUserEntity`, `SystemRoleEntity`, `SystemAdminRoleEntity`, ...                      | uuid PK, soft deletes, `created_by`, jsonb `attributes`; entity-level `findOneOrNew`, `softDelete`, `hardDelete`, `restore`, `paginate` statics                                                                                          |
+| Migrations        | `CreateSysUsersTable...` (29 files), `MigrationUtility`, `SeederUtility`                                                                                  | fluent `this.string()`, `this.numeric()`, `addRecord()` seeding                                                                                                                                                                          |
 | Queue             | `QueueModule`, `QueueService`, `CommonJob`, `JobConsumer`                                                                                                 | BullMQ `@Processor`/`WorkerHost` consumer; auto-discovered jobs, duplicate prevention, recurring schedulers, 1-day TTL, retries, failures persisted to `sys_failed_jobs`                                                                 |
 | Scheduled events  | `SystemScheduledTaskEntity`, `ScheduledEventEntity`, `SetScheduledEventJob`, `DispatchScheduledEventJob`                                                  | schedule definitions in `sys_scheduled_tasks` → events in `sys_scheduled_events`; worker-driven materialisation + dispatch via `SCHEDULED_EVENT_*` env                                                                                   |
-| Auth              | `AuthModule`, `AuthService.validateAccess()`, `AuthContextService`, `AuthContextMiddleware`, `GoogleAuthService`                                          | imperative auth (open by default); bearer token via AsyncLocalStorage → user + roles; access + rotating refresh tokens, Redis JTI blocklist; Google SSO via ID token at `POST /auth/google`                                              |
-| API keys          | `ApiKeyService`, `ApiKeyGuard`, `@ApiKeyScopes()`                                                                                                         | hashed keys in `sys_api_keys`, scopes, expiry/revocation, `x-api-key` header                                                                                                                                                             |
-| Multi-tenancy     | `TenantModule`, `TenantEntity`, `TenantCommonEntity`, `TenantContextService`, `TenantContextMiddleware`                                                   | AsyncLocalStorage tenant context; resolve by header, slug, or domain                                                                                                                                                                     |
-| Admin             | `AdminModule`, `AdminAccessService`, `TenantDataProcessor`, `ClientUserDataProcessor`, `BulkUserDataProcessor`, `AdminUserDataProcessor`, list processors | back-office APIs: tenant onboarding, client/admin user registration (single + bulk), tenant + scheduled-task listing; 4-tier `GlobalAdminRoles` gate; `UserType` discriminator on `sys_users`; Swagger at `/docs` (hidden in production) |
+| Auth              | `AuthModule`, `AuthService.validateRole()`, `Auth`, `JwtMiddleware`, `GoogleAuthService`                                                                  | imperative auth (open by default); JwtMiddleware resolves the user into `Auth`'s AsyncLocalStorage context per request; access + rotating refresh tokens; session-based logout invalidation (`sys_auth_sessions`); Google SSO via ID token at `POST /auth/google` |
+| Admin auth        | `AdminAuthService.validateRole()`, `AdminAuth`, `AdminJwtMiddleware`, `AdminAuthController` (`/admin/auth`)                                               | fully separate stack for back-office admins — own users table (`sys_admin_users`), own roles (`sys_admin_roles`/`sys_auser_roles`), own sessions/refresh tokens (shared tables, `is_admin` flag)                                          |
+| API keys          | `ApiKeyService`, `ApiKeyGuard` / `ApiKeyMiddleware`, `@ApiKeyScopes()`, `ScopeEntity`, `ApiScopeEntity`                                                    | hashed keys in `sys_api_keys` (admin-owned), scopes, expiry/revocation, `x-api-key` header; normalized scopes catalogue in `sys_scopes`/`sys_api_scopes`                                                                                  |
+| Multi-tenancy     | `TenantModule`, `TenantEntity`, `TenantCommonEntity`, `TenantContextService`, `TenantContextMiddleware`                                                   | AsyncLocalStorage tenant context; resolve by header, slug, or domain; tenants are onboarded by admins (`TenantEntity.creator` → `AdminUserEntity`)                                                                                        |
+| Admin             | `AdminModule`, `AdminAccessService`, `TenantDataProcessor`, `ClientUserDataProcessor`, `BulkUserDataProcessor`, `AdminUserDataProcessor`, list processors | back-office APIs: tenant onboarding, client/admin user registration (single + bulk, no role granting), tenant + scheduled-task listing; 4-tier `GlobalAdminRoles` gate over `sys_admin_roles`; Swagger at `/docs` (hidden in production) |
 | Notifications     | `NotificationModule`, `NotificationService`, `FcmPushNotificationService`                                                                                 | in-app rows + FCM push (optional `firebase-admin`); device token registry                                                                                                                                                                |
 | Email (SES)       | `EmailNotificationService`, `ProcessEmailNotification`, `EmailTemplateEntity`, `EmailNotificationLogEntity`                                               | templates in `sys_email_templates` rendered by a remote service, dispatched via SES per recipient (to/cc/bcc); logged to `sys_email_notification_logs` outside production; dispatch skipped when `AWS_SES_FROM_ADDRESS` unset            |
 | Audit             | `AuditService`                                                                                                                                            | `saveAuditLog(old, new)` with changed-value diffing into `sys_audit_logs`                                                                                                                                                                |
@@ -156,16 +157,23 @@ queries to the primary.
 #### Authentication (imperative)
 
 Controllers are **open by default**; you authenticate explicitly inside the
-handler with `AuthService.validateAccess()`. It reads the bearer token from the
-request (held in `AsyncLocalStorage` by `AuthContextMiddleware`), verifies it,
-rejects revoked tokens, and returns the user row with its roles — throwing
-`AccessException` (403) when missing/invalid. This keeps authorization next to
-your business logic, so layering tenant/plan/role checks is just more code.
+handler with `AuthService.validateRole()`. It reads the current user from
+`Auth`'s `AsyncLocalStorage` context — populated once per request by
+`JwtMiddleware`, which verifies the bearer token and checks that its session
+(`sys_auth_sessions`) hasn't been invalidated (logout) or expired — and returns
+the user row with its roles, throwing `AccessException` (403) when there's no
+active session. Pass a role identifier to gate on a specific role:
+`validateRole('tenant.editor')`. This keeps authorization next to your business
+logic, so layering tenant/plan/role checks is just more code.
 
 `AuthController` (mounted at `/auth`) exposes the ready-made flows: `POST
 /auth/login`, `/auth/google`, `/auth/register`, `/auth/refresh`, `/auth/logout`,
 `/auth/change-password`, and `GET /auth/me`. Passwords are hashed/verified via
-`AuthUtility` (bcrypt); the write flows use the processor lifecycle.
+`AuthUtility` (bcrypt); the write flows use the processor lifecycle. Every
+`issueTokens()` call (login or refresh) creates a fresh `sys_auth_sessions` row
+and embeds its identifier in the access token as `sid`; `logout()` revokes the
+refresh token and invalidates that session, so a still-unexpired access token
+stops working immediately.
 
 **Google SSO** — the client posts a Google ID token as `{ id_token }` to
 `POST /auth/google`. `GoogleAuthService` verifies it against Google's tokeninfo
@@ -181,27 +189,54 @@ export class ReportController {
 
   @Get()
   async list() {
-    const { user, roles } = await this.authService.validateAccess();
+    const { user, roles } = await this.authService.validateRole();
     // ...custom checks: roles, tenant membership, subscription, ownership
   }
 }
 ```
 
-Wire the middleware once in your app so the token is captured per request
+Wire the middleware once in your app so the user is resolved per request
 (mirrors `TenantContextMiddleware`):
 
 ```ts
 export class AppModule implements NestModule {
   configure(consumer: MiddlewareConsumer) {
-    consumer.apply(AuthContextMiddleware).forRoutes('*'); // Express 5: e.g. '{*splat}'
+    consumer.apply(JwtMiddleware).forRoutes('*'); // Express 5: e.g. '{*splat}'
   }
 }
 ```
 
-`validateAccess()` reads the token via `AuthContextService` (no request-scoped
-providers). The Passport `JwtStrategy`/`JwtAuthGuard` remain available if you
-prefer guard-based protection on specific routes, but they're no longer the
-default path.
+Read the current user anywhere without going through `AuthService` via the
+`Auth` static class: `Auth.user()` / `Auth.session()`. The Passport
+`JwtStrategy`/`JwtAuthGuard` remain available if you prefer guard-based
+protection on specific routes, but they're no longer the default path, and
+they aren't wired to `sys_auth_sessions` invalidation.
+
+#### Admin authentication (separate stack)
+
+Back-office admins are a **fully separate principal** from tenant users — own
+table (`sys_admin_users`), own roles (`sys_admin_roles`/`sys_auser_roles`), own
+context helper (`AdminAuth`), own middleware (`AdminJwtMiddleware`), own service
+(`AdminAuthService`), mirroring everything above:
+
+```ts
+export class AppModule implements NestModule {
+  configure(consumer: MiddlewareConsumer) {
+    consumer.apply(JwtMiddleware).forRoutes('*');
+    consumer.apply(AdminJwtMiddleware).forRoutes('admin/*');
+  }
+}
+```
+
+`AdminAuthController` (mounted at `/admin/auth`) exposes `POST login` (body:
+`email_or_username`, `password`), `POST refresh`, `POST logout`, `GET me`.
+`AdminAccessService` (used by the back-office admin APIs, see
+[Admin Module](#admin-module)) is built on `AdminAuthService.validateRole()` and gates
+against the `GlobalAdminRoles` hierarchy stored in
+`sys_admin_roles.identifier`. Admins **cannot** grant `sys_roles` to tenant
+users — that's a planned tenant-side self-service feature, not yet built; an
+admin with the `admin` role can grant `sys_admin_roles` to other admins via
+`POST /admin/users/admins`.
 
 ### Encryption
 
@@ -522,19 +557,21 @@ processor.
 ### Roles
 
 Global roles (`GlobalAdminRoles`) are ordered by seniority — a senior role
-satisfies any junior requirement:
+satisfies any junior requirement. They're held by admins only
+(`sys_admin_users`, via `sys_auser_roles`) — never by tenant users:
 
-| Role (`sys_roles.name`)  | Capability                                           |
-| ------------------------ | ---------------------------------------------------- |
+| Role (`sys_admin_roles.identifier`) | Capability                                           |
+| ------------------------------------ | ---------------------------------------------------- |
 | `global.super.admin`     | View/change/delete everything, including tenant info |
 | `global.admin`           | Tenant listing and admin-user management             |
 | `global.content.manager` | View/change/edit everything except tenant info       |
 | `global.content.reader`  | Read-only access to non-tenant content               |
 
 `AdminAccessService` exposes `validateSuperAdmin()`, `validateAdmin()`,
-`validateContentManager()` and `validateContentReader()`. Each authenticates the
-caller and returns `{ user, roles }` so the controller can pass the actor to a
-processor.
+`validateContentManager()` and `validateContentReader()`. Each authenticates
+the caller via `AdminAuthService.validateRole()` and returns `{ user, roles }`
+(an `AdminUserEntity` plus its `SystemAdminRoleEntity[]`) so the controller can
+pass the actor to a processor.
 
 ### Endpoints
 
@@ -551,6 +588,10 @@ processor.
 List endpoints are `POST .../list` with the filter payload in the body (a
 `CommonListFilterDto`) — see [List Endpoints & Filtering](#list-endpoints--filtering).
 
+Auth endpoints for admins themselves (`login`, `refresh`, `logout`, `me`) live
+at `/admin/auth` (`AdminAuthController`) — see
+[Admin authentication](#admin-authentication-separate-stack) — not in this module.
+
 ### Flow
 
 ```ts
@@ -562,10 +603,18 @@ async onboard(@Body() dto: AddTenantDto) {
 ```
 
 Data processors extend `CommonDataProcessor` and are created per request
-(`new XxxDataProcessor(actor, ...deps).process(dto)`); list processors return a
+(`new XxxDataProcessor(...deps).process(dto)`); list processors return a
 `PaginatedResult`. Bulk registration validates the entire batch before any insert.
-Admins and client users share `sys_users`, distinguished by the `UserType` enum on
-`user_type` (`system.user` vs `tenant.user`).
+
+Admins (`sys_admin_users`) and client users (`sys_users`) are **entirely
+separate tables**, not a discriminator on a shared one.
+`ClientUserDataProcessor`/`BulkUserDataProcessor` create `sys_users` rows with
+**no role granting** — an admin creating a client user cannot also grant it
+`sys_roles`, since `sys_user_roles.created_by` references `sys_users` only and
+an admin has no row there. Tenant users granting roles to other tenant users
+is a planned self-service feature, not yet built. `AdminUserDataProcessor`
+creates `sys_admin_users` rows and grants `sys_admin_roles` via
+`sys_auser_roles`.
 
 ### API docs (Swagger)
 

package/dist/admin/controllers/admin.user.controller.d.ts

@@ -9,6 +9,6 @@ export declare class AdminUserController {
     constructor(adminAccessService: AdminAccessService, tenantService: TenantService);
     addClientUser(dto: AddClientUserDto): Promise<import("../..").UserEntity>;
     addClientUsersBulk(dto: AddBulkUsersDto): Promise<import("../libraries/bulk.user.data.processor").BulkUserResult>;
-    addAdminUser(dto: AddAdminUserDto): Promise<import("../..").UserEntity>;
+    addAdminUser(dto: AddAdminUserDto): Promise<import("../..").AdminUserEntity>;
 }
 //# sourceMappingURL=admin.user.controller.d.ts.map

package/dist/admin/controllers/admin.user.controller.js

@@ -29,12 +29,12 @@ let AdminUserController = class AdminUserController {
         this.tenantService = tenantService;
     }
     async addClientUser(dto) {
-        const { user } = await this.adminAccessService.validateSuperAdmin();
-        return new client_user_data_processor_1.ClientUserDataProcessor(user, this.tenantService).process(dto);
+        await this.adminAccessService.validateSuperAdmin();
+        return new client_user_data_processor_1.ClientUserDataProcessor(this.tenantService).process(dto);
     }
     async addClientUsersBulk(dto) {
-        const { user } = await this.adminAccessService.validateSuperAdmin();
-        return new bulk_user_data_processor_1.BulkUserDataProcessor(user, this.tenantService).process(dto);
+        await this.adminAccessService.validateSuperAdmin();
+        return new bulk_user_data_processor_1.BulkUserDataProcessor(this.tenantService).process(dto);
     }
     async addAdminUser(dto) {
         const { user } = await this.adminAccessService.validateAdmin();

package/dist/admin/controllers/admin.user.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.user.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.user.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAwD;AACxD,6CAAuE;AACvE,yEAAqE;AACrE,2EAAsE;AACtE,wFAAkF;AAClF,oFAA8E;AAC9E,sFAAgF;AAChF,qEAA+D;AAC/D,mEAA6D;AAC7D,mEAA6D;AAKtD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YACmB,kBAAsC,EACtC,aAA4B;QAD5B,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,kBAAa,GAAb,aAAa,CAAe;IAC5C,CAAC;IAOE,AAAN,KAAK,CAAC,aAAa,CAAS,GAAqB;QAC/C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QACpE,OAAO,IAAI,oDAAuB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5E,CAAC;IAOK,AAAN,KAAK,CAAC,kBAAkB,CAAS,GAAoB;QACnD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QACpE,OAAO,IAAI,gDAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC;IAOK,AAAN,KAAK,CAAC,YAAY,CAAS,GAAoB;QAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,kDAAsB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;AAnCY,kDAAmB;AAWxB;IALL,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EAAE,uCAAuC;KACrD,CAAC;IACmB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,sCAAgB;;wDAGhD;AAOK;IALL,IAAA,aAAI,EAAC,cAAc,CAAC;IACpB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,uCAAuC;KACrD,CAAC;IACwB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,oCAAe;;6DAGpD;AAOK;IALL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EAAE,0CAA0C;KACxD,CAAC;IACkB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,oCAAe;;uDAG9C;8BAlCU,mBAAmB;IAH/B,IAAA,iBAAO,EAAC,eAAe,CAAC;IACxB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,aAAa,CAAC;qCAGe,yCAAkB;QACvB,8BAAa;GAHpC,mBAAmB,CAmC/B"}
+{"version":3,"file":"admin.user.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.user.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAwD;AACxD,6CAAuE;AACvE,yEAAqE;AACrE,2EAAsE;AACtE,wFAAkF;AAClF,oFAA8E;AAC9E,sFAAgF;AAChF,qEAA+D;AAC/D,mEAA6D;AAC7D,mEAA6D;AAKtD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YACmB,kBAAsC,EACtC,aAA4B;QAD5B,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,kBAAa,GAAb,aAAa,CAAe;IAC5C,CAAC;IAOE,AAAN,KAAK,CAAC,aAAa,CAAS,GAAqB;QAC/C,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QACnD,OAAO,IAAI,oDAAuB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;IAOK,AAAN,KAAK,CAAC,kBAAkB,CAAS,GAAoB;QACnD,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QACnD,OAAO,IAAI,gDAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAOK,AAAN,KAAK,CAAC,YAAY,CAAS,GAAoB;QAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,kDAAsB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;CACF,CAAA;AAnCY,kDAAmB;AAWxB;IALL,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EAAE,uCAAuC;KACrD,CAAC;IACmB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,sCAAgB;;wDAGhD;AAOK;IALL,IAAA,aAAI,EAAC,cAAc,CAAC;IACpB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,uCAAuC;KACrD,CAAC;IACwB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,oCAAe;;6DAGpD;AAOK;IALL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EAAE,0CAA0C;KACxD,CAAC;IACkB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,oCAAe;;uDAG9C;8BAlCU,mBAAmB;IAH/B,IAAA,iBAAO,EAAC,eAAe,CAAC;IACxB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,aAAa,CAAC;qCAGe,yCAAkB;QACvB,8BAAa;GAHpC,mBAAmB,CAmC/B"}

package/dist/admin/dtos/add.admin.user.dto.d.ts

@@ -1,5 +1,9 @@
-import { BaseUserDto } from './base.user.dto';
-export declare class AddAdminUserDto extends BaseUserDto {
+export declare class AddAdminUserDto {
+    name: string;
+    email: string;
+    username: string;
+    password: string;
     role_ids: string[];
+    attributes?: Record<string, any>;
 }
 //# sourceMappingURL=add.admin.user.dto.d.ts.map

package/dist/admin/dtos/add.admin.user.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"add.admin.user.dto.d.ts","sourceRoot":"","sources":["../../../src/admin/dtos/add.admin.user.dto.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAM9C,qBAAa,eAAgB,SAAQ,WAAW;IAStC,QAAQ,EAAE,MAAM,EAAE,CAAC;CAC5B"}
+{"version":3,"file":"add.admin.user.dto.d.ts","sourceRoot":"","sources":["../../../src/admin/dtos/add.admin.user.dto.ts"],"names":[],"mappings":"AAcA,qBAAa,eAAe;IAI1B,IAAI,EAAE,MAAM,CAAC;IAKb,KAAK,EAAE,MAAM,CAAC;IAKd,QAAQ,EAAE,MAAM,CAAC;IAMjB,QAAQ,EAAE,MAAM,CAAC;IAUjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IAKnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAClC"}

package/dist/admin/dtos/add.admin.user.dto.js

@@ -12,19 +12,49 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AddAdminUserDto = void 0;
 const class_validator_1 = require("class-validator");
 const swagger_1 = require("@nestjs/swagger");
-const base_user_dto_1 = require("./base.user.dto");
-class AddAdminUserDto extends base_user_dto_1.BaseUserDto {
+class AddAdminUserDto {
 }
 exports.AddAdminUserDto = AddAdminUserDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'Jane Doe' }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(255),
+    __metadata("design:type", String)
+], AddAdminUserDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'jane@company.com' }),
+    (0, class_validator_1.IsEmail)(),
+    (0, class_validator_1.MaxLength)(255),
+    __metadata("design:type", String)
+], AddAdminUserDto.prototype, "email", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'jane.doe' }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(255),
+    __metadata("design:type", String)
+], AddAdminUserDto.prototype, "username", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'S3curePass!', minLength: 8 }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MinLength)(8),
+    (0, class_validator_1.MaxLength)(72),
+    __metadata("design:type", String)
+], AddAdminUserDto.prototype, "password", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({
         type: [String],
         format: 'uuid',
-        description: 'sys_roles UUIDs — must reference global.* admin roles.',
+        description: 'sys_admin_roles UUIDs to grant the admin user.',
     }),
     (0, class_validator_1.IsArray)(),
     (0, class_validator_1.ArrayMinSize)(1),
     (0, class_validator_1.IsUUID)('all', { each: true }),
     __metadata("design:type", Array)
 ], AddAdminUserDto.prototype, "role_ids", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ type: 'object', additionalProperties: true }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsObject)(),
+    __metadata("design:type", Object)
+], AddAdminUserDto.prototype, "attributes", void 0);
 //# sourceMappingURL=add.admin.user.dto.js.map

package/dist/admin/dtos/add.admin.user.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"add.admin.user.dto.js","sourceRoot":"","sources":["../../../src/admin/dtos/add.admin.user.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAgE;AAChE,6CAA8C;AAC9C,mDAA8C;AAM9C,MAAa,eAAgB,SAAQ,2BAAW;CAU/C;AAVD,0CAUC;AADS;IARP,IAAA,qBAAW,EAAC;QACX,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,wDAAwD;KACtE,CAAC;IACD,IAAA,yBAAO,GAAE;IACT,IAAA,8BAAY,EAAC,CAAC,CAAC;IACf,IAAA,wBAAM,EAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;iDACH"}
+{"version":3,"file":"add.admin.user.dto.js","sourceRoot":"","sources":["../../../src/admin/dtos/add.admin.user.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAUyB;AACzB,6CAAmE;AAGnE,MAAa,eAAe;CAoC3B;AApCD,0CAoCC;AAhCC;IAHC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACpC,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,GAAG,CAAC;;6CACF;AAKb;IAHC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC5C,IAAA,yBAAO,GAAE;IACT,IAAA,2BAAS,EAAC,GAAG,CAAC;;8CACD;AAKd;IAHC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACpC,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,GAAG,CAAC;;iDACE;AAMjB;IAJC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACrD,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,CAAC,CAAC;IACZ,IAAA,2BAAS,EAAC,EAAE,CAAC;;iDACG;AAUjB;IARC,IAAA,qBAAW,EAAC;QACX,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,gDAAgD;KAC9D,CAAC;IACD,IAAA,yBAAO,GAAE;IACT,IAAA,8BAAY,EAAC,CAAC,CAAC;IACf,IAAA,wBAAM,EAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;iDACX;AAKnB;IAHC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;IACnE,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;mDACsB"}

package/dist/admin/dtos/base.user.dto.d.ts

@@ -6,7 +6,6 @@ export declare class BaseUserDto {
     contact_code?: string;
     contact?: string;
     active?: boolean;
-    role_ids?: string[];
     attributes?: Record<string, any>;
 }
 //# sourceMappingURL=base.user.dto.d.ts.map

package/dist/admin/dtos/base.user.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base.user.dto.d.ts","sourceRoot":"","sources":["../../../src/admin/dtos/base.user.dto.ts"],"names":[],"mappings":"AAiBA,qBAAa,WAAW;IAItB,SAAS,EAAE,MAAM,CAAC;IAKlB,KAAK,EAAE,MAAM,CAAC;IAMd,QAAQ,EAAE,MAAM,CAAC;IAMjB,OAAO,CAAC,EAAE,MAAM,CAAC;IAMjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,OAAO,CAAC,EAAE,MAAM,CAAC;IAKjB,MAAM,CAAC,EAAE,OAAO,CAAC;IAUjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAKpB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAClC"}
+{"version":3,"file":"base.user.dto.d.ts","sourceRoot":"","sources":["../../../src/admin/dtos/base.user.dto.ts"],"names":[],"mappings":"AAiBA,qBAAa,WAAW;IAItB,SAAS,EAAE,MAAM,CAAC;IAKlB,KAAK,EAAE,MAAM,CAAC;IAMd,QAAQ,EAAE,MAAM,CAAC;IAMjB,OAAO,CAAC,EAAE,MAAM,CAAC;IAMjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,OAAO,CAAC,EAAE,MAAM,CAAC;IAKjB,MAAM,CAAC,EAAE,OAAO,CAAC;IAKjB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAClC"}

package/dist/admin/dtos/base.user.dto.js

@@ -61,17 +61,6 @@ __decorate([
     (0, class_validator_1.IsBoolean)(),
     __metadata("design:type", Boolean)
 ], BaseUserDto.prototype, "active", void 0);
-__decorate([
-    (0, swagger_1.ApiPropertyOptional)({
-        type: [String],
-        format: 'uuid',
-        description: 'sys_roles UUIDs to grant the user.',
-    }),
-    (0, class_validator_1.IsOptional)(),
-    (0, class_validator_1.IsArray)(),
-    (0, class_validator_1.IsUUID)('all', { each: true }),
-    __metadata("design:type", Array)
-], BaseUserDto.prototype, "role_ids", void 0);
 __decorate([
     (0, swagger_1.ApiPropertyOptional)({ type: 'object', additionalProperties: true }),
     (0, class_validator_1.IsOptional)(),

package/dist/admin/dtos/base.user.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"base.user.dto.js","sourceRoot":"","sources":["../../../src/admin/dtos/base.user.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAUyB;AACzB,6CAAmE;AAMnE,MAAa,WAAW;CAsDvB;AAtDD,kCAsDC;AAlDC;IAHC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACpC,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,GAAG,CAAC;;8CACG;AAKlB;IAHC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IACzC,IAAA,yBAAO,GAAE;IACT,IAAA,2BAAS,EAAC,GAAG,CAAC;;0CACD;AAMd;IAJC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACrD,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,CAAC,CAAC;IACZ,IAAA,2BAAS,EAAC,EAAE,CAAC;;6CACG;AAMjB;IAJC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,EAAE,CAAC;;4CACG;AAMjB;IAJC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACxC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,EAAE,CAAC;;iDACQ;AAMtB;IAJC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC9C,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,EAAE,CAAC;;4CACG;AAKjB;IAHC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtC,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,GAAE;;2CACK;AAUjB;IARC,IAAA,6BAAmB,EAAC;QACnB,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,oCAAoC;KAClD,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,yBAAO,GAAE;IACT,IAAA,wBAAM,EAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;6CACV;AAKpB;IAHC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;IACnE,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;+CACsB"}
+{"version":3,"file":"base.user.dto.js","sourceRoot":"","sources":["../../../src/admin/dtos/base.user.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAQyB;AACzB,6CAAmE;AAQnE,MAAa,WAAW;CA4CvB;AA5CD,kCA4CC;AAxCC;IAHC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACpC,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,GAAG,CAAC;;8CACG;AAKlB;IAHC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IACzC,IAAA,yBAAO,GAAE;IACT,IAAA,2BAAS,EAAC,GAAG,CAAC;;0CACD;AAMd;IAJC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACrD,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,CAAC,CAAC;IACZ,IAAA,2BAAS,EAAC,EAAE,CAAC;;6CACG;AAMjB;IAJC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,EAAE,CAAC;;4CACG;AAMjB;IAJC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACxC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,EAAE,CAAC;;iDACQ;AAMtB;IAJC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC9C,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,EAAE,CAAC;;4CACG;AAKjB;IAHC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACtC,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,GAAE;;2CACK;AAKjB;IAHC,IAAA,6BAAmB,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;IACnE,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;+CACsB"}

package/dist/admin/es6.classes.d.ts

@@ -9,6 +9,7 @@ import { ScheduledTaskDataProcessor } from './libraries/scheduled.task.data.proc
 import { ScheduledTaskListProcessor } from './libraries/scheduled.task.list.processor';
 import { TenantDataProcessor } from './libraries/tenant.data.processor';
 import { TenantListProcessor } from './libraries/tenant.list.processor';
+import { AddAdminUserDto } from './dtos/add.admin.user.dto';
 import { ScheduleIntervalDto } from './dtos/add.scheduled.task.dto';
 import { AddTenantDto } from './dtos/add.tenant.dto';
 import { BaseUserDto } from './dtos/base.user.dto';
@@ -17,7 +18,7 @@ export declare const es6Classes: {
     controllers: (typeof AdminScheduledTaskController | typeof AdminTenantController | typeof AdminUserController)[];
     services: readonly [typeof AdminAccessService];
     libraries: (typeof ScheduledTaskDataProcessor | typeof ScheduledTaskListProcessor | typeof TenantDataProcessor | typeof TenantListProcessor | typeof ClientUserDataProcessor | typeof BulkUserDataProcessor | typeof AdminUserDataProcessor)[];
-    dtos: (typeof ScheduleIntervalDto | typeof ScheduledTaskListDto | typeof AddTenantDto | typeof BaseUserDto)[];
+    dtos: (typeof ScheduleIntervalDto | typeof ScheduledTaskListDto | typeof AddTenantDto | typeof BaseUserDto | typeof AddAdminUserDto)[];
     jobs: any[];
     subscribers: any[];
 };

package/dist/admin/es6.classes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"es6.classes.d.ts","sourceRoot":"","sources":["../../src/admin/es6.classes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAIxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAGtE,eAAO,MAAM,UAAU;;;;;;;CAOtB,CAAC"}
+{"version":3,"file":"es6.classes.d.ts","sourceRoot":"","sources":["../../src/admin/es6.classes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAGtE,eAAO,MAAM,UAAU;;;;;;;CA4BtB,CAAC"}

package/dist/admin/es6.classes.js

@@ -21,10 +21,31 @@ const base_user_dto_1 = require("./dtos/base.user.dto");
 const scheduled_task_list_dto_1 = require("./dtos/scheduled.task.list.dto");
 const tenant_list_dto_1 = require("./dtos/tenant.list.dto");
 exports.es6Classes = {
-    controllers: [admin_scheduled_task_controller_1.AdminScheduledTaskController, admin_tenant_controller_1.AdminTenantController, admin_user_controller_1.AdminUserController],
+    controllers: [
+        admin_scheduled_task_controller_1.AdminScheduledTaskController,
+        admin_tenant_controller_1.AdminTenantController,
+        admin_user_controller_1.AdminUserController,
+    ],
     services: [admin_access_service_1.AdminAccessService],
-    libraries: [admin_user_data_processor_1.AdminUserDataProcessor, bulk_user_data_processor_1.BulkUserDataProcessor, client_user_data_processor_1.ClientUserDataProcessor, scheduled_task_data_processor_1.ScheduledTaskDataProcessor, scheduled_task_list_processor_1.ScheduledTaskListProcessor, tenant_data_processor_1.TenantDataProcessor, tenant_list_processor_1.TenantListProcessor],
-    dtos: [add_admin_user_dto_1.AddAdminUserDto, add_bulk_users_dto_1.BulkUserItemDto, add_client_user_dto_1.AddClientUserDto, add_scheduled_task_dto_1.ScheduleIntervalDto, add_tenant_dto_1.AddTenantDto, base_user_dto_1.BaseUserDto, scheduled_task_list_dto_1.ScheduledTaskListDto, tenant_list_dto_1.TenantListDto],
+    libraries: [
+        admin_user_data_processor_1.AdminUserDataProcessor,
+        bulk_user_data_processor_1.BulkUserDataProcessor,
+        client_user_data_processor_1.ClientUserDataProcessor,
+        scheduled_task_data_processor_1.ScheduledTaskDataProcessor,
+        scheduled_task_list_processor_1.ScheduledTaskListProcessor,
+        tenant_data_processor_1.TenantDataProcessor,
+        tenant_list_processor_1.TenantListProcessor,
+    ],
+    dtos: [
+        add_admin_user_dto_1.AddAdminUserDto,
+        add_bulk_users_dto_1.BulkUserItemDto,
+        add_client_user_dto_1.AddClientUserDto,
+        add_scheduled_task_dto_1.ScheduleIntervalDto,
+        add_tenant_dto_1.AddTenantDto,
+        base_user_dto_1.BaseUserDto,
+        scheduled_task_list_dto_1.ScheduledTaskListDto,
+        tenant_list_dto_1.TenantListDto,
+    ],
     jobs: [],
     subscribers: [],
 };

package/dist/admin/es6.classes.js.map

@@ -1 +1 @@
-{"version":3,"file":"es6.classes.js","sourceRoot":"","sources":["../../src/admin/es6.classes.ts"],"names":[],"mappings":";;;AAAA,mGAA6F;AAC7F,mFAA8E;AAC9E,+EAA0E;AAC1E,0EAAqE;AACrE,qFAA+E;AAC/E,mFAA6E;AAC7E,uFAAiF;AACjF,6FAAuF;AACvF,6FAAuF;AACvF,6EAAwE;AACxE,6EAAwE;AACxE,kEAA4D;AAC5D,kEAA4D;AAC5D,oEAA8D;AAC9D,0EAAoE;AACpE,0DAAqD;AACrD,wDAAmD;AACnD,4EAAsE;AACtE,4DAAuD;AAE1C,QAAA,UAAU,GAAG;IACxB,WAAW,EAAE,CAAC,8DAA4B,EAAE,+CAAqB,EAAE,2CAAmB,CAAC;IACvF,QAAQ,EAAE,CAAC,yCAAkB,CAAU;IACvC,SAAS,EAAE,CAAC,kDAAsB,EAAE,gDAAqB,EAAE,oDAAuB,EAAE,0DAA0B,EAAE,0DAA0B,EAAE,2CAAmB,EAAE,2CAAmB,CAAC;IACrL,IAAI,EAAE,CAAC,oCAAe,EAAE,oCAAe,EAAE,sCAAgB,EAAE,4CAAmB,EAAE,6BAAY,EAAE,2BAAW,EAAE,8CAAoB,EAAE,+BAAa,CAAC;IAC/I,IAAI,EAAE,EAAE;IACR,WAAW,EAAE,EAAE;CAChB,CAAC"}
+{"version":3,"file":"es6.classes.js","sourceRoot":"","sources":["../../src/admin/es6.classes.ts"],"names":[],"mappings":";;;AAAA,mGAA6F;AAC7F,mFAA8E;AAC9E,+EAA0E;AAC1E,0EAAqE;AACrE,qFAA+E;AAC/E,mFAA6E;AAC7E,uFAAiF;AACjF,6FAAuF;AACvF,6FAAuF;AACvF,6EAAwE;AACxE,6EAAwE;AACxE,kEAA4D;AAC5D,kEAA4D;AAC5D,oEAA8D;AAC9D,0EAAoE;AACpE,0DAAqD;AACrD,wDAAmD;AACnD,4EAAsE;AACtE,4DAAuD;AAE1C,QAAA,UAAU,GAAG;IACxB,WAAW,EAAE;QACX,8DAA4B;QAC5B,+CAAqB;QACrB,2CAAmB;KACpB;IACD,QAAQ,EAAE,CAAC,yCAAkB,CAAU;IACvC,SAAS,EAAE;QACT,kDAAsB;QACtB,gDAAqB;QACrB,oDAAuB;QACvB,0DAA0B;QAC1B,0DAA0B;QAC1B,2CAAmB;QACnB,2CAAmB;KACpB;IACD,IAAI,EAAE;QACJ,oCAAe;QACf,oCAAe;QACf,sCAAgB;QAChB,4CAAmB;QACnB,6BAAY;QACZ,2BAAW;QACX,8CAAoB;QACpB,+BAAa;KACd;IACD,IAAI,EAAE,EAAE;IACR,WAAW,EAAE,EAAE;CAChB,CAAC"}

package/dist/admin/libraries/admin.user.data.processor.d.ts

@@ -1,10 +1,17 @@
-import { UserDataProcessor } from './user.data.processor';
-import { UserEntity } from '../../auth/entities/user.entity';
+import { CommonDataProcessor } from '../../common/libraries/common.data.processor';
+import { AdminUserEntity } from '../../auth/entities/admin.user.entity';
 import { AddAdminUserDto } from '../dtos/add.admin.user.dto';
-export declare class AdminUserDataProcessor extends UserDataProcessor {
+export declare class AdminUserDataProcessor extends CommonDataProcessor {
+    private readonly actor;
     protected payload: AddAdminUserDto;
-    process(payload: AddAdminUserDto): Promise<UserEntity>;
+    constructor(actor: AdminUserEntity);
+    process(payload: AddAdminUserDto): Promise<AdminUserEntity>;
     private validate;
     private create;
+    private assertEmailAvailable;
+    private assertUsernameAvailable;
+    private resolveAdminRoles;
+    private grantAdminRoles;
+    private stripSecrets;
 }
 //# sourceMappingURL=admin.user.data.processor.d.ts.map

package/dist/admin/libraries/admin.user.data.processor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.user.data.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/admin.user.data.processor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAM7D,qBAAa,sBAAuB,SAAQ,iBAAiB;IAC3D,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;IAE7B,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC;YAM9C,QAAQ;YASR,MAAM;CAoBrB"}
+{"version":3,"file":"admin.user.data.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/admin.user.data.processor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACnF,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAGxE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAG7D,qBAAa,sBAAuB,SAAQ,mBAAmB;IAGjD,OAAO,CAAC,QAAQ,CAAC,KAAK;IAFlC,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEN,KAAK,EAAE,eAAe;IAI7C,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;YAMnD,QAAQ;YAQR,MAAM;YAiBN,oBAAoB;YAQpB,uBAAuB;YASvB,iBAAiB;YAiBjB,eAAe;IAc7B,OAAO,CAAC,YAAY;CAIrB"}

package/dist/admin/libraries/admin.user.data.processor.js

@@ -1,10 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AdminUserDataProcessor = void 0;
-const user_data_processor_1 = require("./user.data.processor");
-const user_entity_1 = require("../../auth/entities/user.entity");
-const user_type_enum_1 = require("../../auth/enums/user.type.enum");
-class AdminUserDataProcessor extends user_data_processor_1.UserDataProcessor {
+const typeorm_1 = require("typeorm");
+const common_data_processor_1 = require("../../common/libraries/common.data.processor");
+const admin_user_entity_1 = require("../../auth/entities/admin.user.entity");
+const system_admin_role_entity_1 = require("../../auth/entities/system.admin.role.entity");
+const system_admin_user_role_entity_1 = require("../../auth/entities/system.admin.user.role.entity");
+class AdminUserDataProcessor extends common_data_processor_1.CommonDataProcessor {
+    constructor(actor) {
+        super();
+        this.actor = actor;
+    }
     async process(payload) {
         this.payload = payload;
         await this.validate();
@@ -12,27 +18,59 @@ class AdminUserDataProcessor extends user_data_processor_1.UserDataProcessor {
     }
     async validate() {
         await this.assertEmailAvailable(this.payload.email);
-        await this.resolveRoles(this.payload.role_ids, 'role_ids', {
-            requireGlobal: true,
-        });
+        await this.assertUsernameAvailable(this.payload.username);
+        await this.resolveAdminRoles(this.payload.role_ids, 'role_ids');
         this.throwExceptionOnError();
     }
     async create() {
         const body = this.payload;
-        const user = user_entity_1.UserEntity.create({
-            user_type: user_type_enum_1.UserType.SYSTEM_USER,
-            full_name: body.full_name,
+        const adminUser = admin_user_entity_1.AdminUserEntity.create({
+            name: body.name,
             email: body.email,
+            username: body.username,
             password: body.password,
-            country: body.country,
-            contact_code: body.contact_code,
-            contact: body.contact,
-            active: body.active ?? true,
             attributes: body.attributes ?? {},
         });
-        await user.save();
-        await this.grantRoles(user.id, body.role_ids);
-        return this.stripSecrets(user);
+        await adminUser.save();
+        await this.grantAdminRoles(adminUser.id, body.role_ids);
+        return this.stripSecrets(adminUser);
+    }
+    async assertEmailAvailable(email, field = 'email') {
+        const existing = await admin_user_entity_1.AdminUserEntity.findOne({ where: { email } });
+        if (existing)
+            this.setColumnError(field, 'Email is already registered');
+    }
+    async assertUsernameAvailable(username, field = 'username') {
+        const existing = await admin_user_entity_1.AdminUserEntity.findOne({ where: { username } });
+        if (existing)
+            this.setColumnError(field, 'Username is already taken');
+    }
+    async resolveAdminRoles(roleIds, field) {
+        if (!roleIds?.length)
+            return [];
+        const unique = [...new Set(roleIds)];
+        const roles = await system_admin_role_entity_1.SystemAdminRoleEntity.find({
+            where: { id: (0, typeorm_1.In)(unique) },
+        });
+        const foundIds = new Set(roles.map((role) => role.id));
+        for (const id of unique) {
+            if (!foundIds.has(id))
+                this.setColumnError(field, `Role ${id} not found`);
+        }
+        return roles;
+    }
+    async grantAdminRoles(adminUserId, roleIds = []) {
+        const links = [...new Set(roleIds)].map((roleId) => system_admin_user_role_entity_1.SystemAdminUserRoleEntity.create({
+            admin_user_id: adminUserId,
+            role_id: roleId,
+            created_by: this.actor.id,
+        }));
+        if (links.length)
+            await system_admin_user_role_entity_1.SystemAdminUserRoleEntity.save(links);
+    }
+    stripSecrets(adminUser) {
+        delete adminUser.password;
+        return adminUser;
     }
 }
 exports.AdminUserDataProcessor = AdminUserDataProcessor;

package/dist/admin/libraries/admin.user.data.processor.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.user.data.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/admin.user.data.processor.ts"],"names":[],"mappings":";;;AAAA,+DAA0D;AAC1D,iEAA6D;AAC7D,oEAA2D;AAO3D,MAAa,sBAAuB,SAAQ,uCAAiB;IAG3D,KAAK,CAAC,OAAO,CAAC,OAAwB;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE;YACzD,aAAa,EAAE,IAAI;SACpB,CAAC,CAAC;QAEH,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1B,MAAM,IAAI,GAAG,wBAAU,CAAC,MAAM,CAAC;YAC7B,SAAS,EAAE,yBAAQ,CAAC,WAAW;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;YAC3B,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE;SAClC,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAElB,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE9C,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;CACF;AAtCD,wDAsCC"}
+{"version":3,"file":"admin.user.data.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/admin.user.data.processor.ts"],"names":[],"mappings":";;;AAAA,qCAA6B;AAC7B,wFAAmF;AACnF,6EAAwE;AACxE,2FAAqF;AACrF,qGAA8F;AAI9F,MAAa,sBAAuB,SAAQ,2CAAmB;IAG7D,YAA6B,KAAsB;QACjD,KAAK,EAAE,CAAC;QADmB,UAAK,GAAL,KAAK,CAAiB;IAEnD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAwB;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEhE,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1B,MAAM,SAAS,GAAG,mCAAe,CAAC,MAAM,CAAC;YACvC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE;SAClC,CAAC,CAAC;QACH,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QAEvB,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAExD,OAAO,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAChC,KAAa,EACb,KAAK,GAAG,OAAO;QAEf,MAAM,QAAQ,GAAG,MAAM,mCAAe,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,QAAQ;YAAE,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,QAAgB,EAChB,KAAK,GAAG,UAAU;QAElB,MAAM,QAAQ,GAAG,MAAM,mCAAe,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QACxE,IAAI,QAAQ;YAAE,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;IACxE,CAAC;IAGO,KAAK,CAAC,iBAAiB,CAC7B,OAAiB,EACjB,KAAa;QAEb,IAAI,CAAC,OAAO,EAAE,MAAM;YAAE,OAAO,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,gDAAqB,CAAC,IAAI,CAAC;YAC7C,KAAK,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC,EAAE;SAC1B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;YACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,eAAe,CAC3B,WAAmB,EACnB,UAAoB,EAAE;QAEtB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACjD,yDAAyB,CAAC,MAAM,CAAC;YAC/B,aAAa,EAAE,WAAW;YAC1B,OAAO,EAAE,MAAM;YACf,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;SAC1B,CAAC,CACH,CAAC;QACF,IAAI,KAAK,CAAC,MAAM;YAAE,MAAM,yDAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IAEO,YAAY,CAA4B,SAAY;QAC1D,OAAQ,SAAmC,CAAC,QAAQ,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AA1FD,wDA0FC"}

package/dist/admin/libraries/bulk.user.data.processor.d.ts

@@ -9,7 +9,7 @@ export interface BulkUserResult {
 export declare class BulkUserDataProcessor extends UserDataProcessor {
     private readonly tenantService;
     protected payload: AddBulkUsersDto;
-    constructor(actor: UserEntity, tenantService: TenantService);
+    constructor(tenantService: TenantService);
     process(payload: AddBulkUsersDto): Promise<BulkUserResult>;
     private validate;
     private create;

package/dist/admin/libraries/bulk.user.data.processor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk.user.data.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/bulk.user.data.processor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAG7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAOD,qBAAa,qBAAsB,SAAQ,iBAAiB;IAKxD,OAAO,CAAC,QAAQ,CAAC,aAAa;IAJhC,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;gBAGjC,KAAK,EAAE,UAAU,EACA,aAAa,EAAE,aAAa;IAKzC,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;YAMlD,QAAQ;YAeR,MAAM;IAgCpB,OAAO,CAAC,mBAAmB;YAiBb,eAAe;CAa9B"}
+{"version":3,"file":"bulk.user.data.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/bulk.user.data.processor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAQD,qBAAa,qBAAsB,SAAQ,iBAAiB;IAG9C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEN,aAAa,EAAE,aAAa;IAInD,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;YAMlD,QAAQ;YAWR,MAAM;IA0BpB,OAAO,CAAC,mBAAmB;YAiBb,eAAe;CAa9B"}

package/dist/admin/libraries/bulk.user.data.processor.js

@@ -4,11 +4,10 @@ exports.BulkUserDataProcessor = void 0;
 const typeorm_1 = require("typeorm");
 const user_data_processor_1 = require("./user.data.processor");
 const user_entity_1 = require("../../auth/entities/user.entity");
-const user_role_entity_1 = require("../../auth/entities/user.role.entity");
 const user_type_enum_1 = require("../../auth/enums/user.type.enum");
 class BulkUserDataProcessor extends user_data_processor_1.UserDataProcessor {
-    constructor(actor, tenantService) {
-        super(actor);
+    constructor(tenantService) {
+        super();
         this.tenantService = tenantService;
     }
     async process(payload) {
@@ -22,10 +21,6 @@ class BulkUserDataProcessor extends user_data_processor_1.UserDataProcessor {
             this.setColumnError('tenant_id', 'Tenant not found or inactive');
         this.flagDuplicateEmails();
         await this.flagTakenEmails();
-        const allRoleIds = [
-            ...new Set(this.payload.users.flatMap((user) => user.role_ids ?? [])),
-        ];
-        await this.resolveRoles(allRoleIds, 'role_ids', { forbidGlobal: true });
         this.throwExceptionOnError();
     }
     async create() {
@@ -43,12 +38,6 @@ class BulkUserDataProcessor extends user_data_processor_1.UserDataProcessor {
             attributes: user.attributes ?? {},
         }));
         await user_entity_1.UserEntity.save(entities);
-        const links = [];
-        entities.forEach((user, index) => {
-            links.push(...this.buildRoleLinks(user.id, body.users[index].role_ids));
-        });
-        if (links.length)
-            await user_role_entity_1.UserRoleEntity.save(links);
         return {
             created: entities.length,
             users: entities.map((user) => this.stripSecrets(user)),