@neohm/nestend 3.1.5 → 3.3.0

package/README.md

@@ -106,7 +106,8 @@ these are free to change without a breaking release.
 | Scheduled events  | `SystemScheduledTaskEntity`, `ScheduledEventEntity`, `ScheduleKind`, `ScheduleSpec`, `IsCronExpression`                              | schedule definitions in `sys_scheduled_tasks` → events in `sys_scheduled_events`; interval / cron / once specs with timezones, drift-free slots, horizon materialisation, catch-up + overlap policies, fire-once dispatch with backoff, cadence via `SCHEDULED_EVENT_MIN` |
 | Auth              | `AuthModule`, `AuthService.validateRole()`, `Auth`, `JwtMiddleware`                                                                  | imperative auth (open by default); JwtMiddleware resolves the user into `Auth`'s AsyncLocalStorage context per request; access + rotating refresh tokens; session-based logout invalidation (`sys_auth_sessions`); Google SSO via ID token at `POST /auth/google`         |
 | Admin auth        | `AdminAuthService.validateRole()`, `AdminAuth`, `AdminJwtMiddleware` (endpoints at `/admin/auth`)                                    | fully separate stack for back-office admins — own users table (`sys_admin_users`), own roles (`sys_admin_roles`/`sys_auser_roles`), own sessions/refresh tokens (shared tables, `is_admin` flag)                                                                          |
-| API keys          | `ApiKeyService`, `ApiKeyGuard` / `ApiKeyMiddleware`, `@ApiKeyScopes()`, `ScopeEntity`, `ApiScopeEntity`                              | hashed keys in `sys_api_keys` (admin-owned), scopes, expiry/revocation, `x-api-key` header; normalized scopes catalogue in `sys_scopes`/`sys_api_scopes`                                                                                                                  |
+| API keys          | `ApiKeyService`, `ApiKeyGuard` / `ApiKeyMiddleware`, `@ApiKeyScopes()`, `ApiKeyContext`                                               | hashed keys in `sys_api_keys` (admin-owned), one tenant per key, expiry/revocation, `x-api-key` header; `validateAccess(scope)` returns the tenant the key acts for                                                                                                        |
+| Scopes            | `ScopeService`, `AuthService.validateAccess()`, `ScopeEntity`, `TenantScopeEntity`, `ApiScopeEntity`                                  | one feature named once in `sys_scopes`, then granted per organization (`sys_tenant_scopes`) or per API key (`sys_api_scopes`) — never an array on the principal                                                                                                            |
 | Multi-tenancy     | `TenantModule`, `TenantEntity`, `CommonTenantEntity`, `TenantContextService`, `TenantContextMiddleware`                              | AsyncLocalStorage tenant context; resolve by header, slug, or domain; tenants are onboarded by admins (`TenantEntity.creator` → `AdminUserEntity`)                                                                                                                        |
 | Admin             | `AdminModule` (its controllers, DTOs and processors are internal — import the module and hit the endpoints), `GlobalAdminRoles`      | back-office APIs: tenant onboarding, client/admin user registration (single + bulk, no role granting), tenant + scheduled-task listing; 4-tier `GlobalAdminRoles` gate over `sys_admin_roles`; Swagger at `/docs` (hidden in production)                                  |
 | Notifications     | `NotificationModule`, `NotificationService`, `FcmPushNotificationService`                                                            | in-app rows + FCM push (optional `firebase-admin`); device token registry                                                                                                                                                                                                 |
@@ -182,6 +183,17 @@ active session. Pass a role identifier to gate on a specific role:
 `validateRole('tenant.editor')`. This keeps authorization next to your business
 logic, so layering tenant/plan/role checks is just more code.
 
+For a feature that a whole organization is either enabled for or not, use
+`validateAccess(scopeIdentifier, roleIdentifier?)`: it first checks that the
+caller's tenant holds that scope (`sys_tenant_scopes` against the `sys_scopes`
+catalogue), then delegates to `validateRole()`. One call answers "is this feature
+sold to them?" and "is this person allowed to use it?" in that order.
+
+```ts
+const { user } = await this.authService.validateAccess('billing.invoices');
+const { user } = await this.authService.validateAccess('billing.invoices', 'tenant.editor');
+```
+
 `AuthController` (mounted at `/auth`) exposes the ready-made flows: `POST
 /auth/login`, `/auth/google`, `/auth/register`, `/auth/refresh`, `/auth/logout`,
 `/auth/change-password`, and `GET /auth/me`. Passwords are hashed/verified via
@@ -261,7 +273,7 @@ admin with the `admin` role can grant `sys_admin_roles` to other admins via
 
 | Variable            | Default | Description                                                                           |
 | ------------------- | ------- | ------------------------------------------------------------------------------------- |
-| `ENCRYPTION_SECRET` | —       | **Required** when `EncryptionService` is used. AES-256-GCM key material. Min 32 chars |
+| `ENCRYPTION_SECRET` | —       | **Required** when `EncryptionService` is used — which now includes issuing API keys (`key_encrypted`). AES-256-GCM key material. Min 32 chars |
 
 ### Cache (Redis)
 
@@ -553,9 +565,35 @@ a subscriber only starts firing once something constructs it.
 
 ### API Keys
 
-| Variable              | Default     | Description                         |
-| --------------------- | ----------- | ----------------------------------- |
-| `API_KEY_HEADER_NAME` | `x-api-key` | Request header carrying the API key |
+| Variable              | Default     | Description                                                      |
+| --------------------- | ----------- | ---------------------------------------------------------------- |
+| `API_KEY_HEADER_NAME` | `x-api-key` | Request header carrying the API key                              |
+| `ENCRYPTION_SECRET`   | —           | **Required to issue keys** — `key_encrypted` is AES-256-GCM      |
+
+A key is stored three ways: its sha256 hash in `key_hash` (what lookups match), a
+short visible prefix in `key_prefix`, and the key itself encrypted in
+`key_encrypted`. That last one makes a key recoverable after issuing, so a lost key
+does not force a reissue and a redeploy — `revealApiKey(uuid)` returns it, and
+`apiKeyDetail(uuid, reveal)` folds it into the detail as `key`. The column is
+`select: false` like `UserEntity.password`, so the ciphertext never rides along on a
+read. Note what it costs: a key is no longer irrecoverable by construction, so treat
+reaching either method as equivalent to holding the key — which is why
+`GET /admin/api-keys/:id` reveals it from the global admin role up and not to a
+content reader.
+
+A key belongs to one tenant and holds its scopes as `sys_api_scopes` rows against
+the `sys_scopes` catalogue — there is no scopes array on the key, and a key grants
+nothing it was not given (a granted `*` is the only blanket). `ApiKeyMiddleware`
+resolves the key, its tenant and its scope identifiers once per request into
+`ApiKeyContext`; enforce from there:
+
+```ts
+const { tenant } = this.apiKeyService.validateAccess('orders:read');
+// tenant is the sys_tenants row the key acts for — never taken from the payload
+```
+
+`ApiKeyGuard`/`@ApiKeyScopes()` remain available for guard-based enforcement;
+`hasScope()` is `async` now that grants are rows.
 
 ### Email Notifications (AWS SES)
 
@@ -757,18 +795,51 @@ pass the actor to a processor.
 
 ### Endpoints
 
-| Route                              | Min. role       | Processor                                                   |
-| ---------------------------------- | --------------- | ----------------------------------------------------------- |
-| `POST /admin/tenants`              | super admin     | `TenantDataProcessor` (upsert — send `id` to update)        |
-| `POST /admin/tenants/list`         | admin           | `TenantListProcessor`                                       |
-| `POST /admin/users/clients`        | super admin     | `ClientUserDataProcessor`                                   |
-| `POST /admin/users/clients/bulk`   | super admin     | `BulkUserDataProcessor`                                     |
-| `POST /admin/users/admins`         | admin           | `AdminUserDataProcessor`                                    |
-| `POST /admin/scheduled-tasks`      | content manager | `ScheduledTaskDataProcessor` (upsert — send `id` to update) |
-| `POST /admin/scheduled-tasks/list` | content reader  | `ScheduledTaskListProcessor`                                |
+| Route                                    | Min. role       | Handler                                                     |
+| ---------------------------------------- | --------------- | ----------------------------------------------------------- |
+| `POST /admin/tenants`                    | super admin     | `TenantDataProcessor` (upsert — send `id` to update)        |
+| `POST /admin/tenants/list`               | content reader  | `TenantListProcessor`                                       |
+| `GET  /admin/tenants/:id`                | content reader  | the row plus its `scopes`                                   |
+| `POST /admin/tenants/:id/delete`         | super admin     | `TenantDeleteProcessor`                                     |
+| `POST /admin/tenant-users`               | admin           | `ClientUserDataProcessor`                                   |
+| `POST /admin/tenant-users/bulk`          | admin           | `BulkUserDataProcessor`                                     |
+| `POST /admin/tenant-users/list`          | content reader  | `ClientUserListProcessor`                                   |
+| `GET  /admin/tenant-users/:id`           | content reader  | the row                                                     |
+| `POST /admin/tenant-users/:id/delete`    | admin           | `ClientUserDeleteProcessor`                                 |
+| `POST /admin/users`                      | super admin     | `AdminUserDataProcessor`                                    |
+| `POST /admin/users/list`                 | content reader  | `AdminUserListProcessor`                                    |
+| `GET  /admin/users/:id`                  | content reader  | the row                                                     |
+| `POST /admin/users/:id/delete`           | super admin     | `AdminUserDeleteProcessor`                                  |
+| `POST /admin/roles/list`                 | admin           | `AdminRoleListProcessor`                                    |
+| `POST /admin/roles/tenant/list`          | admin           | `RoleListProcessor`                                         |
+| `POST /admin/scheduled-tasks`            | content manager | `ScheduledTaskDataProcessor` (upsert — send `id` to update) |
+| `POST /admin/scheduled-tasks/list`       | content reader  | `ScheduledTaskListProcessor`                                |
+| `GET  /admin/scheduled-tasks/:id`        | content reader  | the row                                                     |
+| `POST /admin/scheduled-tasks/:id/delete` | content manager | `ScheduledTaskDeleteProcessor`                              |
+| `POST /admin/scopes`                     | content manager | `ScopeDataProcessor` (upsert — send `id` to update)         |
+| `POST /admin/scopes/list`                | content reader  | `ScopeListProcessor`                                        |
+| `GET  /admin/scopes/:id`                 | content reader  | the row                                                     |
+| `POST /admin/scopes/:id/delete`          | content manager | `ScopeService.deleteScope` (cascades to every grant)        |
+| `POST /admin/api-keys`                   | admin           | `ApiKeyDataProcessor` — returns `{ raw_key, api_key }`      |
+| `POST /admin/api-keys/list`              | content reader  | `ApiKeyListProcessor`                                       |
+| `GET  /admin/api-keys/:id`               | content reader  | the row, its `scopes`, and `key` from admin up              |
+| `POST /admin/api-keys/:id/disable`       | admin           | `ApiKeyService.disableApiKey` (reversible)                   |
+| `POST /admin/api-keys/:id/delete`        | admin           | `ApiKeyService.deleteApiKey` (soft, and revokes)             |
 
 List endpoints are `POST .../list` with the filter payload in the body (a
 `CommonListFilterDto`) — see [List Endpoints & Filtering](#list-endpoints--filtering).
+Deletes and the API-key disable are single-action, so they sit on the domain service
+rather than in a processor; processors are for the writes that validate a payload.
+
+**Scopes and grants.** A scope is defined once in `sys_scopes` (content manager),
+then granted to the principals that hold it. `AddTenantDto.scope_ids` carries the
+tenant's whole scope set — `setScopes()` grants what is new and soft-removes what is
+gone, so an omitted list revokes them all (a picker has no other way to clear its
+last selection); every other optional field on that DTO still keeps its stored value.
+An API key can only be granted scopes its tenant already holds, so a key never
+out-ranks the organization it acts for. The key comes back in the issue response as
+`raw_key`, and afterwards from `GET /admin/api-keys/:id` as `key` — for a global
+admin only.
 
 Auth endpoints for admins themselves (`login`, `refresh`, `logout`, `me`) live
 at `/admin/auth` (`AdminAuthController`) — see

package/dist/admin/controllers/admin.api.key.controller.d.ts

@@ -0,0 +1,24 @@
+import { SqlService } from '../../common/services/sql.service';
+import { ApiKeyService } from '../../auth/services/api.key.service';
+import { AdminAccessService } from '../services/admin.access.service';
+import { CommonParamsDto } from '../../common/dtos/common.params.dto';
+import { AddApiKeyDto } from '../dtos/add.api.key.dto';
+import { ApiKeyListDto } from '../dtos/api.key.list.dto';
+export declare class AdminApiKeyController {
+    private readonly adminAccessService;
+    private readonly apiKeyService;
+    private readonly sqlService;
+    constructor(adminAccessService: AdminAccessService, apiKeyService: ApiKeyService, sqlService: SqlService);
+    issue(dto: AddApiKeyDto): Promise<import("../types/admin.types").IssuedApiKey>;
+    list(dto: ApiKeyListDto): Promise<{
+        records: import("../..").SqlRow[];
+        total: number;
+        page: number;
+        limit: number;
+        total_pages: number;
+    }>;
+    detail({ id }: CommonParamsDto): Promise<import("../..").ApiKeyDetail>;
+    disable({ id }: CommonParamsDto): Promise<import("../..").DisableResult>;
+    remove({ id }: CommonParamsDto): Promise<import("../..").DeleteResult>;
+}
+//# sourceMappingURL=admin.api.key.controller.d.ts.map

package/dist/admin/controllers/admin.api.key.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.api.key.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.api.key.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAGtE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAOzD,qBAGa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAFV,kBAAkB,EAAE,kBAAkB,EACtC,aAAa,EAAE,aAAa,EAC5B,UAAU,EAAE,UAAU;IASnC,KAAK,CAAS,GAAG,EAAE,YAAY;IAW/B,IAAI,CAAS,GAAG,EAAE,aAAa;;;;;;;IAW/B,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAgBvC,OAAO,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAWxC,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;CAI9C"}

package/dist/admin/controllers/admin.api.key.controller.js

@@ -0,0 +1,119 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminApiKeyController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const sql_service_1 = require("../../common/services/sql.service");
+const api_key_service_1 = require("../../auth/services/api.key.service");
+const global_admin_roles_enum_1 = require("../../auth/enums/global.admin.roles.enum");
+const admin_access_service_1 = require("../services/admin.access.service");
+const common_params_dto_1 = require("../../common/dtos/common.params.dto");
+const api_key_data_processor_1 = require("../libraries/api.key.data.processor");
+const api_key_list_processor_1 = require("../libraries/api.key.list.processor");
+const add_api_key_dto_1 = require("../dtos/add.api.key.dto");
+const api_key_list_dto_1 = require("../dtos/api.key.list.dto");
+let AdminApiKeyController = class AdminApiKeyController {
+    constructor(adminAccessService, apiKeyService, sqlService) {
+        this.adminAccessService = adminAccessService;
+        this.apiKeyService = apiKeyService;
+        this.sqlService = sqlService;
+    }
+    async issue(dto) {
+        const { user } = await this.adminAccessService.validateAdmin();
+        return new api_key_data_processor_1.ApiKeyDataProcessor(user, this.apiKeyService).process(dto);
+    }
+    async list(dto) {
+        await this.adminAccessService.validateContentReader();
+        return new api_key_list_processor_1.ApiKeyListProcessor(this.sqlService).process(dto);
+    }
+    async detail({ id }) {
+        const access = await this.adminAccessService.validateContentReader();
+        const reveal = this.adminAccessService.holdsAtLeast(access, global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_ADMIN);
+        return this.apiKeyService.apiKeyDetail(id, reveal);
+    }
+    async disable({ id }) {
+        const { user } = await this.adminAccessService.validateAdmin();
+        return this.apiKeyService.disableApiKey(id, user.id);
+    }
+    async remove({ id }) {
+        const { user } = await this.adminAccessService.validateAdmin();
+        return this.apiKeyService.deleteApiKey(id, user.id);
+    }
+};
+exports.AdminApiKeyController = AdminApiKeyController;
+__decorate([
+    (0, common_1.Post)(),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Issue an API key for a tenant.',
+        description: 'Create-only — `raw_key` is the full key and is returned exactly once, since only its hash is stored. A key can only be granted scopes its tenant already holds. Requires at least the global admin role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [add_api_key_dto_1.AddApiKeyDto]),
+    __metadata("design:returntype", Promise)
+], AdminApiKeyController.prototype, "issue", null);
+__decorate([
+    (0, common_1.Post)('list'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'List, search and filter API keys.',
+        description: 'Rows carry `key_prefix` rather than the key itself, and `scopes` as the granted `{ id, identifier, name }` objects. Requires at least the global content reader role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [api_key_list_dto_1.ApiKeyListDto]),
+    __metadata("design:returntype", Promise)
+], AdminApiKeyController.prototype, "list", null);
+__decorate([
+    (0, common_1.Get)(':id'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'One API key, in full.',
+        description: 'Carries the owning tenant and the `scopes` granted to the key. Requires at least the global content reader role — but `key`, the decrypted raw key, is only included from the global admin role up: it is a live credential, and reading a record is not the same permission as holding it. A key issued before keys were stored recoverably has no `key` at all.',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:returntype", Promise)
+], AdminApiKeyController.prototype, "detail", null);
+__decorate([
+    (0, common_1.Post)(':id/disable'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Disable an API key.',
+        description: 'Turns the key off (`is_active` false) without destroying it: validation stops accepting it, while the row keeps its scopes and its history. Requires at least the global admin role.',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:returntype", Promise)
+], AdminApiKeyController.prototype, "disable", null);
+__decorate([
+    (0, common_1.Post)(':id/delete'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Delete an API key.',
+        description: 'Soft delete: the row keeps its data with `deleted_at` set and drops out of every listing. It is revoked in the same transaction, along with its scope grants — key validation matches on `is_active`/`revoked_at`, so a row that only left the listings would keep authenticating requests. Requires at least the global admin role.',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:returntype", Promise)
+], AdminApiKeyController.prototype, "remove", null);
+exports.AdminApiKeyController = AdminApiKeyController = __decorate([
+    (0, swagger_1.ApiTags)('Admin - API Keys'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('api/admin/api-keys'),
+    __metadata("design:paramtypes", [admin_access_service_1.AdminAccessService,
+        api_key_service_1.ApiKeyService,
+        sql_service_1.SqlService])
+], AdminApiKeyController);
+//# sourceMappingURL=admin.api.key.controller.js.map

package/dist/admin/controllers/admin.api.key.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.api.key.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.api.key.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoE;AACpE,6CAAuE;AACvE,mEAA+D;AAC/D,yEAAoE;AACpE,sFAA4E;AAC5E,2EAAsE;AACtE,2EAAsE;AACtE,gFAA0E;AAC1E,gFAA0E;AAC1E,6DAAuD;AACvD,+DAAyD;AAUlD,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YACmB,kBAAsC,EACtC,aAA4B,EAC5B,UAAsB;QAFtB,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,kBAAa,GAAb,aAAa,CAAe;QAC5B,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAQE,AAAN,KAAK,CAAC,KAAK,CAAS,GAAiB;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,4CAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IAQK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAkB;QACnC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,4CAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,YAAY,CACjD,MAAM,EACN,0CAAgB,CAAC,YAAY,CAC9B,CAAC;QAEF,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAQK,AAAN,KAAK,CAAC,OAAO,CAAU,EAAE,EAAE,EAAmB;QAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;CACF,CAAA;AAlEY,sDAAqB;AAa1B;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,0MAA0M;KAC7M,CAAC;IACW,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,8BAAY;;kDAGpC;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EACT,uKAAuK;KAC1K,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,gCAAa;;iDAGpC;AAQK;IANL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,mWAAmW;KACtW,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;mDAQ5C;AAQK;IANL,IAAA,aAAI,EAAC,aAAa,CAAC;IACnB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EACT,sLAAsL;KACzL,CAAC;IACa,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;oDAG7C;AAQK;IANL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,sUAAsU;KACzU,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;mDAG5C;gCAjEU,qBAAqB;IAHjC,IAAA,iBAAO,EAAC,kBAAkB,CAAC;IAC3B,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,oBAAoB,CAAC;qCAGQ,yCAAkB;QACvB,+BAAa;QAChB,wBAAU;GAJ9B,qBAAqB,CAkEjC"}

package/dist/admin/controllers/admin.scheduled.task.controller.d.ts

@@ -17,6 +17,6 @@ export declare class AdminScheduledTaskController {
         total_pages: number;
     }>;
     detail({ id }: CommonParamsDto): Promise<SystemScheduledTaskEntity>;
-    remove({ id }: CommonParamsDto): Promise<import("../types/admin.types").DeleteResult>;
+    remove({ id }: CommonParamsDto): Promise<import("../..").DeleteResult>;
 }
 //# sourceMappingURL=admin.scheduled.task.controller.d.ts.map

package/dist/admin/controllers/admin.scope.controller.d.ts

@@ -0,0 +1,24 @@
+import { SqlService } from '../../common/services/sql.service';
+import { AdminAccessService } from '../services/admin.access.service';
+import { CommonParamsDto } from '../../common/dtos/common.params.dto';
+import { ScopeService } from '../../auth/services/scope.service';
+import { AddScopeDto } from '../dtos/add.scope.dto';
+import { ScopeListDto } from '../dtos/scope.list.dto';
+import { ScopeEntity } from '../../auth/entities/scope.entity';
+export declare class AdminScopeController {
+    private readonly adminAccessService;
+    private readonly scopeService;
+    private readonly sqlService;
+    constructor(adminAccessService: AdminAccessService, scopeService: ScopeService, sqlService: SqlService);
+    save(dto: AddScopeDto): Promise<ScopeEntity>;
+    list(dto: ScopeListDto): Promise<{
+        records: import("../..").SqlRow[];
+        total: number;
+        page: number;
+        limit: number;
+        total_pages: number;
+    }>;
+    detail({ id }: CommonParamsDto): Promise<ScopeEntity>;
+    remove({ id }: CommonParamsDto): Promise<import("../..").DeleteResult>;
+}
+//# sourceMappingURL=admin.scope.controller.d.ts.map

package/dist/admin/controllers/admin.scope.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.scope.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.scope.controller.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAGjE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAQ/D,qBAGa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAFV,kBAAkB,EAAE,kBAAkB,EACtC,YAAY,EAAE,YAAY,EAC1B,UAAU,EAAE,UAAU;IASnC,IAAI,CAAS,GAAG,EAAE,WAAW;IAU7B,IAAI,CAAS,GAAG,EAAE,YAAY;;;;;;;IAU9B,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAevC,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;CAI9C"}

package/dist/admin/controllers/admin.scope.controller.js

@@ -0,0 +1,106 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminScopeController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const sql_service_1 = require("../../common/services/sql.service");
+const admin_access_service_1 = require("../services/admin.access.service");
+const common_params_dto_1 = require("../../common/dtos/common.params.dto");
+const scope_service_1 = require("../../auth/services/scope.service");
+const scope_data_processor_1 = require("../libraries/scope.data.processor");
+const scope_list_processor_1 = require("../libraries/scope.list.processor");
+const add_scope_dto_1 = require("../dtos/add.scope.dto");
+const scope_list_dto_1 = require("../dtos/scope.list.dto");
+const scope_entity_1 = require("../../auth/entities/scope.entity");
+let AdminScopeController = class AdminScopeController {
+    constructor(adminAccessService, scopeService, sqlService) {
+        this.adminAccessService = adminAccessService;
+        this.scopeService = scopeService;
+        this.sqlService = sqlService;
+    }
+    async save(dto) {
+        const { user } = await this.adminAccessService.validateContentManager();
+        return new scope_data_processor_1.ScopeDataProcessor(user).process(dto);
+    }
+    async list(dto) {
+        await this.adminAccessService.validateContentReader();
+        return new scope_list_processor_1.ScopeListProcessor(this.sqlService).process(dto);
+    }
+    async detail({ id }) {
+        await this.adminAccessService.validateContentReader();
+        const scope = await scope_entity_1.ScopeEntity.findOne({ where: { id } });
+        if (!scope)
+            throw new common_1.NotFoundException('No scope exists for this id');
+        return scope;
+    }
+    async remove({ id }) {
+        const { user } = await this.adminAccessService.validateContentManager();
+        return this.scopeService.deleteScope(id, user.id);
+    }
+};
+exports.AdminScopeController = AdminScopeController;
+__decorate([
+    (0, common_1.Post)(),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Define a scope, or update an existing one.',
+        description: 'Send an `id` to edit that scope; omit it to define a new one. `identifier` is what code checks and is unique across the catalogue. Requires at least the global content manager role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [add_scope_dto_1.AddScopeDto]),
+    __metadata("design:returntype", Promise)
+], AdminScopeController.prototype, "save", null);
+__decorate([
+    (0, common_1.Post)('list'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'List, search and filter scopes.',
+        description: 'Requires at least the global content reader role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [scope_list_dto_1.ScopeListDto]),
+    __metadata("design:returntype", Promise)
+], AdminScopeController.prototype, "list", null);
+__decorate([
+    (0, common_1.Get)(':id'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'One scope, in full.',
+        description: 'Requires at least the global content reader role.',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:returntype", Promise)
+], AdminScopeController.prototype, "detail", null);
+__decorate([
+    (0, common_1.Post)(':id/delete'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Delete a scope.',
+        description: 'Soft delete: the row keeps its data with `deleted_at` set and drops out of every listing. Every grant of it goes too — the tenant rows in `sys_tenant_scopes` and the API-key rows in `sys_api_scopes` — so no principal keeps a feature the catalogue no longer defines. Requires at least the global content manager role.',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:returntype", Promise)
+], AdminScopeController.prototype, "remove", null);
+exports.AdminScopeController = AdminScopeController = __decorate([
+    (0, swagger_1.ApiTags)('Admin - Scopes'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('api/admin/scopes'),
+    __metadata("design:paramtypes", [admin_access_service_1.AdminAccessService,
+        scope_service_1.ScopeService,
+        sql_service_1.SqlService])
+], AdminScopeController);
+//# sourceMappingURL=admin.scope.controller.js.map

package/dist/admin/controllers/admin.scope.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.scope.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.scope.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,6CAAuE;AACvE,mEAA+D;AAC/D,2EAAsE;AACtE,2EAAsE;AACtE,qEAAiE;AACjE,4EAAuE;AACvE,4EAAuE;AACvE,yDAAoD;AACpD,2DAAsD;AACtD,mEAA+D;AAWxD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YACmB,kBAAsC,EACtC,YAA0B,EAC1B,UAAsB;QAFtB,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,iBAAY,GAAZ,YAAY,CAAc;QAC1B,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CAAS,GAAgB;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC;QACxE,OAAO,IAAI,yCAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IAOK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAiB;QAClC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,yCAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;IAOK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QAEtD,MAAM,KAAK,GAAG,MAAM,0BAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;QAEvE,OAAO,KAAK,CAAC;IACf,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAA;AApDY,oDAAoB;AAazB;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,4CAA4C;QACrD,WAAW,EACT,uLAAuL;KAC1L,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,2BAAW;;gDAGlC;AAOK;IALL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,6BAAY;;gDAGnC;AAOK;IALL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;kDAO5C;AAQK;IANL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EACT,8TAA8T;KACjU,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;kDAG5C;+BAnDU,oBAAoB;IAHhC,IAAA,iBAAO,EAAC,gBAAgB,CAAC;IACzB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,kBAAkB,CAAC;qCAGU,yCAAkB;QACxB,4BAAY;QACd,wBAAU;GAJ9B,oBAAoB,CAoDhC"}

package/dist/admin/controllers/admin.tenant.controller.d.ts

@@ -3,15 +3,14 @@ import { AdminAccessService } from '../services/admin.access.service';
 import { CommonParamsDto } from '../../common/dtos/common.params.dto';
 import { AddTenantDto } from '../dtos/add.tenant.dto';
 import { TenantListDto } from '../dtos/tenant.list.dto';
-import { EmailNotificationService } from '../../notification/services/email.notification.service';
-import { SystemPropertyService } from '../../common/services/system.property.service';
+import { TenantOnboardedMailJob } from '../../notification/jobs/tenant.onboarded.mail.job';
 import { TenantEntity } from '../../tenant/entities/tenant.entity';
+import { TenantDetail } from '../types/admin.types';
 export declare class AdminTenantController {
     private readonly adminAccessService;
     private readonly sqlService;
-    private readonly emailNotificationService;
-    private readonly systemPropertyService;
-    constructor(adminAccessService: AdminAccessService, sqlService: SqlService, emailNotificationService: EmailNotificationService, systemPropertyService: SystemPropertyService);
+    private readonly tenantOnboardedMailJob;
+    constructor(adminAccessService: AdminAccessService, sqlService: SqlService, tenantOnboardedMailJob: TenantOnboardedMailJob);
     onboard(dto: AddTenantDto): Promise<TenantEntity>;
     list(dto: TenantListDto): Promise<{
         records: import("../..").SqlRow[];
@@ -20,7 +19,7 @@ export declare class AdminTenantController {
         limit: number;
         total_pages: number;
     }>;
-    detail({ id }: CommonParamsDto): Promise<TenantEntity>;
+    detail({ id }: CommonParamsDto): Promise<TenantDetail>;
     remove({ id }: CommonParamsDto): Promise<import("../types/admin.types").DeleteResult>;
 }
 //# sourceMappingURL=admin.tenant.controller.d.ts.map

package/dist/admin/controllers/admin.tenant.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.tenant.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.tenant.controller.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAItE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAClG,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,qBAGa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IACzC,OAAO,CAAC,QAAQ,CAAC,qBAAqB;gBAHrB,kBAAkB,EAAE,kBAAkB,EACtC,UAAU,EAAE,UAAU,EACtB,wBAAwB,EAAE,wBAAwB,EAClD,qBAAqB,EAAE,qBAAqB;IASzD,OAAO,CAAS,GAAG,EAAE,YAAY;IAejC,IAAI,CAAS,GAAG,EAAE,aAAa;;;;;;;IAW/B,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAevC,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;CAI9C"}
+{"version":3,"file":"admin.tenant.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.tenant.controller.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAItE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,mDAAmD,CAAC;AAC3F,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAEnE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,qBAGa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,sBAAsB;gBAFtB,kBAAkB,EAAE,kBAAkB,EACtC,UAAU,EAAE,UAAU,EACtB,sBAAsB,EAAE,sBAAsB;IAS3D,OAAO,CAAS,GAAG,EAAE,YAAY;IAajC,IAAI,CAAS,GAAG,EAAE,aAAa;;;;;;;IAW/B,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;IA2B/D,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;CAI9C"}

package/dist/admin/controllers/admin.tenant.controller.js

@@ -23,19 +23,18 @@ const tenant_delete_processor_1 = require("../libraries/tenant.delete.processor"
 const tenant_list_processor_1 = require("../libraries/tenant.list.processor");
 const add_tenant_dto_1 = require("../dtos/add.tenant.dto");
 const tenant_list_dto_1 = require("../dtos/tenant.list.dto");
-const email_notification_service_1 = require("../../notification/services/email.notification.service");
-const system_property_service_1 = require("../../common/services/system.property.service");
+const tenant_onboarded_mail_job_1 = require("../../notification/jobs/tenant.onboarded.mail.job");
 const tenant_entity_1 = require("../../tenant/entities/tenant.entity");
+const tenant_scope_entity_1 = require("../../auth/entities/tenant.scope.entity");
 let AdminTenantController = class AdminTenantController {
-    constructor(adminAccessService, sqlService, emailNotificationService, systemPropertyService) {
+    constructor(adminAccessService, sqlService, tenantOnboardedMailJob) {
         this.adminAccessService = adminAccessService;
         this.sqlService = sqlService;
-        this.emailNotificationService = emailNotificationService;
-        this.systemPropertyService = systemPropertyService;
+        this.tenantOnboardedMailJob = tenantOnboardedMailJob;
     }
     async onboard(dto) {
         const { user } = await this.adminAccessService.validateSuperAdmin();
-        return new tenant_data_processor_1.TenantDataProcessor(user, this.emailNotificationService, this.systemPropertyService).process(dto);
+        return new tenant_data_processor_1.TenantDataProcessor(user, this.tenantOnboardedMailJob).process(dto);
     }
     async list(dto) {
         await this.adminAccessService.validateContentReader();
@@ -46,7 +45,15 @@ let AdminTenantController = class AdminTenantController {
         const tenant = await tenant_entity_1.TenantEntity.findOne({ where: { id } });
         if (!tenant)
             throw new common_1.NotFoundException('No tenant exists for this id');
-        return tenant;
+        const tenantScopes = await tenant_scope_entity_1.TenantScopeEntity.find({
+            where: { tenant_id: id },
+            relations: { scope: true },
+        });
+        return Object.assign(tenant, {
+            scopes: tenantScopes
+                .map((tenantScope) => tenantScope.scope)
+                .filter((scope) => !!scope),
+        });
     }
     async remove({ id }) {
         const { user } = await this.adminAccessService.validateSuperAdmin();
@@ -58,7 +65,7 @@ __decorate([
     (0, common_1.Post)(),
     (0, swagger_1.ApiOperation)({
         summary: 'Onboard a new client tenant, or update an existing one.',
-        description: 'Send an `id` to edit that tenant; omit it to onboard a new one. Omitted optional fields keep their stored value. An edit never re-runs onboarding — `onboarded_at`, `created_by` and the welcome email belong to first registration. Requires the global super admin role.',
+        description: "Send an `id` to edit that tenant; omit it to onboard a new one. Omitted optional fields keep their stored value, except `scope_ids` — that list replaces the tenant's scope grants, so an omitted one revokes them all. An edit never re-runs onboarding — `onboarded_at`, `created_by` and the welcome email belong to first registration. Requires the global super admin role.",
     }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
@@ -80,7 +87,7 @@ __decorate([
     (0, common_1.Get)(':id'),
     (0, swagger_1.ApiOperation)({
         summary: 'One tenant, in full.',
-        description: 'Everything the listing leaves out — address, attributes and the onboarding trail. Requires at least the global reader role.',
+        description: 'Everything the listing leaves out — address, attributes, the onboarding trail and the `scopes` enabled for the tenant. Requires at least the global reader role.',
     }),
     __param(0, (0, common_1.Param)()),
     __metadata("design:type", Function),
@@ -104,7 +111,6 @@ exports.AdminTenantController = AdminTenantController = __decorate([
     (0, common_1.Controller)('api/admin/tenants'),
     __metadata("design:paramtypes", [admin_access_service_1.AdminAccessService,
         sql_service_1.SqlService,
-        email_notification_service_1.EmailNotificationService,
-        system_property_service_1.SystemPropertyService])
+        tenant_onboarded_mail_job_1.TenantOnboardedMailJob])
 ], AdminTenantController);
 //# sourceMappingURL=admin.tenant.controller.js.map

package/dist/admin/controllers/admin.tenant.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.tenant.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.tenant.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,6CAAuE;AACvE,mEAA+D;AAC/D,2EAAsE;AACtE,2EAAsE;AACtE,8EAAyE;AACzE,kFAA6E;AAC7E,8EAAyE;AACzE,2DAAsD;AACtD,6DAAwD;AACxD,uGAAkG;AAClG,2FAAsF;AACtF,uEAAmE;AAK5D,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YACmB,kBAAsC,EACtC,UAAsB,EACtB,wBAAkD,EAClD,qBAA4C;QAH5C,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,eAAU,GAAV,UAAU,CAAY;QACtB,6BAAwB,GAAxB,wBAAwB,CAA0B;QAClD,0BAAqB,GAArB,qBAAqB,CAAuB;IAC5D,CAAC;IAQE,AAAN,KAAK,CAAC,OAAO,CAAS,GAAiB;QACrC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QAEpE,OAAO,IAAI,2CAAmB,CAC5B,IAAI,EACJ,IAAI,CAAC,wBAAwB,EAC7B,IAAI,CAAC,qBAAqB,CAC3B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAOK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAkB;QACnC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,2CAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QAEtD,MAAM,MAAM,GAAG,MAAM,4BAAY,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,0BAAiB,CAAC,8BAA8B,CAAC,CAAC;QAEzE,OAAO,MAAM,CAAC;IAChB,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QACpE,OAAO,IAAI,+CAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;CACF,CAAA;AA3DY,sDAAqB;AAc1B;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,4QAA4Q;KAC/Q,CAAC;IACa,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,6BAAY;;oDAQtC;AAOK;IALL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,+BAAa;;iDAGpC;AAQK;IANL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EACT,6HAA6H;KAChI,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;mDAO5C;AAQK;IANL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EACT,yTAAyT;KAC5T,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;mDAG5C;gCA1DU,qBAAqB;IAHjC,IAAA,iBAAO,EAAC,iBAAiB,CAAC;IAC1B,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,mBAAmB,CAAC;qCAGS,yCAAkB;QAC1B,wBAAU;QACI,qDAAwB;QAC3B,+CAAqB;GALpD,qBAAqB,CA2DjC"}
+{"version":3,"file":"admin.tenant.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.tenant.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,6CAAuE;AACvE,mEAA+D;AAC/D,2EAAsE;AACtE,2EAAsE;AACtE,8EAAyE;AACzE,kFAA6E;AAC7E,8EAAyE;AACzE,2DAAsD;AACtD,6DAAwD;AACxD,iGAA2F;AAC3F,uEAAmE;AACnE,iFAA4E;AAMrE,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YACmB,kBAAsC,EACtC,UAAsB,EACtB,sBAA8C;QAF9C,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,eAAU,GAAV,UAAU,CAAY;QACtB,2BAAsB,GAAtB,sBAAsB,CAAwB;IAC9D,CAAC;IAQE,AAAN,KAAK,CAAC,OAAO,CAAS,GAAiB;QACrC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QAEpE,OAAO,IAAI,2CAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,OAAO,CACvE,GAAG,CACJ,CAAC;IACJ,CAAC;IAOK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAkB;QACnC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,2CAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/D,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QAEtD,MAAM,MAAM,GAAG,MAAM,4BAAY,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,0BAAiB,CAAC,8BAA8B,CAAC,CAAC;QAKzE,MAAM,YAAY,GAAG,MAAM,uCAAiB,CAAC,IAAI,CAAC;YAChD,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;YACxB,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;SAC3B,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE;YAC3B,MAAM,EAAE,YAAY;iBACjB,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC;iBACvC,MAAM,CAAC,CAAC,KAAK,EAAsC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QACpE,OAAO,IAAI,+CAAqB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC;CACF,CAAA;AApEY,sDAAqB;AAa1B;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,mXAAmX;KACtX,CAAC;IACa,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,6BAAY;;oDAMtC;AAOK;IALL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,+BAAa;;iDAGpC;AAQK;IANL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EACT,kKAAkK;KACrK,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;mDAmB5C;AAQK;IANL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EACT,yTAAyT;KAC5T,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;mDAG5C;gCAnEU,qBAAqB;IAHjC,IAAA,iBAAO,EAAC,iBAAiB,CAAC;IAC1B,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,mBAAmB,CAAC;qCAGS,yCAAkB;QAC1B,wBAAU;QACE,kDAAsB;GAJtD,qBAAqB,CAoEjC"}

package/dist/admin/controllers/admin.tenant.user.controller.d.ts

@@ -5,16 +5,14 @@ import { AddClientUserDto } from '../dtos/add.client.user.dto';
 import { ClientUserListDto } from '../dtos/client.user.list.dto';
 import { AdminAccessService } from '../services/admin.access.service';
 import { TenantService } from '../../tenant/services/tenant.service';
-import { EmailNotificationService } from '../../notification/services/email.notification.service';
-import { SystemPropertyService } from '../../common/services/system.property.service';
+import { TenantUserOnboardedMailJob } from '../../notification/jobs/tenant.user.onboarded.mail.job';
 import { SqlService } from '../../common/services/sql.service';
 export declare class AdminTenantUserController {
     protected readonly adminAccessService: AdminAccessService;
     protected readonly tenantService: TenantService;
-    protected readonly emailNotificationService: EmailNotificationService;
-    protected readonly systemPropertyService: SystemPropertyService;
+    protected readonly tenantUserOnboardedMailJob: TenantUserOnboardedMailJob;
     protected readonly sqlService: SqlService;
-    constructor(adminAccessService: AdminAccessService, tenantService: TenantService, emailNotificationService: EmailNotificationService, systemPropertyService: SystemPropertyService, sqlService: SqlService);
+    constructor(adminAccessService: AdminAccessService, tenantService: TenantService, tenantUserOnboardedMailJob: TenantUserOnboardedMailJob, sqlService: SqlService);
     clientUserDetail({ id }: CommonParamsDto): Promise<UserEntity>;
     addClientUser(dto: AddClientUserDto): Promise<UserEntity>;
     addClientUsersBulk(dto: AddBulkUsersDto): Promise<import("../types/admin.types").BulkUserResult>;
@@ -25,6 +23,6 @@ export declare class AdminTenantUserController {
         limit: number;
         total_pages: number;
     }>;
-    removeClientUser(id: string): Promise<import("../types/admin.types").DeleteResult>;
+    removeClientUser(id: string): Promise<import("../..").DeleteResult>;
 }
 //# sourceMappingURL=admin.tenant.user.controller.d.ts.map

package/dist/admin/controllers/admin.tenant.user.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.tenant.user.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.tenant.user.controller.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAKjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wDAAwD,CAAC;AAClG,OAAO,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AACtF,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAE/D,qBACa,yBAAyB;IAElC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB;IACzD,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa;IAC/C,SAAS,CAAC,QAAQ,CAAC,wBAAwB,EAAE,wBAAwB;IACrE,SAAS,CAAC,QAAQ,CAAC,qBAAqB,EAAE,qBAAqB;IAC/D,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU;gBAJtB,kBAAkB,EAAE,kBAAkB,EACtC,aAAa,EAAE,aAAa,EAC5B,wBAAwB,EAAE,wBAAwB,EAClD,qBAAqB,EAAE,qBAAqB,EAC5C,UAAU,EAAE,UAAU;IASrC,gBAAgB,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAiBjD,aAAa,CAAS,GAAG,EAAE,gBAAgB;IAc3C,kBAAkB,CAAS,GAAG,EAAE,eAAe;IAW/C,eAAe,CAAS,GAAG,EAAE,iBAAiB;;;;;;;IAW9C,gBAAgB,CAA6B,EAAE,EAAE,MAAM;CAI9D"}
+{"version":3,"file":"admin.tenant.user.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.tenant.user.controller.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAKjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAE/D,qBACa,yBAAyB;IAElC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB;IACzD,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa;IAC/C,SAAS,CAAC,QAAQ,CAAC,0BAA0B,EAAE,0BAA0B;IACzE,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU;gBAHtB,kBAAkB,EAAE,kBAAkB,EACtC,aAAa,EAAE,aAAa,EAC5B,0BAA0B,EAAE,0BAA0B,EACtD,UAAU,EAAE,UAAU;IASrC,gBAAgB,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAiBjD,aAAa,CAAS,GAAG,EAAE,gBAAgB;IAa3C,kBAAkB,CAAS,GAAG,EAAE,eAAe;IAW/C,eAAe,CAAS,GAAG,EAAE,iBAAiB;;;;;;;IAW9C,gBAAgB,CAA6B,EAAE,EAAE,MAAM;CAI9D"}