@neohm/nestend 3.3.1 → 3.3.3

package/README.md

@@ -91,7 +91,8 @@ the notification and document modules.
 
 Internal by design: the controllers, DTOs and processors behind the built-in endpoints
 (the whole `admin` module beyond `AdminModule` itself, `AuthController`,
-`AdminAuthController`), the passport strategies, `JobConsumer` and the framework
+`AdminAuthController`, `ImpersonationController` and `ImpersonationService`), the
+passport strategies, `JobConsumer` and the framework
 jobs/subscribers/schedule resolvers, the `FILTER_OPERATORS` registry, the internal
 `*Default` enums, and the migration classes. Import the module and call the endpoints —
 these are free to change without a breaking release.
@@ -104,12 +105,12 @@ these are free to change without a breaking release.
 | Migrations        | `MigrationUtility`, `SeederUtility` (the 26 table migrations ship in `dist/migrations` — glob them, they are not barrel exports)     | fluent `this.string()`, `this.numeric()`, `addRecord()` seeding                                                                                                                                                                                                           |
 | Queue             | `QueueModule`, `QueueService`, `CommonJob`                                                                                           | BullMQ `@Processor`/`WorkerHost` consumer; auto-discovered jobs, duplicate prevention, recurring schedulers, 1-day TTL, retries, failures persisted to `sys_failed_jobs`                                                                                                  |
 | Scheduled events  | `SystemScheduledTaskEntity`, `ScheduledEventEntity`, `ScheduleKind`, `ScheduleSpec`, `IsCronExpression`                              | schedule definitions in `sys_scheduled_tasks` → events in `sys_scheduled_events`; interval / cron / once specs with timezones, drift-free slots, horizon materialisation, catch-up + overlap policies, fire-once dispatch with backoff, cadence via `SCHEDULED_EVENT_MIN` |
-| Auth              | `AuthModule`, `AuthService.validateRole()`, `Auth`, `JwtMiddleware`                                                                  | imperative auth (open by default); JwtMiddleware resolves the user into `Auth`'s AsyncLocalStorage context per request; access + rotating refresh tokens; session-based logout invalidation (`sys_auth_sessions`); Google SSO via ID token at `POST /auth/google`         |
+| Auth              | `AuthModule`, `AuthService.validateRole()`, `Auth`, `JwtMiddleware`                                                                  | imperative auth (open by default); JwtMiddleware resolves the user into `Auth`'s AsyncLocalStorage context per request; access + rotating refresh tokens; session-based logout invalidation (`sys_auth_sessions`); Google SSO via ID token at `POST /auth/google`; impersonation — a tenantless `has_global_access` user signs into one organization at `POST /auth/impersonation/login`         |
 | Admin auth        | `AdminAuthService.validateRole()`, `AdminAuth`, `AdminJwtMiddleware` (endpoints at `/admin/auth`)                                    | fully separate stack for back-office admins — own users table (`sys_admin_users`), own roles (`sys_admin_roles`/`sys_auser_roles`), own sessions/refresh tokens (shared tables, `is_admin` flag)                                                                          |
 | API keys          | `ApiKeyService`, `ApiKeyGuard` / `ApiKeyMiddleware`, `@ApiKeyScopes()`, `ApiKeyContext`                                               | hashed keys in `sys_api_keys` (admin-owned), one tenant per key, expiry/revocation, `x-api-key` header; `validateAccess(scope)` returns the tenant the key acts for                                                                                                        |
 | Scopes            | `ScopeService`, `AuthService.validateAccess()`, `ScopeEntity`, `TenantScopeEntity`, `ApiScopeEntity`                                  | one feature named once in `sys_scopes`, then granted per organization (`sys_tenant_scopes`) or per API key (`sys_api_scopes`) — never an array on the principal                                                                                                            |
 | Multi-tenancy     | `TenantModule`, `TenantEntity`, `CommonTenantEntity`, `TenantContextService`, `TenantContextMiddleware`                              | AsyncLocalStorage tenant context; resolve by header, slug, or domain; tenants are onboarded by admins (`TenantEntity.creator` → `AdminUserEntity`)                                                                                                                        |
-| Admin             | `AdminModule` (its controllers, DTOs and processors are internal — import the module and hit the endpoints), `GlobalAdminRoles`      | back-office APIs: tenant onboarding, client/admin user registration (single + bulk, no role granting), tenant + scheduled-task listing; 4-tier `GlobalAdminRoles` gate over `sys_admin_roles`; Swagger at `/docs` (hidden in production)                                  |
+| Admin             | `AdminModule` (its controllers, DTOs and processors are internal — import the module and hit the endpoints), `GlobalAdminRoles`      | back-office APIs: tenant onboarding, client/admin/system user registration (single + bulk), the `has_global_access` grant that enables impersonation, tenant + scheduled-task listing; 4-tier `GlobalAdminRoles` gate over `sys_admin_roles`; Swagger at `/docs` (hidden in production)                                  |
 | Notifications     | `NotificationModule`, `NotificationService`, `FcmPushNotificationService`                                                            | in-app rows + FCM push (optional `firebase-admin`); device token registry                                                                                                                                                                                                 |
 | Email (SES)       | `EmailNotificationService`, `ProcessEmailNotification`, `EmailTemplateEntity`, `EmailNotificationLogEntity`                          | templates in `sys_email_templates` rendered by a remote service, dispatched via SES per recipient (to/cc/bcc); logged to `sys_email_notification_logs` outside production; dispatch skipped when `AWS_SES_FROM_ADDRESS` unset                                             |
 | Audit             | `AuditService`                                                                                                                       | `saveAuditLog(old, new)` with changed-value diffing into `sys_audit_logs`                                                                                                                                                                                                 |
@@ -118,6 +119,7 @@ these are free to change without a breaking release.
 | Encryption        | `EncryptionService`                                                                                                                  | AES-256-GCM, scrypt-derived keys                                                                                                                                                                                                                                          |
 | System properties | `SystemPropertyModule`, `SystemPropertyService`                                                                                      | cached + optionally encrypted key/value settings in `sys_properties`                                                                                                                                                                                                      |
 | Documents         | `DocumentModule`, `DocumentService`, `S3BucketDocumentService`, `MinioBucketDocumentService`                                         | `uploadDocument(multerFiles) → links[]`; driver chosen via `DOCUMENT_STORAGE_DRIVER`                                                                                                                                                                                      |
+| PDF generation    | `PdfService`, `PdfRenderOptions`                                                                                                     | `renderHtmlToPdf(html) → Buffer` via headless Chromium; honours the document's own `@page` rules and paginates to any length; optional peer dep `puppeteer`                                                                                                               |
 | HTTP              | `CommonController`, `GlobalExceptionFilter`, common DTOs                                                                             | health endpoint base controller, uniform error envelope                                                                                                                                                                                                                   |
 | Raw SQL           | `SqlService`, `SqlTarget`                                                                                                            | named `:key` placeholders always bound as driver params, `:...key` array expansion; runs on the read replica (`DB_READ_*`) with transparent primary fallback; `fetchOne`/`fetchScalar`/`exists`/`count`/`paginate` helpers                                                |
 | List endpoints    | `CommonListProcessor`, `CommonListFilterDto`, `FilterDto`, `CommonListFilterConfig`                                                  | allowlisted columns, parameterised operators (`eq`…`isNull`), typed value casting (`str`/`num`/`date`/`bool`/`null`), multi-sort + paginated on the read replica                                                                                                          |
@@ -206,6 +208,25 @@ and embeds its identifier in the access token as `sid`; `logout()` revokes the
 refresh token and invalidates that session, so a still-unexpired access token
 stops working immediately.
 
+**Impersonation** — support staff work inside a customer's organization without
+borrowing anyone's identity. The principal is a `sys_users` row with
+`user_type = system.user`, no `tenant_id` and `has_global_access = true`; it
+cannot use `POST /auth/login` at all, and signs in through `POST
+/auth/impersonation/login` with `{ email, password, tenant_id }`. The assumed
+organization is stored on the session row (and its refresh-token row, so a
+rotation keeps it) and stamped onto the context user's `tenant_id` by
+`JwtMiddleware`, so `validateAccess()` and every processor reading
+`user.tenant_id` work unchanged. Because the token belongs to the real actor,
+`created_by` records who actually did the work. Role assertions yield to the
+grant — the account holds no roles inside the tenant — but scope checks never
+do, so impersonation cannot reach a feature the organization was not sold.
+`GET /auth/impersonation/tenants` lists the organizations available (also from an
+impersonated session, for an in-app switcher), each login writes an
+`AuditAction.IMPERSONATE` entry, and withdrawing the flag through
+`POST /admin/system-users` revokes the sessions it opened. Distinguish an assumed
+tenant from real membership with `Auth.isImpersonating()` /
+`Auth.impersonatedTenant()`.
+
 **Google SSO** — the client posts a Google ID token as `{ id_token }` to
 `POST /auth/google`. `GoogleAuthService` verifies it against Google's tokeninfo
 endpoint (audience must match `GOOGLE_CLIENT_ID`, issuer `accounts.google.com`,
@@ -543,6 +564,16 @@ a subscriber only starts firing once something constructs it.
 | `MINIO_BUCKET`     | `documents`  | Bucket name (auto-created if missing)       |
 | `MINIO_PUBLIC_URL` | _(empty)_    | CDN base URL when MinIO sits behind a proxy |
 
+### PDF Generation
+
+Requires the optional peer dependency `puppeteer`.
+
+| Variable                  | Default   | Description                                                                        |
+| ------------------------- | --------- | ---------------------------------------------------------------------------------- |
+| `PDF_CHROMIUM_PATH`       | _(empty)_ | Path to an existing Chromium/Chrome binary; falls back to puppeteer's bundled one   |
+| `PDF_CHROMIUM_NO_SANDBOX` | `false`   | `true` passes `--no-sandbox`. Needed in most containers; only use with trusted HTML |
+| `PDF_RENDER_TIMEOUT_MS`   | `30000`   | Per-render page load timeout in milliseconds                                        |
+
 ### HTTP Logging
 
 | Variable          | Default | Description                                                                 |
@@ -637,6 +668,72 @@ async upload(@UploadedFiles() files: Express.Multer.File[], @CurrentUser() user:
 Set `DOCUMENT_STORAGE_DRIVER=minio` for a local MinIO bucket (auto-created) or
 `DOCUMENT_STORAGE_DRIVER=s3` for Amazon S3. Switching drivers requires no code change.
 
+## PDF Generation (PdfService)
+
+`PdfService` (exported by `DocumentModule`) turns an HTML document into PDF
+bytes using a headless Chromium.
+
+It is the backend half of the document rendering service: that service serves
+print-ready, A4-locked HTML at `POST /pdfs/<version>/<path>/<template>`, and
+this service rasterizes it. The split keeps the template service free of a
+browser binary and puts the PDF bytes next to the storage and delivery code
+that needs them.
+
+```ts
+// 1. Fetch the rendered document from the template service.
+const html = await this.remoteRequestService.getApiResponse<string>({
+  url: `${templateBaseUrl}/pdfs/v1/business/summary-report`,
+  requestType: ApiRequestTypeEnum.POST,
+  contentType: ApiContentTypeEnum.APPLICATION_JSON,
+  headers: { 'x-client-key': clientKey },
+  body: reportPayload,
+});
+
+// 2. Rasterize it.
+const pdf: Buffer = await this.pdfService.renderHtmlToPdf(html);
+
+// …or go straight to bucket storage.
+const file = await this.pdfService.renderHtmlToUploadableFile(html, 'summary-report.pdf');
+const [link] = await this.documentService.uploadDocument([file], {
+  pathPrefix: 'reports',
+});
+```
+
+**Install puppeteer.** It is an *optional* peer dependency — nothing imports it
+until a PDF is actually requested, so apps that never generate one skip the
+~170MB Chromium download entirely:
+
+```bash
+yarn add puppeteer
+```
+
+`PdfService.isAvailable()` reports whether it is installed.
+
+### Behaviour worth knowing
+
+- **The template owns the page setup.** `preferCssPageSize` defaults to `true`,
+  so an `@page { size: A4; margin: … }` rule in the HTML wins over the `format`
+  option. Page *count* is never specified by anyone — Chromium paginates and
+  emits as many pages as the content needs, which is what lets an A4-width
+  template grow to any length.
+- **Print media is emulated**, so `@media screen` blocks (the sheet shadow a
+  template uses for browser previews) are correctly ignored.
+- **Backgrounds are kept** (`printBackground` defaults to `true`), since
+  Chromium otherwise drops the themed fills and borders when printing.
+- **One browser, many renders.** Chromium costs hundreds of milliseconds to
+  start, so a single instance is launched lazily and reused for the process
+  lifetime; each render gets its own page and closes it. A browser that dies is
+  detected and relaunched on the next call, and the whole thing is torn down
+  with the module.
+
+### Configuration
+
+| Variable                  | Default   | Description                                                                          |
+| ------------------------- | --------- | ------------------------------------------------------------------------------------ |
+| `PDF_CHROMIUM_PATH`       | _(empty)_ | Path to an existing Chromium/Chrome binary; falls back to puppeteer's bundled one     |
+| `PDF_CHROMIUM_NO_SANDBOX` | `false`   | `true` passes `--no-sandbox`. Needed in most containers; only use with trusted HTML   |
+| `PDF_RENDER_TIMEOUT_MS`   | `30000`   | Per-render page load timeout                                                          |
+
 ## Raw SQL (SqlService)
 
 `SqlService` (global via `CommonModule`) runs raw SQL with named `:key`

package/dist/admin/controllers/admin.system.user.controller.d.ts

@@ -0,0 +1,24 @@
+import { UserEntity } from '../../auth/entities/user.entity';
+import { CommonParamsDto } from '../../common/dtos/common.params.dto';
+import { SqlService } from '../../common/services/sql.service';
+import { AddSystemUserDto } from '../dtos/add.system.user.dto';
+import { SystemUserListDto } from '../dtos/system.user.list.dto';
+import { AdminAccessService } from '../services/admin.access.service';
+import { SystemUserService } from '../services/system.user.service';
+export declare class AdminSystemUserController {
+    protected readonly adminAccessService: AdminAccessService;
+    protected readonly systemUserService: SystemUserService;
+    protected readonly sqlService: SqlService;
+    constructor(adminAccessService: AdminAccessService, systemUserService: SystemUserService, sqlService: SqlService);
+    systemUserDetail({ id }: CommonParamsDto): Promise<UserEntity>;
+    addSystemUser(dto: AddSystemUserDto): Promise<UserEntity>;
+    listSystemUsers(dto: SystemUserListDto): Promise<{
+        records: import("../..").SqlRow[];
+        total: number;
+        page: number;
+        limit: number;
+        total_pages: number;
+    }>;
+    removeSystemUser(id: string): Promise<import("../..").DeleteResult>;
+}
+//# sourceMappingURL=admin.system.user.controller.d.ts.map

package/dist/admin/controllers/admin.system.user.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.system.user.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.system.user.controller.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAGjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,qBACa,yBAAyB;IAElC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB;IACzD,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB;IACvD,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU;gBAFtB,kBAAkB,EAAE,kBAAkB,EACtC,iBAAiB,EAAE,iBAAiB,EACpC,UAAU,EAAE,UAAU;IAQrC,gBAAgB,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAiBjD,aAAa,CAAS,GAAG,EAAE,gBAAgB;IAW3C,eAAe,CAAS,GAAG,EAAE,iBAAiB;;;;;;;IAW9C,gBAAgB,CAA6B,EAAE,EAAE,MAAM;CAI9D"}

package/dist/admin/controllers/admin.system.user.controller.js

@@ -0,0 +1,107 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminSystemUserController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const user_entity_1 = require("../../auth/entities/user.entity");
+const user_type_enum_1 = require("../../auth/enums/user.type.enum");
+const common_params_dto_1 = require("../../common/dtos/common.params.dto");
+const sql_service_1 = require("../../common/services/sql.service");
+const add_system_user_dto_1 = require("../dtos/add.system.user.dto");
+const system_user_list_dto_1 = require("../dtos/system.user.list.dto");
+const system_user_data_processor_1 = require("../libraries/system.user.data.processor");
+const system_user_list_processor_1 = require("../libraries/system.user.list.processor");
+const admin_access_service_1 = require("../services/admin.access.service");
+const system_user_service_1 = require("../services/system.user.service");
+let AdminSystemUserController = class AdminSystemUserController {
+    constructor(adminAccessService, systemUserService, sqlService) {
+        this.adminAccessService = adminAccessService;
+        this.systemUserService = systemUserService;
+        this.sqlService = sqlService;
+    }
+    async systemUserDetail({ id }) {
+        await this.adminAccessService.validateContentReader();
+        const user = await user_entity_1.UserEntity.findOne({
+            where: { id, user_type: user_type_enum_1.UserType.SYSTEM_USER },
+        });
+        if (!user)
+            throw new common_1.NotFoundException('No system user exists for this id');
+        return user;
+    }
+    async addSystemUser(dto) {
+        await this.adminAccessService.validateSuperAdmin();
+        return new system_user_data_processor_1.SystemUserDataProcessor().process(dto);
+    }
+    async listSystemUsers(dto) {
+        await this.adminAccessService.validateContentReader();
+        return new system_user_list_processor_1.SystemUserListProcessor(this.sqlService).process(dto);
+    }
+    async removeSystemUser(id) {
+        const { user } = await this.adminAccessService.validateSuperAdmin();
+        return this.systemUserService.delete(id, user);
+    }
+};
+exports.AdminSystemUserController = AdminSystemUserController;
+__decorate([
+    (0, common_1.Get)(':id'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'One tenantless system user, in full.',
+        description: 'Requires at least the global content reader role.',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:returntype", Promise)
+], AdminSystemUserController.prototype, "systemUserDetail", null);
+__decorate([
+    (0, common_1.Post)(),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Register a tenantless system user, or update one.',
+        description: 'Send an `id` to edit that user; omit it to register a new one. `password` is required only when creating. `has_global_access` is what lets the account sign in to an organization through `POST /auth/impersonation/login`; withdrawing it revokes the sessions it opened. Requires the global super admin role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [add_system_user_dto_1.AddSystemUserDto]),
+    __metadata("design:returntype", Promise)
+], AdminSystemUserController.prototype, "addSystemUser", null);
+__decorate([
+    (0, common_1.Post)('list'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'List, search and filter tenantless system users.',
+        description: 'Scoped to system users, so a request cannot reach client users through it. Requires at least the global content reader role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [system_user_list_dto_1.SystemUserListDto]),
+    __metadata("design:returntype", Promise)
+], AdminSystemUserController.prototype, "listSystemUsers", null);
+__decorate([
+    (0, common_1.Post)(':id/delete'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Delete a system user.',
+        description: "Soft delete, with the user's sessions and refresh tokens revoked in the same transaction. Requires the global super admin role.",
+    }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], AdminSystemUserController.prototype, "removeSystemUser", null);
+exports.AdminSystemUserController = AdminSystemUserController = __decorate([
+    (0, common_1.Controller)('api/admin/system-users'),
+    __metadata("design:paramtypes", [admin_access_service_1.AdminAccessService,
+        system_user_service_1.SystemUserService,
+        sql_service_1.SqlService])
+], AdminSystemUserController);
+//# sourceMappingURL=admin.system.user.controller.js.map

package/dist/admin/controllers/admin.system.user.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.system.user.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.system.user.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,6CAA+C;AAC/C,iEAA6D;AAC7D,oEAA2D;AAC3D,2EAAsE;AACtE,mEAA+D;AAC/D,qEAA+D;AAC/D,uEAAiE;AACjE,wFAAkF;AAClF,wFAAkF;AAClF,2EAAsE;AACtE,yEAAoE;AAG7D,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACpC,YACqB,kBAAsC,EACtC,iBAAoC,EACpC,UAAsB;QAFtB,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,eAAU,GAAV,UAAU,CAAY;IACxC,CAAC;IAOE,AAAN,KAAK,CAAC,gBAAgB,CAAU,EAAE,EAAE,EAAmB;QACrD,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,wBAAU,CAAC,OAAO,CAAC;YACpC,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,yBAAQ,CAAC,WAAW,EAAE;SAC/C,CAAC,CAAC;QACH,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,mCAAmC,CAAC,CAAC;QAE5E,OAAO,IAAI,CAAC;IACd,CAAC;IAQK,AAAN,KAAK,CAAC,aAAa,CAAS,GAAqB;QAC/C,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QACnD,OAAO,IAAI,oDAAuB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpD,CAAC;IAQK,AAAN,KAAK,CAAC,eAAe,CAAS,GAAsB;QAClD,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,oDAAuB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;IAQK,AAAN,KAAK,CAAC,gBAAgB,CAA6B,EAAU;QAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;CACF,CAAA;AAvDY,8DAAyB;AAY9B;IALL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,sCAAsC;QAC/C,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACsB,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;iEAStD;AAQK;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mDAAmD;QAC5D,WAAW,EACT,kTAAkT;KACrT,CAAC;IACmB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,sCAAgB;;8DAGhD;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kDAAkD;QAC3D,WAAW,EACT,8HAA8H;KACjI,CAAC;IACqB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,wCAAiB;;gEAGnD;AAQK;IANL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,iIAAiI;KACpI,CAAC;IACsB,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;iEAGjD;oCAtDU,yBAAyB;IADrC,IAAA,mBAAU,EAAC,wBAAwB,CAAC;qCAGM,yCAAkB;QACnB,uCAAiB;QACxB,wBAAU;GAJhC,yBAAyB,CAuDrC"}

package/dist/admin/dtos/add.system.user.dto.d.ts

@@ -0,0 +1,5 @@
+import { BaseUserDto } from './base.user.dto';
+export declare class AddSystemUserDto extends BaseUserDto {
+    has_global_access?: boolean;
+}
+//# sourceMappingURL=add.system.user.dto.d.ts.map

package/dist/admin/dtos/add.system.user.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.system.user.dto.d.ts","sourceRoot":"","sources":["../../../src/admin/dtos/add.system.user.dto.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAG9C,qBAAa,gBAAiB,SAAQ,WAAW;IAO/C,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B"}

package/dist/admin/dtos/add.system.user.dto.js

@@ -0,0 +1,28 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AddSystemUserDto = void 0;
+const class_validator_1 = require("class-validator");
+const swagger_1 = require("@nestjs/swagger");
+const base_user_dto_1 = require("./base.user.dto");
+class AddSystemUserDto extends base_user_dto_1.BaseUserDto {
+}
+exports.AddSystemUserDto = AddSystemUserDto;
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        default: false,
+        description: 'Lets this user sign in to any organization.',
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], AddSystemUserDto.prototype, "has_global_access", void 0);
+//# sourceMappingURL=add.system.user.dto.js.map

package/dist/admin/dtos/add.system.user.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.system.user.dto.js","sourceRoot":"","sources":["../../../src/admin/dtos/add.system.user.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAwD;AACxD,6CAAsD;AACtD,mDAA8C;AAG9C,MAAa,gBAAiB,SAAQ,2BAAW;CAQhD;AARD,4CAQC;AADC;IANC,IAAA,6BAAmB,EAAC;QACnB,OAAO,EAAE,KAAK;QACd,WAAW,EAAE,6CAA6C;KAC3D,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,GAAE;;2DACgB"}

package/dist/admin/dtos/system.user.list.dto.d.ts

@@ -0,0 +1,4 @@
+import { CommonListFilterDto } from '../../common/dtos/common.list.filter.dto';
+export declare class SystemUserListDto extends CommonListFilterDto {
+}
+//# sourceMappingURL=system.user.list.dto.d.ts.map

package/dist/admin/dtos/system.user.list.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.user.list.dto.d.ts","sourceRoot":"","sources":["../../../src/admin/dtos/system.user.list.dto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAO/E,qBAAa,iBAAkB,SAAQ,mBAAmB;CAAG"}

package/dist/admin/dtos/system.user.list.dto.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SystemUserListDto = void 0;
+const common_list_filter_dto_1 = require("../../common/dtos/common.list.filter.dto");
+class SystemUserListDto extends common_list_filter_dto_1.CommonListFilterDto {
+}
+exports.SystemUserListDto = SystemUserListDto;
+//# sourceMappingURL=system.user.list.dto.js.map

package/dist/admin/dtos/system.user.list.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.user.list.dto.js","sourceRoot":"","sources":["../../../src/admin/dtos/system.user.list.dto.ts"],"names":[],"mappings":";;;AAAA,qFAA+E;AAO/E,MAAa,iBAAkB,SAAQ,4CAAmB;CAAG;AAA7D,8CAA6D"}

package/dist/admin/es6.classes.d.ts

@@ -3,10 +3,12 @@ import { AdminRoleController } from './controllers/admin.role.controller';
 import { AdminScheduledTaskController } from './controllers/admin.scheduled.task.controller';
 import { AdminScopeController } from './controllers/admin.scope.controller';
 import { AdminTenantController } from './controllers/admin.tenant.controller';
+import { AdminSystemUserController } from './controllers/admin.system.user.controller';
 import { AdminTenantUserController } from './controllers/admin.tenant.user.controller';
 import { AdminUserController } from './controllers/admin.user.controller';
 import { SystemRoleController } from './controllers/system.role.controller';
 import { AdminAccessService } from './services/admin.access.service';
+import { SystemUserService } from './services/system.user.service';
 import { AdminUserDataProcessor } from './libraries/admin.user.data.processor';
 import { AdminUserDeleteProcessor } from './libraries/admin.user.delete.processor';
 import { AdminUserListProcessor } from './libraries/admin.user.list.processor';
@@ -23,6 +25,8 @@ import { ScheduledTaskListProcessor } from './libraries/scheduled.task.list.proc
 import { ScopeDataProcessor } from './libraries/scope.data.processor';
 import { ScopeListProcessor } from './libraries/scope.list.processor';
 import { SystemRoleDataProcessor } from './libraries/system.role.data.processor';
+import { SystemUserDataProcessor } from './libraries/system.user.data.processor';
+import { SystemUserListProcessor } from './libraries/system.user.list.processor';
 import { TenantDataProcessor } from './libraries/tenant.data.processor';
 import { TenantDeleteProcessor } from './libraries/tenant.delete.processor';
 import { TenantListProcessor } from './libraries/tenant.list.processor';
@@ -34,9 +38,9 @@ import { AddTenantDto } from './dtos/add.tenant.dto';
 import { ApiKeyListDto } from './dtos/api.key.list.dto';
 import { BaseUserDto } from './dtos/base.user.dto';
 export declare const es6Classes: {
-    controllers: (typeof AdminApiKeyController | typeof AdminRoleController | typeof AdminScheduledTaskController | typeof AdminScopeController | typeof AdminTenantController | typeof AdminTenantUserController | typeof AdminUserController | typeof SystemRoleController)[];
-    services: readonly [typeof AdminAccessService];
-    libraries: (typeof ApiKeyDataProcessor | typeof ApiKeyListProcessor | typeof RoleListProcessor | typeof AdminRoleListProcessor | typeof ScheduledTaskDataProcessor | typeof ScheduledTaskDeleteProcessor | typeof ScheduledTaskListProcessor | typeof ScopeDataProcessor | typeof ScopeListProcessor | typeof TenantDataProcessor | typeof TenantDeleteProcessor | typeof TenantListProcessor | typeof BulkUserDataProcessor | typeof ClientUserDataProcessor | typeof ClientUserDeleteProcessor | typeof ClientUserListProcessor | typeof AdminUserDataProcessor | typeof AdminUserDeleteProcessor | typeof AdminUserListProcessor | typeof SystemRoleDataProcessor)[];
+    controllers: (typeof AdminApiKeyController | typeof AdminRoleController | typeof AdminScheduledTaskController | typeof AdminScopeController | typeof AdminTenantController | typeof AdminSystemUserController | typeof AdminTenantUserController | typeof AdminUserController | typeof SystemRoleController)[];
+    services: readonly [typeof AdminAccessService, typeof SystemUserService];
+    libraries: (typeof ApiKeyDataProcessor | typeof ApiKeyListProcessor | typeof RoleListProcessor | typeof AdminRoleListProcessor | typeof ScheduledTaskDataProcessor | typeof ScheduledTaskDeleteProcessor | typeof ScheduledTaskListProcessor | typeof ScopeDataProcessor | typeof ScopeListProcessor | typeof TenantDataProcessor | typeof TenantDeleteProcessor | typeof TenantListProcessor | typeof SystemUserDataProcessor | typeof SystemUserListProcessor | typeof BulkUserDataProcessor | typeof ClientUserDataProcessor | typeof ClientUserDeleteProcessor | typeof ClientUserListProcessor | typeof AdminUserDataProcessor | typeof AdminUserDeleteProcessor | typeof AdminUserListProcessor | typeof SystemRoleDataProcessor)[];
     dtos: (typeof AddApiKeyDto | typeof ApiKeyListDto | typeof ScheduleDto | typeof AddScopeDto | typeof AddTenantDto | typeof BaseUserDto | typeof AddAdminUserDto)[];
     jobs: any[];
     subscribers: any[];

package/dist/admin/es6.classes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"es6.classes.d.ts","sourceRoot":"","sources":["../../src/admin/es6.classes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAMnD,eAAO,MAAM,UAAU;;;;;;;CAsDtB,CAAC"}
+{"version":3,"file":"es6.classes.d.ts","sourceRoot":"","sources":["../../src/admin/es6.classes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,+CAA+C,CAAC;AAC7F,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,wBAAwB,EAAE,MAAM,yCAAyC,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,0CAA0C,CAAC;AACrF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAC3F,OAAO,EAAE,0BAA0B,EAAE,MAAM,2CAA2C,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AACxE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAGnD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAOnD,eAAO,MAAM,UAAU;;;;;;;CA2DtB,CAAC"}

package/dist/admin/es6.classes.js

@@ -6,10 +6,12 @@ const admin_role_controller_1 = require("./controllers/admin.role.controller");
 const admin_scheduled_task_controller_1 = require("./controllers/admin.scheduled.task.controller");
 const admin_scope_controller_1 = require("./controllers/admin.scope.controller");
 const admin_tenant_controller_1 = require("./controllers/admin.tenant.controller");
+const admin_system_user_controller_1 = require("./controllers/admin.system.user.controller");
 const admin_tenant_user_controller_1 = require("./controllers/admin.tenant.user.controller");
 const admin_user_controller_1 = require("./controllers/admin.user.controller");
 const system_role_controller_1 = require("./controllers/system.role.controller");
 const admin_access_service_1 = require("./services/admin.access.service");
+const system_user_service_1 = require("./services/system.user.service");
 const admin_user_data_processor_1 = require("./libraries/admin.user.data.processor");
 const admin_user_delete_processor_1 = require("./libraries/admin.user.delete.processor");
 const admin_user_list_processor_1 = require("./libraries/admin.user.list.processor");
@@ -26,6 +28,8 @@ const scheduled_task_list_processor_1 = require("./libraries/scheduled.task.list
 const scope_data_processor_1 = require("./libraries/scope.data.processor");
 const scope_list_processor_1 = require("./libraries/scope.list.processor");
 const system_role_data_processor_1 = require("./libraries/system.role.data.processor");
+const system_user_data_processor_1 = require("./libraries/system.user.data.processor");
+const system_user_list_processor_1 = require("./libraries/system.user.list.processor");
 const tenant_data_processor_1 = require("./libraries/tenant.data.processor");
 const tenant_delete_processor_1 = require("./libraries/tenant.delete.processor");
 const tenant_list_processor_1 = require("./libraries/tenant.list.processor");
@@ -36,6 +40,7 @@ const add_client_user_dto_1 = require("./dtos/add.client.user.dto");
 const add_scheduled_task_dto_1 = require("./dtos/add.scheduled.task.dto");
 const add_scope_dto_1 = require("./dtos/add.scope.dto");
 const add_system_role_dto_1 = require("./dtos/add.system.role.dto");
+const add_system_user_dto_1 = require("./dtos/add.system.user.dto");
 const add_tenant_dto_1 = require("./dtos/add.tenant.dto");
 const admin_user_list_dto_1 = require("./dtos/admin.user.list.dto");
 const api_key_list_dto_1 = require("./dtos/api.key.list.dto");
@@ -44,6 +49,7 @@ const base_user_dto_1 = require("./dtos/base.user.dto");
 const role_list_dto_1 = require("./dtos/role.list.dto");
 const scheduled_task_list_dto_1 = require("./dtos/scheduled.task.list.dto");
 const scope_list_dto_1 = require("./dtos/scope.list.dto");
+const system_user_list_dto_1 = require("./dtos/system.user.list.dto");
 const tenant_list_dto_1 = require("./dtos/tenant.list.dto");
 exports.es6Classes = {
     controllers: [
@@ -54,9 +60,10 @@ exports.es6Classes = {
         admin_tenant_controller_1.AdminTenantController,
         admin_user_controller_1.AdminUserController,
         admin_tenant_user_controller_1.AdminTenantUserController,
+        admin_system_user_controller_1.AdminSystemUserController,
         system_role_controller_1.SystemRoleController,
     ],
-    services: [admin_access_service_1.AdminAccessService],
+    services: [admin_access_service_1.AdminAccessService, system_user_service_1.SystemUserService],
     libraries: [
         admin_user_data_processor_1.AdminUserDataProcessor,
         admin_user_delete_processor_1.AdminUserDeleteProcessor,
@@ -75,6 +82,8 @@ exports.es6Classes = {
         scope_data_processor_1.ScopeDataProcessor,
         scope_list_processor_1.ScopeListProcessor,
         system_role_data_processor_1.SystemRoleDataProcessor,
+        system_user_data_processor_1.SystemUserDataProcessor,
+        system_user_list_processor_1.SystemUserListProcessor,
         tenant_data_processor_1.TenantDataProcessor,
         tenant_delete_processor_1.TenantDeleteProcessor,
         tenant_list_processor_1.TenantListProcessor,
@@ -87,6 +96,7 @@ exports.es6Classes = {
         add_scheduled_task_dto_1.ScheduleDto,
         add_scope_dto_1.AddScopeDto,
         add_system_role_dto_1.AddSystemRoleDto,
+        add_system_user_dto_1.AddSystemUserDto,
         add_tenant_dto_1.AddTenantDto,
         admin_user_list_dto_1.AdminUserListDto,
         api_key_list_dto_1.ApiKeyListDto,
@@ -95,6 +105,7 @@ exports.es6Classes = {
         role_list_dto_1.RoleListDto,
         scheduled_task_list_dto_1.ScheduledTaskListDto,
         scope_list_dto_1.ScopeListDto,
+        system_user_list_dto_1.SystemUserListDto,
         tenant_list_dto_1.TenantListDto,
     ],
     jobs: [],

package/dist/admin/es6.classes.js.map

@@ -1 +1 @@
-{"version":3,"file":"es6.classes.js","sourceRoot":"","sources":["../../src/admin/es6.classes.ts"],"names":[],"mappings":";;;AAAA,qFAA+E;AAC/E,+EAA0E;AAC1E,mGAA6F;AAC7F,iFAA4E;AAC5E,mFAA8E;AAC9E,6FAAuF;AACvF,+EAA0E;AAC1E,iFAA4E;AAC5E,0EAAqE;AACrE,qFAA+E;AAC/E,yFAAmF;AACnF,qFAA+E;AAC/E,+EAAyE;AACzE,+EAAyE;AACzE,mFAA6E;AAC7E,uFAAiF;AACjF,2FAAqF;AACrF,uFAAiF;AACjF,yEAGyC;AACzC,6FAAuF;AACvF,iGAA2F;AAC3F,6FAAuF;AACvF,2EAAsE;AACtE,2EAAsE;AACtE,uFAAiF;AACjF,6EAAwE;AACxE,iFAA4E;AAC5E,6EAAwE;AACxE,kEAA4D;AAC5D,4DAAsD;AACtD,kEAA4D;AAC5D,oEAA8D;AAC9D,0EAA4D;AAC5D,wDAAmD;AACnD,oEAA8D;AAC9D,0DAAqD;AACrD,oEAA8D;AAC9D,8DAAwD;AACxD,sEAAgE;AAChE,wDAAmD;AACnD,wDAAmD;AACnD,4EAAsE;AACtE,0DAAqD;AACrD,4DAAuD;AAE1C,QAAA,UAAU,GAAG;IACxB,WAAW,EAAE;QACX,gDAAqB;QACrB,2CAAmB;QACnB,8DAA4B;QAC5B,6CAAoB;QACpB,+CAAqB;QACrB,2CAAmB;QACnB,wDAAyB;QACzB,6CAAoB;KACrB;IACD,QAAQ,EAAE,CAAC,yCAAkB,CAAU;IACvC,SAAS,EAAE;QACT,kDAAsB;QACtB,sDAAwB;QACxB,kDAAsB;QACtB,4CAAsB;QACtB,4CAAmB;QACnB,4CAAmB;QACnB,gDAAqB;QACrB,oDAAuB;QACvB,wDAAyB;QACzB,oDAAuB;QACvB,uCAAiB;QACjB,0DAA0B;QAC1B,8DAA4B;QAC5B,0DAA0B;QAC1B,yCAAkB;QAClB,yCAAkB;QAClB,oDAAuB;QACvB,2CAAmB;QACnB,+CAAqB;QACrB,2CAAmB;KACpB;IACD,IAAI,EAAE;QACJ,oCAAe;QACf,8BAAY;QACZ,oCAAe;QACf,sCAAgB;QAChB,oCAAW;QACX,2BAAW;QACX,sCAAgB;QAChB,6BAAY;QACZ,sCAAgB;QAChB,gCAAa;QACb,2BAAW;QACX,wCAAiB;QACjB,2BAAW;QACX,8CAAoB;QACpB,6BAAY;QACZ,+BAAa;KACd;IACD,IAAI,EAAE,EAAE;IACR,WAAW,EAAE,EAAE;CAChB,CAAC"}
+{"version":3,"file":"es6.classes.js","sourceRoot":"","sources":["../../src/admin/es6.classes.ts"],"names":[],"mappings":";;;AAAA,qFAA+E;AAC/E,+EAA0E;AAC1E,mGAA6F;AAC7F,iFAA4E;AAC5E,mFAA8E;AAC9E,6FAAuF;AACvF,6FAAuF;AACvF,+EAA0E;AAC1E,iFAA4E;AAC5E,0EAAqE;AACrE,wEAAmE;AACnE,qFAA+E;AAC/E,yFAAmF;AACnF,qFAA+E;AAC/E,+EAAyE;AACzE,+EAAyE;AACzE,mFAA6E;AAC7E,uFAAiF;AACjF,2FAAqF;AACrF,uFAAiF;AACjF,yEAGyC;AACzC,6FAAuF;AACvF,iGAA2F;AAC3F,6FAAuF;AACvF,2EAAsE;AACtE,2EAAsE;AACtE,uFAAiF;AACjF,uFAAiF;AACjF,uFAAiF;AACjF,6EAAwE;AACxE,iFAA4E;AAC5E,6EAAwE;AACxE,kEAA4D;AAC5D,4DAAsD;AACtD,kEAA4D;AAC5D,oEAA8D;AAC9D,0EAA4D;AAC5D,wDAAmD;AACnD,oEAA8D;AAC9D,oEAA8D;AAC9D,0DAAqD;AACrD,oEAA8D;AAC9D,8DAAwD;AACxD,sEAAgE;AAChE,wDAAmD;AACnD,wDAAmD;AACnD,4EAAsE;AACtE,0DAAqD;AACrD,sEAAgE;AAChE,4DAAuD;AAE1C,QAAA,UAAU,GAAG;IACxB,WAAW,EAAE;QACX,gDAAqB;QACrB,2CAAmB;QACnB,8DAA4B;QAC5B,6CAAoB;QACpB,+CAAqB;QACrB,2CAAmB;QACnB,wDAAyB;QACzB,wDAAyB;QACzB,6CAAoB;KACrB;IACD,QAAQ,EAAE,CAAC,yCAAkB,EAAE,uCAAiB,CAAU;IAC1D,SAAS,EAAE;QACT,kDAAsB;QACtB,sDAAwB;QACxB,kDAAsB;QACtB,4CAAsB;QACtB,4CAAmB;QACnB,4CAAmB;QACnB,gDAAqB;QACrB,oDAAuB;QACvB,wDAAyB;QACzB,oDAAuB;QACvB,uCAAiB;QACjB,0DAA0B;QAC1B,8DAA4B;QAC5B,0DAA0B;QAC1B,yCAAkB;QAClB,yCAAkB;QAClB,oDAAuB;QACvB,oDAAuB;QACvB,oDAAuB;QACvB,2CAAmB;QACnB,+CAAqB;QACrB,2CAAmB;KACpB;IACD,IAAI,EAAE;QACJ,oCAAe;QACf,8BAAY;QACZ,oCAAe;QACf,sCAAgB;QAChB,oCAAW;QACX,2BAAW;QACX,sCAAgB;QAChB,sCAAgB;QAChB,6BAAY;QACZ,sCAAgB;QAChB,gCAAa;QACb,2BAAW;QACX,wCAAiB;QACjB,2BAAW;QACX,8CAAoB;QACpB,6BAAY;QACZ,wCAAiB;QACjB,+BAAa;KACd;IACD,IAAI,EAAE,EAAE;IACR,WAAW,EAAE,EAAE;CAChB,CAAC"}

package/dist/admin/libraries/system.user.data.processor.d.ts

@@ -0,0 +1,12 @@
+import { UserDataProcessor } from './user.data.processor';
+import { UserEntity } from '../../auth/entities/user.entity';
+import { AddSystemUserDto } from '../dtos/add.system.user.dto';
+export declare class SystemUserDataProcessor extends UserDataProcessor {
+    protected payload: AddSystemUserDto;
+    process(payload: AddSystemUserDto): Promise<UserEntity>;
+    private validate;
+    private save;
+    private create;
+    private update;
+}
+//# sourceMappingURL=system.user.data.processor.d.ts.map

package/dist/admin/libraries/system.user.data.processor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.user.data.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/system.user.data.processor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAI7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAQ/D,qBAAa,uBAAwB,SAAQ,iBAAiB;IAC5D,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;IAE9B,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;YAM/C,QAAQ;YAkBR,IAAI;YAKJ,MAAM;YAoBN,MAAM;CA2BrB"}

package/dist/admin/libraries/system.user.data.processor.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SystemUserDataProcessor = void 0;
+const user_data_processor_1 = require("./user.data.processor");
+const user_entity_1 = require("../../auth/entities/user.entity");
+const user_type_enum_1 = require("../../auth/enums/user.type.enum");
+const auth_utilities_1 = require("../../auth/utilities/auth.utilities");
+const access_revocation_1 = require("../../auth/utilities/access.revocation");
+const access_exception_1 = require("../../global/exceptions/access.exception");
+class SystemUserDataProcessor extends user_data_processor_1.UserDataProcessor {
+    async process(payload) {
+        this.payload = payload;
+        await this.validate();
+        return this.save();
+    }
+    async validate() {
+        const editId = this.payload.id;
+        if (editId &&
+            !(await user_entity_1.UserEntity.existsBy({
+                id: editId,
+                user_type: user_type_enum_1.UserType.SYSTEM_USER,
+            })))
+            this.setColumnError('id', 'No system user exists for this id');
+        await this.assertEmailAvailable(this.payload.email, 'email', editId);
+        this.assertPasswordOnCreate(this.payload.password, !!editId);
+        this.throwExceptionOnError();
+    }
+    async save() {
+        if (this.payload?.id)
+            return this.update();
+        return this.create();
+    }
+    async create() {
+        const body = this.payload;
+        const user = user_entity_1.UserEntity.create({
+            user_type: user_type_enum_1.UserType.SYSTEM_USER,
+            has_global_access: body.has_global_access ?? false,
+            full_name: body.full_name,
+            email: body.email,
+            password: await auth_utilities_1.AuthUtility.hashPassword(body.password),
+            country: body.country,
+            contact_code: body.contact_code,
+            contact: body.contact,
+            active: body.active ?? true,
+        });
+        await user.save();
+        return this.stripSecrets(user);
+    }
+    async update() {
+        const body = this.payload;
+        const user = await user_entity_1.UserEntity.findOne({ where: { id: body.id } });
+        if (!user)
+            throw new access_exception_1.AccessException('Invalid user id provided');
+        const hadAccess = user.has_global_access && user.active;
+        user.full_name = body.full_name;
+        user.email = body.email;
+        user.country = body.country;
+        user.contact_code = body.contact_code;
+        user.contact = body.contact;
+        user.active = body.active ?? true;
+        user.has_global_access = body.has_global_access ?? false;
+        await user.save();
+        if (hadAccess && !(user.has_global_access && user.active))
+            await user_entity_1.UserEntity.getRepository().manager.transaction((trx) => access_revocation_1.AccessRevocation.revokeAll(trx, user.id, false));
+        return this.stripSecrets(user);
+    }
+}
+exports.SystemUserDataProcessor = SystemUserDataProcessor;
+//# sourceMappingURL=system.user.data.processor.js.map

package/dist/admin/libraries/system.user.data.processor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.user.data.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/system.user.data.processor.ts"],"names":[],"mappings":";;;AAAA,+DAA0D;AAC1D,iEAA6D;AAC7D,oEAA2D;AAC3D,wEAAkE;AAClE,8EAA0E;AAE1E,+EAA2E;AAO3E,MAAa,uBAAwB,SAAQ,uCAAiB;IAG5D,KAAK,CAAC,OAAO,CAAC,OAAyB;QACrC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAE/B,IACE,MAAM;YACN,CAAC,CAAC,MAAM,wBAAU,CAAC,QAAQ,CAAC;gBAC1B,EAAE,EAAE,MAAM;gBACV,SAAS,EAAE,yBAAQ,CAAC,WAAW;aAChC,CAAC,CAAC;YAEH,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,mCAAmC,CAAC,CAAC;QAEjE,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACrE,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QAE7D,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE;YAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1B,MAAM,IAAI,GAAG,wBAAU,CAAC,MAAM,CAAC;YAC7B,SAAS,EAAE,yBAAQ,CAAC,WAAW;YAC/B,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IAAI,KAAK;YAClD,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,MAAM,4BAAW,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YACvD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;SAC5B,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAElB,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1B,MAAM,IAAI,GAAG,MAAM,wBAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,kCAAe,CAAC,0BAA0B,CAAC,CAAC;QAEjE,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,MAAM,CAAC;QAExD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;QACtC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;QAClC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,iBAAiB,IAAI,KAAK,CAAC;QAEzD,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAIlB,IAAI,SAAS,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,MAAM,CAAC;YACvD,MAAM,wBAAU,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CAC3D,oCAAgB,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAChD,CAAC;QAEJ,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;CACF;AA/ED,0DA+EC"}

package/dist/admin/libraries/system.user.list.processor.d.ts

@@ -0,0 +1,15 @@
+import { CommonListProcessor } from '../../common/libraries/common.list.processor';
+import { SqlService } from '../../common/services/sql.service';
+import { SystemUserListDto } from '../dtos/system.user.list.dto';
+export declare class SystemUserListProcessor extends CommonListProcessor {
+    protected readonly sqlService: SqlService;
+    constructor(sqlService: SqlService);
+    process(payload: SystemUserListDto): Promise<{
+        records: import("../..").SqlRow[];
+        total: number;
+        page: number;
+        limit: number;
+        total_pages: number;
+    }>;
+}
+//# sourceMappingURL=system.user.list.processor.d.ts.map

package/dist/admin/libraries/system.user.list.processor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system.user.list.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/system.user.list.processor.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAE/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AASjE,qBAAa,uBAAwB,SAAQ,mBAAmB;IAClD,SAAS,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU;gBAAtB,UAAU,EAAE,UAAU;IAI/C,OAAO,CAAC,OAAO,EAAE,iBAAiB;;;;;;;CAoCzC"}