@neohm/nestend 4.0.1 → 4.1.0

package/README.md

@@ -104,13 +104,13 @@ these are free to change without a breaking release.
 | Area              | Key exports                                                                                                                          | Notes                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
 | ----------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | Entities          | `RootEntity`, `CommonEntity`, `CommonAdminEntity`, `UserEntity`, `AdminUserEntity`, `SystemRoleEntity`, `SystemAdminRoleEntity`, ... | uuid PK, soft deletes, `created_by`/`updated_by` (+ `creator`/`updater` relations), jsonb `attributes`; entity-level `findOneOrNew`, `hardDelete`, `restore`, `paginate` statics plus a row-wise `softDelete()`                                                                                                                                                                                                                                                                                         |
-| Migrations        | `MigrationUtility`, `SeederUtility` (the 29 table migrations ship in `dist/migrations` — glob them, they are not barrel exports)     | fluent `this.string()`, `this.numeric()`, `addRecord()` seeding                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| Migrations        | `MigrationUtility`, `SeederUtility` (the 31 table migrations ship in `dist/migrations` — glob them, they are not barrel exports)     | fluent `this.string()`, `this.numeric()`, `addRecord()` seeding                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | Queue             | `QueueModule`, `QueueModule.withConnection()`, `QueueService`, `CommonJob`                                                           | BullMQ `@Processor`/`WorkerHost` consumer; auto-discovered jobs, duplicate prevention, recurring schedulers, completed jobs cleared from Redis on success (1-day TTL on failures), `clearQueue()`, retries, failures persisted to `sys_failed_jobs`; connection from `BULL_REDIS_*` or supplied by the app — never register `BullModule.forRoot()` yourself, two roots race over the worker's connection                                                                                                |
 | Scheduled events  | `SystemScheduledTaskEntity`, `ScheduledEventEntity`, `ScheduleKind`, `ScheduleSpec`, `IsCronExpression`                              | schedule definitions in `sys_scheduled_tasks` → events in `sys_scheduled_events`; interval / cron / once specs with timezones, drift-free slots, horizon materialisation, catch-up + overlap policies, fire-once dispatch with backoff, cadence via `SCHEDULED_EVENT_MIN`                                                                                                                                                                                                                               |
-| Auth              | `AuthModule`, `AuthService.validateRole()`, `RoleTier`, `TenantRole`, `Auth`, `JwtMiddleware`                                        | imperative auth (open by default); `<module>.<tier>` role hierarchy (manager > writer > viewer), with `global.admin` overriding every role check; JwtMiddleware resolves the user into `Auth`'s AsyncLocalStorage context per request; access + rotating refresh tokens; session-based logout invalidation (`sys_auth_sessions`); Google SSO via ID token at `POST /auth/google`; impersonation — a tenantless `has_global_access` user signs into one organization at `POST /auth/impersonation/login` |
+| Auth              | `AuthModule`, `AuthService.validateRole()`, `RoleTier`, `TenantRole`, `Auth`, `JwtMiddleware`                                        | imperative auth (open by default); `<module>.<tier>` role hierarchy (manager > writer > viewer), with `global.admin` overriding every role check; JwtMiddleware resolves the user into `Auth`'s AsyncLocalStorage context per request; access + rotating refresh tokens; session-based logout invalidation (`sys_auth_sessions`); Google SSO via ID token at `POST /auth/google`; impersonation — a tenantless `has_global_access` user signs into one organization at `POST /auth/impersonation/login`; multi-organization membership with per-organization roles, organization switching and `global.admin` invitations (`TenantMembershipService`, `TenantInvitationService`) |
 | Admin auth        | `AdminAuthService.validateRole()`, `AdminAuth`, `AdminJwtMiddleware` (endpoints at `/admin/auth`)                                    | fully separate stack for back-office admins — own users table (`sys_admin_users`), own roles (`sys_admin_roles`/`sys_auser_roles`), own sessions/refresh tokens (shared tables, `is_admin` flag)                                                                                                                                                                                                                                                                                                        |
 | API keys          | `ApiKeyService`, `ApiKeyGuard` / `ApiKeyMiddleware`, `@ApiKeyScopes()`, `ApiKeyContext`                                              | hashed keys in `sys_api_keys` (admin-owned), one tenant per key, expiry/revocation, `x-api-key` header; `validateAccess(scope)` returns the tenant the key acts for                                                                                                                                                                                                                                                                                                                                     |
-| Scopes            | `ScopeService`, `AuthService.validateAccess()`, `ScopeEntity`, `TenantScopeEntity`, `ApiScopeEntity`                                 | one feature named once in `sys_scopes`, then granted per organization (`sys_tenant_scopes`) or per API key (`sys_api_scopes`) — never an array on the principal                                                                                                                                                                                                                                                                                                                                         |
+| Scopes            | `ScopeService`, `AuthService.validateAccess()`, `ScopeEntity`, `TenantScopeEntity`, `ApiScopeEntity`                                 | one feature named once in `sys_scopes`, optionally with child scopes under it, then granted per organization (`sys_tenant_scopes`) or per API key (`sys_api_scopes`) — never an array on the principal                                                                                                                                                                                                                                                                                                                                         |
 | Multi-tenancy     | `TenantModule`, `TenantEntity`, `CommonTenantEntity`, `TenantContextService`, `TenantContextMiddleware`                              | AsyncLocalStorage tenant context; resolve by header, slug, or domain; tenants are onboarded by admins (`TenantEntity.creator` → `AdminUserEntity`)                                                                                                                                                                                                                                                                                                                                                      |
 | Admin             | `AdminModule` (its controllers, DTOs and processors are internal — import the module and hit the endpoints), `GlobalAdminRoles`      | back-office APIs: tenant onboarding, client/admin/system user registration (single + bulk), the `has_global_access` grant that enables impersonation, tenant + scheduled-task listing, the email/PDF template catalogues (read at content-reader, written at content-manager, deleted at global admin); 4-tier `GlobalAdminRoles` gate over `sys_admin_roles`; Swagger at `/docs` (hidden in production)                                                                                                                                                                                                                 |
 | Notifications     | `NotificationModule`, `NotificationService`, `FcmPushNotificationService`                                                            | in-app rows + FCM push (optional `firebase-admin`); device token registry                                                                                                                                                                                                                                                                                                                                                                                                                               |
@@ -207,6 +207,12 @@ caller's tenant holds that scope (`sys_tenant_scopes` against the `sys_scopes`
 catalogue), then delegates to `validateRole()`. One call answers "is this feature
 sold to them?" and "is this person allowed to use it?" in that order.
 
+A scope can be a parent of others (`parent_id` on `sys_scopes`), which is how part
+of a feature is sold on its own. Granting the parent grants every child under it, so
+a tenant enabled for `billing.invoices` clears `billing.invoices.refund` too;
+granting children grants only those, and never the parent. The catalogue stops at two
+levels — a child holds no children — so a grant expands in exactly one hop.
+
 ```ts
 const { user } = await this.authService.validateAccess('billing.invoices');
 const { user } = await this.authService.validateAccess(
@@ -217,7 +223,8 @@ const { user } = await this.authService.validateAccess(
 
 `AuthController` (mounted at `/auth`) exposes the ready-made flows: `POST
 /auth/login`, `/auth/google`, `/auth/register`, `/auth/refresh`, `/auth/logout`,
-`/auth/change-password`, and `GET /auth/me`. Passwords are hashed/verified via
+`/auth/change-password`, and `GET /auth/me` (user, roles in the session's
+organization, `organizations` to switch to, pending `invitations`). Passwords are hashed/verified via
 `AuthUtility` (bcrypt); the write flows use the processor lifecycle. Credential
 misses spend the same bcrypt work as a wrong password
 (`AuthUtility.compareAgainstDummy()`), so response timing does not reveal
@@ -246,6 +253,35 @@ impersonated session, for an in-app switcher), each login writes an
 tenant from real membership with `Auth.isImpersonating()` /
 `Auth.impersonatedTenant()`.
 
+**Multiple organizations** — a tenant user may belong to many organizations
+(`sys_tenant_users`), with roles granted per organization (`sys_user_roles.tenant_id`).
+Each session works in one, held on its `sys_auth_sessions` row and mirrored onto
+`Auth.user().organization_id`, so role and scope checks only ever see that
+organization's grants. Login lands in the last organization switched to (remembered in
+`sys_users.organization_id`) or the first membership; a user with none gets a
+tenantless session. `GET /auth/organizations` lists memberships and
+`POST /auth/organizations/switch` (`{ tenant_id, refresh_token }`) retires the current
+session and returns a pair bound to the chosen one; `POST /auth/organizations/:id/leave`
+ends a membership and returns a fresh pair. A refresh re-checks the membership and
+the tenant, so a removed member or a deactivated tenant drops the organization.
+
+**Invitations** — an organization's `global.admin` invites an email with roles at
+`POST /organization/invitations` (`{ email, role_ids }`; also `POST .../list`,
+`DELETE .../:id` to revoke, `GET .../roles` for the picker). An address with no account gets one: a random one-time password is mailed through the
+`tenant-user-invited` template and `password_change_required` is set, so every endpoint
+except `GET /auth/me` and `POST /auth/change-password` (`AuthService.validateIdentity()`)
+refuses until it is changed; resending the invitation re-issues it. The invitee
+sees pending ones on `GET /auth/me` / `GET /auth/invitations` and answers with
+`POST /auth/invitations/:id/accept` (membership + roles, then switch to use it) or
+`.../decline`. Invitations expire after `TENANT_INVITATION_EXPIRY` (default `7d`).
+Acceptance trusts the account's email — emails are unique case-insensitively, but
+verify addresses if you allow open self-registration. The same `global.admin` manages
+members at `/organization/members` (`POST list`, `POST :userId/roles`,
+`POST :userId/deactivate` / `reactivate`, `DELETE :userId`) and resends invitations
+(`POST /organization/invitations/:id/resend`). Deactivation suspends the membership,
+not the account (which may belong elsewhere); an organization always keeps at least
+one active `global.admin`. A deactivated account is refused on its next request.
+
 **Google SSO** — the client posts a Google ID token as `{ id_token }` to
 `POST /auth/google`. `GoogleAuthService` verifies it against Google's tokeninfo
 endpoint (audience must match `GOOGLE_CLIENT_ID`, issuer `accounts.google.com`,
@@ -634,6 +670,7 @@ Requires the optional peer dependency `puppeteer`.
 | Variable             | Default       | Description                                     |
 | -------------------- | ------------- | ----------------------------------------------- |
 | `TENANT_HEADER_NAME` | `x-tenant-id` | Request header carrying the tenant UUID or slug |
+| `TENANT_INVITATION_EXPIRY` | `7d` | How long an organization invitation stays answerable |
 
 ### API Keys
 
@@ -655,7 +692,8 @@ content reader.
 
 A key belongs to one tenant and holds its scopes as `sys_api_scopes` rows against
 the `sys_scopes` catalogue — there is no scopes array on the key, and a key grants
-nothing it was not given (a granted `*` is the only blanket). `ApiKeyMiddleware`
+nothing it was not given (a granted `*` is the only blanket, and a granted parent
+scope carries its children). `ApiKeyMiddleware`
 resolves the key, its tenant and its scope identifiers once per request into
 `ApiKeyContext`; enforce from there:
 
@@ -1060,6 +1098,9 @@ pass the actor to a processor.
 | `POST   /admin/tenant-users/list`    | content reader  | `ClientUserListProcessor`                                       |
 | `GET    /admin/tenant-users/:id`     | content reader  | the row                                                         |
 | `DELETE /admin/tenant-users/:id`     | admin           | `ClientUserDeleteProcessor`                                     |
+| `POST   /admin/tenant-users/memberships` | admin      | `ClientMembershipDataProcessor` — add an existing user to a tenant |
+| `DELETE /admin/tenant-users/:id/memberships/:tenantId` | admin | `TenantMembershipService.removeMember` |
+| `POST   /admin/tenant-users/:id/memberships/:tenantId/deactivate` · `/reactivate` | admin | `TenantMembershipService.setMemberActive` |
 | `POST   /admin/system-users`         | super admin     | `SystemUserDataProcessor` (upsert — send `id` to update)        |
 | `POST   /admin/system-users/list`    | content reader  | `SystemUserListProcessor` (scoped to `user_type = system.user`) |
 | `GET    /admin/system-users/:id`     | content reader  | the row                                                         |
@@ -1088,8 +1129,10 @@ pass the actor to a processor.
 | `DELETE /admin/pdf-templates/:id`    | **admin**       | `TemplateService.deletePdfTemplate`                             |
 | `POST   /admin/scopes`               | content manager | `ScopeDataProcessor` (upsert — send `id` to update)             |
 | `POST   /admin/scopes/list`          | content reader  | `ScopeListProcessor`                                            |
+| `POST   /admin/scopes/:id/children`  | content manager | `ScopeDataProcessor` (upsert — parent taken from the path)      |
+| `POST   /admin/scopes/:id/children/list` | content reader | `ScopeListProcessor` (`parent_id` taken from the path)       |
 | `GET    /admin/scopes/:id`           | content reader  | the row                                                         |
-| `DELETE /admin/scopes/:id`           | content manager | `ScopeService.deleteScope` (cascades to every grant)            |
+| `DELETE /admin/scopes/:id`           | content manager, **admin** for a child | `ScopeService.deleteScope` (cascades to children and every grant) |
 | `POST   /admin/api-keys`             | admin           | `ApiKeyDataProcessor` — returns `{ raw_key, api_key }`          |
 | `POST   /admin/api-keys/list`        | content reader  | `ApiKeyListProcessor`                                           |
 | `GET    /admin/api-keys/:id`         | content reader  | the row, its `scopes`, and `key` from admin up                  |
@@ -1117,12 +1160,18 @@ remote template, every mail already sent and every document already generated ar
 exactly as they are.
 
 **Scopes and grants.** A scope is defined once in `sys_scopes` (content manager),
-then granted to the principals that hold it. `AddTenantDto.scope_ids` carries the
-tenant's whole scope set — `setScopes()` grants what is new and soft-removes what is
-gone, so an omitted list revokes them all (a picker has no other way to clear its
-last selection); every other optional field on that DTO still keeps its stored value.
-An API key can only be granted scopes its tenant already holds, so a key never
-out-ranks the organization it acts for. The key comes back in the issue response as
+then granted to the principals that hold it. A scope sent with a `parent_id` — or
+posted to `/admin/scopes/:id/children` — is a child of that scope, and granting the
+parent grants it. `ScopeDataProcessor` keeps the catalogue two levels deep: a child
+never takes children, and a scope that already has children can never be turned into
+one. `AddTenantDto.scope_ids` carries the tenant's whole scope set — `setScopes()`
+grants what is new and soft-removes what is gone, so an omitted list revokes them all
+(a picker has no other way to clear its last selection); every other optional field on
+that DTO still keeps its stored value. An API key can only be granted scopes its
+tenant already holds — children of a held parent included — so a key never out-ranks
+the organization it acts for. Deleting a scope takes its children with it, which is
+why removing a child sits at the admin bar rather than the content-manager one: it
+narrows access tenants already have. The key comes back in the issue response as
 `raw_key`, and afterwards from `GET /admin/api-keys/:id` as `key` — for a global
 admin only.
 

package/dist/admin/controllers/admin.api.key.controller.d.ts

@@ -1,5 +1,6 @@
 import { ListFilterService } from '../../common/services/list.filter.service';
 import { ApiKeyService } from '../../auth/services/api.key.service';
+import { ScopeService } from '../../auth/services/scope.service';
 import { AdminAccessService } from '../services/admin.access.service';
 import { CommonParamsDto } from '../../common/dtos/common.params.dto';
 import { AddApiKeyDto } from '../dtos/add.api.key.dto';
@@ -7,8 +8,9 @@ import { ApiKeyListDto } from '../dtos/api.key.list.dto';
 export declare class AdminApiKeyController {
     private readonly adminAccessService;
     private readonly apiKeyService;
+    private readonly scopeService;
     private readonly listFilterService;
-    constructor(adminAccessService: AdminAccessService, apiKeyService: ApiKeyService, listFilterService: ListFilterService);
+    constructor(adminAccessService: AdminAccessService, apiKeyService: ApiKeyService, scopeService: ScopeService, listFilterService: ListFilterService);
     issue(dto: AddApiKeyDto): Promise<import("../types/admin.types").IssuedApiKey>;
     list(dto: ApiKeyListDto): Promise<import("../..").CommonListResult>;
     detail({ id }: CommonParamsDto): Promise<import("../..").ApiKeyDetail>;

package/dist/admin/controllers/admin.api.key.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.api.key.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.api.key.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAGtE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAOzD,qBAGa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,kBAAkB,EAAE,kBAAkB,EACtC,aAAa,EAAE,aAAa,EAC5B,iBAAiB,EAAE,iBAAiB;IASjD,KAAK,CAAS,GAAG,EAAE,YAAY;IAW/B,IAAI,CAAS,GAAG,EAAE,aAAa;IAW/B,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAgBvC,OAAO,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAWxC,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;CAI9C"}
+{"version":3,"file":"admin.api.key.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.api.key.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAEjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAGtE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAOzD,qBAGa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAHjB,kBAAkB,EAAE,kBAAkB,EACtC,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,YAAY,EAC1B,iBAAiB,EAAE,iBAAiB;IASjD,KAAK,CAAS,GAAG,EAAE,YAAY;IAe/B,IAAI,CAAS,GAAG,EAAE,aAAa;IAW/B,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAgBvC,OAAO,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAWxC,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;CAI9C"}

package/dist/admin/controllers/admin.api.key.controller.js

@@ -17,6 +17,7 @@ const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
 const list_filter_service_1 = require("../../common/services/list.filter.service");
 const api_key_service_1 = require("../../auth/services/api.key.service");
+const scope_service_1 = require("../../auth/services/scope.service");
 const global_admin_roles_enum_1 = require("../../auth/enums/global.admin.roles.enum");
 const admin_access_service_1 = require("../services/admin.access.service");
 const common_params_dto_1 = require("../../common/dtos/common.params.dto");
@@ -25,14 +26,15 @@ const api_key_list_processor_1 = require("../libraries/api.key.list.processor");
 const add_api_key_dto_1 = require("../dtos/add.api.key.dto");
 const api_key_list_dto_1 = require("../dtos/api.key.list.dto");
 let AdminApiKeyController = class AdminApiKeyController {
-    constructor(adminAccessService, apiKeyService, listFilterService) {
+    constructor(adminAccessService, apiKeyService, scopeService, listFilterService) {
         this.adminAccessService = adminAccessService;
         this.apiKeyService = apiKeyService;
+        this.scopeService = scopeService;
         this.listFilterService = listFilterService;
     }
     async issue(dto) {
         const { user } = await this.adminAccessService.validateAdmin();
-        return new api_key_data_processor_1.ApiKeyDataProcessor(user, this.apiKeyService).process(dto);
+        return new api_key_data_processor_1.ApiKeyDataProcessor(user, this.apiKeyService, this.scopeService).process(dto);
     }
     async list(dto) {
         await this.adminAccessService.validateContentReader();
@@ -57,7 +59,7 @@ __decorate([
     (0, common_1.Post)(),
     (0, swagger_1.ApiOperation)({
         summary: 'Issue an API key for a tenant.',
-        description: 'Create-only — `raw_key` is the full key and is returned exactly once, since only its hash is stored. A key can only be granted scopes its tenant already holds. Requires at least the global admin role.',
+        description: 'Create-only — `raw_key` is the full key and is returned exactly once, since only its hash is stored. A key can only be granted scopes its tenant already holds, which includes the children of any parent scope the tenant is enabled for. Requires at least the global admin role.',
     }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
@@ -114,6 +116,7 @@ exports.AdminApiKeyController = AdminApiKeyController = __decorate([
     (0, common_1.Controller)('api/admin/api-keys'),
     __metadata("design:paramtypes", [admin_access_service_1.AdminAccessService,
         api_key_service_1.ApiKeyService,
+        scope_service_1.ScopeService,
         list_filter_service_1.ListFilterService])
 ], AdminApiKeyController);
 //# sourceMappingURL=admin.api.key.controller.js.map

package/dist/admin/controllers/admin.api.key.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.api.key.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.api.key.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4E;AAC5E,6CAAuE;AACvE,mFAA8E;AAC9E,yEAAoE;AACpE,sFAA4E;AAC5E,2EAAsE;AACtE,2EAAsE;AACtE,gFAA0E;AAC1E,gFAA0E;AAC1E,6DAAuD;AACvD,+DAAyD;AAUlD,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YACmB,kBAAsC,EACtC,aAA4B,EAC5B,iBAAoC;QAFpC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,kBAAa,GAAb,aAAa,CAAe;QAC5B,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,KAAK,CAAS,GAAiB;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,4CAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxE,CAAC;IAQK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAkB;QACnC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,4CAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,YAAY,CACjD,MAAM,EACN,0CAAgB,CAAC,YAAY,CAC9B,CAAC;QAEF,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAQK,AAAN,KAAK,CAAC,OAAO,CAAU,EAAE,EAAE,EAAmB;QAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;CACF,CAAA;AAlEY,sDAAqB;AAa1B;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,0MAA0M;KAC7M,CAAC;IACW,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,8BAAY;;kDAGpC;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EACT,uKAAuK;KAC1K,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,gCAAa;;iDAGpC;AAQK;IANL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,mWAAmW;KACtW,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;mDAQ5C;AAQK;IANL,IAAA,aAAI,EAAC,aAAa,CAAC;IACnB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EACT,sLAAsL;KACzL,CAAC;IACa,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;oDAG7C;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,sUAAsU;KACzU,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;mDAG5C;gCAjEU,qBAAqB;IAHjC,IAAA,iBAAO,EAAC,kBAAkB,CAAC;IAC3B,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,oBAAoB,CAAC;qCAGQ,yCAAkB;QACvB,+BAAa;QACT,uCAAiB;GAJ5C,qBAAqB,CAkEjC"}
+{"version":3,"file":"admin.api.key.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.api.key.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4E;AAC5E,6CAAuE;AACvE,mFAA8E;AAC9E,yEAAoE;AACpE,qEAAiE;AACjE,sFAA4E;AAC5E,2EAAsE;AACtE,2EAAsE;AACtE,gFAA0E;AAC1E,gFAA0E;AAC1E,6DAAuD;AACvD,+DAAyD;AAUlD,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,YACmB,kBAAsC,EACtC,aAA4B,EAC5B,YAA0B,EAC1B,iBAAoC;QAHpC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,kBAAa,GAAb,aAAa,CAAe;QAC5B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,KAAK,CAAS,GAAiB;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,4CAAmB,CAC5B,IAAI,EACJ,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,YAAY,CAClB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAQK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAkB;QACnC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,4CAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,YAAY,CACjD,MAAM,EACN,0CAAgB,CAAC,YAAY,CAC9B,CAAC;QAEF,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAQK,AAAN,KAAK,CAAC,OAAO,CAAU,EAAE,EAAE,EAAmB;QAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;CACF,CAAA;AAvEY,sDAAqB;AAc1B;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,qRAAqR;KACxR,CAAC;IACW,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,8BAAY;;kDAOpC;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EACT,uKAAuK;KAC1K,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,gCAAa;;iDAGpC;AAQK;IANL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,mWAAmW;KACtW,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;mDAQ5C;AAQK;IANL,IAAA,aAAI,EAAC,aAAa,CAAC;IACnB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EACT,sLAAsL;KACzL,CAAC;IACa,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;oDAG7C;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,sUAAsU;KACzU,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;mDAG5C;gCAtEU,qBAAqB;IAHjC,IAAA,iBAAO,EAAC,kBAAkB,CAAC;IAC3B,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,oBAAoB,CAAC;qCAGQ,yCAAkB;QACvB,+BAAa;QACd,4BAAY;QACP,uCAAiB;GAL5C,qBAAqB,CAuEjC"}

package/dist/admin/controllers/admin.scope.controller.d.ts

@@ -12,6 +12,8 @@ export declare class AdminScopeController {
     constructor(adminAccessService: AdminAccessService, scopeService: ScopeService, listFilterService: ListFilterService);
     save(dto: AddScopeDto): Promise<ScopeEntity>;
     list(dto: ScopeListDto): Promise<import("../..").CommonListResult>;
+    saveChild({ id }: CommonParamsDto, dto: AddScopeDto): Promise<ScopeEntity>;
+    children({ id }: CommonParamsDto, dto: ScopeListDto): Promise<import("../..").CommonListResult>;
     detail({ id }: CommonParamsDto): Promise<ScopeEntity>;
     remove({ id }: CommonParamsDto): Promise<import("../..").DeleteResult>;
 }

package/dist/admin/controllers/admin.scope.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.scope.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.scope.controller.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAGjE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAQ/D,qBAGa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,kBAAkB,EAAE,kBAAkB,EACtC,YAAY,EAAE,YAAY,EAC1B,iBAAiB,EAAE,iBAAiB;IASjD,IAAI,CAAS,GAAG,EAAE,WAAW;IAU7B,IAAI,CAAS,GAAG,EAAE,YAAY;IAU9B,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAevC,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;CAI9C"}
+{"version":3,"file":"admin.scope.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.scope.controller.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AAGtE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAGjE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAQ/D,qBAGa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,kBAAkB,EAAE,kBAAkB,EACtC,YAAY,EAAE,YAAY,EAC1B,iBAAiB,EAAE,iBAAiB;IASjD,IAAI,CAAS,GAAG,EAAE,WAAW;IAW7B,IAAI,CAAS,GAAG,EAAE,YAAY;IAW9B,SAAS,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe,EAAU,GAAG,EAAE,WAAW;IAWpE,QAAQ,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe,EAAU,GAAG,EAAE,YAAY;IAapE,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAevC,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;CAgB9C"}

package/dist/admin/controllers/admin.scope.controller.js

@@ -18,6 +18,8 @@ const swagger_1 = require("@nestjs/swagger");
 const list_filter_service_1 = require("../../common/services/list.filter.service");
 const admin_access_service_1 = require("../services/admin.access.service");
 const common_params_dto_1 = require("../../common/dtos/common.params.dto");
+const global_admin_roles_enum_1 = require("../../auth/enums/global.admin.roles.enum");
+const access_exception_1 = require("../../global/exceptions/access.exception");
 const scope_service_1 = require("../../auth/services/scope.service");
 const scope_data_processor_1 = require("../libraries/scope.data.processor");
 const scope_list_processor_1 = require("../libraries/scope.list.processor");
@@ -38,6 +40,17 @@ let AdminScopeController = class AdminScopeController {
         await this.adminAccessService.validateContentReader();
         return new scope_list_processor_1.ScopeListProcessor(this.listFilterService).process(dto);
     }
+    async saveChild({ id }, dto) {
+        const { user } = await this.adminAccessService.validateContentManager();
+        return new scope_data_processor_1.ScopeDataProcessor(user).process({ ...dto, parent_id: id });
+    }
+    async children({ id }, dto) {
+        await this.adminAccessService.validateContentReader();
+        return new scope_list_processor_1.ScopeListProcessor(this.listFilterService).process({
+            ...dto,
+            parent_id: id,
+        });
+    }
     async detail({ id }) {
         await this.adminAccessService.validateContentReader();
         const scope = await scope_entity_1.ScopeEntity.findOne({ where: { id } });
@@ -46,8 +59,11 @@ let AdminScopeController = class AdminScopeController {
         return scope;
     }
     async remove({ id }) {
-        const { user } = await this.adminAccessService.validateContentManager();
-        return this.scopeService.deleteScope(id, user.id);
+        const access = await this.adminAccessService.validateContentManager();
+        if ((await this.scopeService.isChildScope(id)) &&
+            !this.adminAccessService.holdsAtLeast(access, global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_ADMIN))
+            throw new access_exception_1.AccessException(`Deleting a child scope requires at least the "${global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_ADMIN}" role.`);
+        return this.scopeService.deleteScope(id, access.user.id);
     }
 };
 exports.AdminScopeController = AdminScopeController;
@@ -55,7 +71,7 @@ __decorate([
     (0, common_1.Post)(),
     (0, swagger_1.ApiOperation)({
         summary: 'Define a scope, or update an existing one.',
-        description: 'Send an `id` to edit that scope; omit it to define a new one. `identifier` is what code checks and is unique across the catalogue. Requires at least the global content manager role.',
+        description: 'Send an `id` to edit that scope; omit it to define a new one. `identifier` is what code checks and is unique across the catalogue. `parent_id` files the scope under another one — a scope that already has children of its own cannot be given a parent. Requires at least the global content manager role.',
     }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
@@ -66,13 +82,37 @@ __decorate([
     (0, common_1.Post)('list'),
     (0, swagger_1.ApiOperation)({
         summary: 'List, search and filter scopes.',
-        description: 'Requires at least the global content reader role.',
+        description: 'Rows carry `parent_id`, the parent labels `parent_identifier` and `parent_name`, and `child_count` — so a parent and a child are told apart without a second read. Requires at least the global content reader role.',
     }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [scope_list_dto_1.ScopeListDto]),
     __metadata("design:returntype", Promise)
 ], AdminScopeController.prototype, "list", null);
+__decorate([
+    (0, common_1.Post)(':id/children'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Add a child scope under this one, or update an existing child.',
+        description: 'The parent comes from the path, so the body is an ordinary scope — send an `id` to edit a child, omit it to define one. The parent has to be a parent itself: a child scope never holds children. Requires at least the global content manager role.',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto, add_scope_dto_1.AddScopeDto]),
+    __metadata("design:returntype", Promise)
+], AdminScopeController.prototype, "saveChild", null);
+__decorate([
+    (0, common_1.Post)(':id/children/list'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'List, search and filter the children of one scope.',
+        description: 'The same listing as `POST /list`, with `parent_id` taken from the path — so a body that names a different parent cannot widen it. Requires at least the global content reader role.',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto, scope_list_dto_1.ScopeListDto]),
+    __metadata("design:returntype", Promise)
+], AdminScopeController.prototype, "children", null);
 __decorate([
     (0, common_1.Get)(':id'),
     (0, swagger_1.ApiOperation)({
@@ -88,7 +128,7 @@ __decorate([
     (0, common_1.Delete)(':id'),
     (0, swagger_1.ApiOperation)({
         summary: 'Delete a scope.',
-        description: 'Soft delete: the row keeps its data with `deleted_at` set and drops out of every listing. Every grant of it goes too — the tenant rows in `sys_tenant_scopes` and the API-key rows in `sys_api_scopes` — so no principal keeps a feature the catalogue no longer defines. Requires at least the global content manager role.',
+        description: 'Soft delete: the row keeps its data with `deleted_at` set and drops out of every listing. Its children go with it, and so does every grant of any of them — the tenant rows in `sys_tenant_scopes` and the API-key rows in `sys_api_scopes` — so no principal keeps a feature the catalogue no longer defines. Requires at least the global content manager role, and the global admin role to delete a child scope: a child is a slice of a feature tenants already hold, and removing it narrows their access rather than retiring the feature.',
     }),
     __param(0, (0, common_1.Param)()),
     __metadata("design:type", Function),

package/dist/admin/controllers/admin.scope.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.scope.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.scope.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,6CAAuE;AACvE,mFAA8E;AAC9E,2EAAsE;AACtE,2EAAsE;AACtE,qEAAiE;AACjE,4EAAuE;AACvE,4EAAuE;AACvE,yDAAoD;AACpD,2DAAsD;AACtD,mEAA+D;AAWxD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YACmB,kBAAsC,EACtC,YAA0B,EAC1B,iBAAoC;QAFpC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,iBAAY,GAAZ,YAAY,CAAc;QAC1B,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CAAS,GAAgB;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC;QACxE,OAAO,IAAI,yCAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IAOK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAiB;QAClC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,yCAAkB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IAOK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QAEtD,MAAM,KAAK,GAAG,MAAM,0BAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;QAEvE,OAAO,KAAK,CAAC;IACf,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACpD,CAAC;CACF,CAAA;AApDY,oDAAoB;AAazB;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,4CAA4C;QACrD,WAAW,EACT,uLAAuL;KAC1L,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,2BAAW;;gDAGlC;AAOK;IALL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,6BAAY;;gDAGnC;AAOK;IALL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;kDAO5C;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EACT,8TAA8T;KACjU,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;kDAG5C;+BAnDU,oBAAoB;IAHhC,IAAA,iBAAO,EAAC,gBAAgB,CAAC;IACzB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,kBAAkB,CAAC;qCAGU,yCAAkB;QACxB,4BAAY;QACP,uCAAiB;GAJ5C,oBAAoB,CAoDhC"}
+{"version":3,"file":"admin.scope.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.scope.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,6CAAuE;AACvE,mFAA8E;AAC9E,2EAAsE;AACtE,2EAAsE;AACtE,sFAA4E;AAC5E,+EAA2E;AAC3E,qEAAiE;AACjE,4EAAuE;AACvE,4EAAuE;AACvE,yDAAoD;AACpD,2DAAsD;AACtD,mEAA+D;AAWxD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YACmB,kBAAsC,EACtC,YAA0B,EAC1B,iBAAoC;QAFpC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,iBAAY,GAAZ,YAAY,CAAc;QAC1B,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CAAS,GAAgB;QACjC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC;QACxE,OAAO,IAAI,yCAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC;IAQK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAiB;QAClC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,yCAAkB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IAQK,AAAN,KAAK,CAAC,SAAS,CAAU,EAAE,EAAE,EAAmB,EAAU,GAAgB;QACxE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC;QACxE,OAAO,IAAI,yCAAkB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IACzE,CAAC;IAQK,AAAN,KAAK,CAAC,QAAQ,CAAU,EAAE,EAAE,EAAmB,EAAU,GAAiB;QACxE,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,yCAAkB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;YAC5D,GAAG,GAAG;YACN,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IAOK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QAEtD,MAAM,KAAK,GAAG,MAAM,0BAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;QAEvE,OAAO,KAAK,CAAC;IACf,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC;QAEtE,IACE,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC,IAAI,CAAC,kBAAkB,CAAC,YAAY,CACnC,MAAM,EACN,0CAAgB,CAAC,YAAY,CAC9B;YAED,MAAM,IAAI,kCAAe,CACvB,iDAAiD,0CAAgB,CAAC,YAAY,SAAS,CACxF,CAAC;QAEJ,OAAO,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;CACF,CAAA;AA1FY,oDAAoB;AAazB;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,4CAA4C;QACrD,WAAW,EACT,8SAA8S;KACjT,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,2BAAW;;gDAGlC;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,sNAAsN;KACzN,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,6BAAY;;gDAGnC;AAQK;IANL,IAAA,aAAI,EAAC,cAAc,CAAC;IACpB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gEAAgE;QACzE,WAAW,EACT,sPAAsP;KACzP,CAAC;IACe,WAAA,IAAA,cAAK,GAAE,CAAA;IAA2B,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAxB,mCAAe,EAAe,2BAAW;;qDAGzE;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oDAAoD;QAC7D,WAAW,EACT,qLAAqL;KACxL,CAAC;IACc,WAAA,IAAA,cAAK,GAAE,CAAA;IAA2B,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAxB,mCAAe,EAAe,6BAAY;;oDAMzE;AAOK;IALL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;kDAO5C;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EACT,mhBAAmhB;KACthB,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;kDAe5C;+BAzFU,oBAAoB;IAHhC,IAAA,iBAAO,EAAC,gBAAgB,CAAC;IACzB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,kBAAkB,CAAC;qCAGU,yCAAkB;QACxB,4BAAY;QACP,uCAAiB;GAJ5C,oBAAoB,CA0FhC"}

package/dist/admin/controllers/admin.tenant.user.controller.d.ts

@@ -7,15 +7,22 @@ import { AdminAccessService } from '../services/admin.access.service';
 import { TenantService } from '../../tenant/services/tenant.service';
 import { TenantUserOnboardedMailJob } from '../../notification/jobs/tenant.user.onboarded.mail.job';
 import { ListFilterService } from '../../common/services/list.filter.service';
+import { TenantMembershipService } from '../../auth/services/tenant.membership.service';
+import { AddClientMembershipDto } from '../dtos/add.client.membership.dto';
 export declare class AdminTenantUserController {
     protected readonly adminAccessService: AdminAccessService;
     protected readonly tenantService: TenantService;
     protected readonly tenantUserOnboardedMailJob: TenantUserOnboardedMailJob;
     private readonly listFilterService;
-    constructor(adminAccessService: AdminAccessService, tenantService: TenantService, tenantUserOnboardedMailJob: TenantUserOnboardedMailJob, listFilterService: ListFilterService);
+    private readonly tenantMembershipService;
+    constructor(adminAccessService: AdminAccessService, tenantService: TenantService, tenantUserOnboardedMailJob: TenantUserOnboardedMailJob, listFilterService: ListFilterService, tenantMembershipService: TenantMembershipService);
     clientUserDetail({ id }: CommonParamsDto): Promise<UserEntity>;
     addClientUser(dto: AddClientUserDto): Promise<UserEntity>;
     addClientUsersBulk(dto: AddBulkUsersDto): Promise<import("../types/admin.types").BulkUserResult>;
+    addMembership(dto: AddClientMembershipDto): Promise<import("../..").TenantUserEntity>;
+    deactivateMembership(id: string, tenantId: string): Promise<import("../..").TenantUserEntity>;
+    reactivateMembership(id: string, tenantId: string): Promise<import("../..").TenantUserEntity>;
+    removeMembership(id: string, tenantId: string): Promise<import("../..").DeleteResult>;
     listClientUsers(dto: ClientUserListDto): Promise<import("../..").CommonListResult>;
     removeClientUser(id: string): Promise<import("../..").DeleteResult>;
 }

package/dist/admin/controllers/admin.tenant.user.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.tenant.user.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.tenant.user.controller.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAKjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAE9E,qBACa,yBAAyB;IAElC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB;IACzD,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa;IAC/C,SAAS,CAAC,QAAQ,CAAC,0BAA0B,EAAE,0BAA0B;IACzE,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAHf,kBAAkB,EAAE,kBAAkB,EACtC,aAAa,EAAE,aAAa,EAC5B,0BAA0B,EAAE,0BAA0B,EACxD,iBAAiB,EAAE,iBAAiB;IASjD,gBAAgB,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAkBjD,aAAa,CAAS,GAAG,EAAE,gBAAgB;IAa3C,kBAAkB,CAAS,GAAG,EAAE,eAAe;IAW/C,eAAe,CAAS,GAAG,EAAE,iBAAiB;IAW9C,gBAAgB,CAA6B,EAAE,EAAE,MAAM;CAI9D"}
+{"version":3,"file":"admin.tenant.user.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.tenant.user.controller.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAKjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAC;AACxF,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAG3E,qBACa,yBAAyB;IAElC,SAAS,CAAC,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB;IACzD,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa;IAC/C,SAAS,CAAC,QAAQ,CAAC,0BAA0B,EAAE,0BAA0B;IACzE,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;gBAJrB,kBAAkB,EAAE,kBAAkB,EACtC,aAAa,EAAE,aAAa,EAC5B,0BAA0B,EAAE,0BAA0B,EACxD,iBAAiB,EAAE,iBAAiB,EACpC,uBAAuB,EAAE,uBAAuB;IAS7D,gBAAgB,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAkBjD,aAAa,CAAS,GAAG,EAAE,gBAAgB;IAa3C,kBAAkB,CAAS,GAAG,EAAE,eAAe;IAW/C,aAAa,CAAS,GAAG,EAAE,sBAAsB;IAWjD,oBAAoB,CACI,EAAE,EAAE,MAAM,EACJ,QAAQ,EAAE,MAAM;IAiB9C,oBAAoB,CACI,EAAE,EAAE,MAAM,EACJ,QAAQ,EAAE,MAAM;IAkB9C,gBAAgB,CACQ,EAAE,EAAE,MAAM,EACJ,QAAQ,EAAE,MAAM;IAiB9C,eAAe,CAAS,GAAG,EAAE,iBAAiB;IAW9C,gBAAgB,CAA6B,EAAE,EAAE,MAAM;CAI9D"}

package/dist/admin/controllers/admin.tenant.user.controller.js

@@ -29,18 +29,22 @@ const admin_access_service_1 = require("../services/admin.access.service");
 const tenant_service_1 = require("../../tenant/services/tenant.service");
 const tenant_user_onboarded_mail_job_1 = require("../../notification/jobs/tenant.user.onboarded.mail.job");
 const list_filter_service_1 = require("../../common/services/list.filter.service");
+const tenant_membership_service_1 = require("../../auth/services/tenant.membership.service");
+const add_client_membership_dto_1 = require("../dtos/add.client.membership.dto");
+const client_membership_data_processor_1 = require("../libraries/client.membership.data.processor");
 let AdminTenantUserController = class AdminTenantUserController {
-    constructor(adminAccessService, tenantService, tenantUserOnboardedMailJob, listFilterService) {
+    constructor(adminAccessService, tenantService, tenantUserOnboardedMailJob, listFilterService, tenantMembershipService) {
         this.adminAccessService = adminAccessService;
         this.tenantService = tenantService;
         this.tenantUserOnboardedMailJob = tenantUserOnboardedMailJob;
         this.listFilterService = listFilterService;
+        this.tenantMembershipService = tenantMembershipService;
     }
     async clientUserDetail({ id }) {
         await this.adminAccessService.validateContentReader();
         const user = await user_entity_1.UserEntity.findOne({
             where: { id, user_type: user_type_enum_1.UserType.TENANT_USER },
-            relations: { organization: true, userRoles: { role: true } },
+            relations: { memberships: { tenant: true }, userRoles: { role: true } },
         });
         if (!user)
             throw new common_1.NotFoundException('No client user exists for this id');
@@ -54,6 +58,22 @@ let AdminTenantUserController = class AdminTenantUserController {
         await this.adminAccessService.validateAdmin();
         return new bulk_user_data_processor_1.BulkUserDataProcessor(this.tenantService).process(dto);
     }
+    async addMembership(dto) {
+        await this.adminAccessService.validateAdmin();
+        return new client_membership_data_processor_1.ClientMembershipDataProcessor(this.tenantService).process(dto);
+    }
+    async deactivateMembership(id, tenantId) {
+        await this.adminAccessService.validateAdmin();
+        return this.tenantMembershipService.setMemberActive(id, tenantId, false, undefined, false);
+    }
+    async reactivateMembership(id, tenantId) {
+        await this.adminAccessService.validateAdmin();
+        return this.tenantMembershipService.setMemberActive(id, tenantId, true, undefined, false);
+    }
+    async removeMembership(id, tenantId) {
+        const { user } = await this.adminAccessService.validateAdmin();
+        return this.tenantMembershipService.removeMember(id, tenantId, user.id, false);
+    }
     async listClientUsers(dto) {
         await this.adminAccessService.validateContentReader();
         return new client_user_list_processor_1.ClientUserListProcessor(this.listFilterService).process(dto);
@@ -68,7 +88,7 @@ __decorate([
     (0, common_1.Get)(':id'),
     (0, swagger_1.ApiOperation)({
         summary: 'One client (tenant-scoped) user, in full.',
-        description: "Carries the user's tenant name and current role grants alongside everything the listing leaves out. The grants matter for editing: a save reconciles `role_ids` against them and revokes whatever the payload omits, so an edit form has to start from this list. Requires at least the global content reader role.",
+        description: "Carries the user's memberships (each with its tenant) and role grants (each with its `tenant_id`) alongside everything the listing leaves out. The grants matter for editing: a save reconciles one tenant's `role_ids` against them and revokes whatever the payload omits, so an edit form has to start from this list. Requires at least the global content reader role.",
     }),
     __param(0, (0, common_1.Param)()),
     __metadata("design:type", Function),
@@ -79,7 +99,7 @@ __decorate([
     (0, common_1.Post)(),
     (0, swagger_1.ApiOperation)({
         summary: 'Register a single client (tenant-scoped) user, or update one.',
-        description: 'Send an `id` to edit that user; omit it to register a new one. `password` is required only when creating. `role_ids` replaces the current grants, so an edit must send the full set (read them from `GET :id`). `tenant_id` is not applied on an edit — a user does not move between tenants. Requires at least the global admin role.',
+        description: "Send an `id` to edit that user; omit it to register a new one as a member of `tenant_id`. `password` is required only when creating. `role_ids` replaces the grants held in `tenant_id`, so an edit must send that tenant's full set (read them from `GET :id`). On an edit `tenant_id` must be one of the user's memberships; others are untouched. Requires at least the global admin role.",
     }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
@@ -97,11 +117,58 @@ __decorate([
     __metadata("design:paramtypes", [add_bulk_users_dto_1.AddBulkUsersDto]),
     __metadata("design:returntype", Promise)
 ], AdminTenantUserController.prototype, "addClientUsersBulk", null);
+__decorate([
+    (0, common_1.Post)('memberships'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Add an existing client user to another tenant.',
+        description: 'Creates the membership and grants `role_ids` in that tenant. Refused when the user is already a member. Requires at least the global admin role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [add_client_membership_dto_1.AddClientMembershipDto]),
+    __metadata("design:returntype", Promise)
+], AdminTenantUserController.prototype, "addMembership", null);
+__decorate([
+    (0, common_1.Post)(':id/memberships/:tenantId/deactivate'),
+    (0, swagger_1.ApiOperation)({
+        summary: "Deactivate a client user's membership of one tenant.",
+        description: "Roles are kept; the user's credentials bound to the tenant are revoked and it can no longer be worked in. Reversible. Requires at least the global admin role.",
+    }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __param(1, (0, common_1.Param)('tenantId', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:returntype", Promise)
+], AdminTenantUserController.prototype, "deactivateMembership", null);
+__decorate([
+    (0, common_1.Post)(':id/memberships/:tenantId/reactivate'),
+    (0, swagger_1.ApiOperation)({
+        summary: "Reactivate a client user's membership of one tenant.",
+        description: 'Requires at least the global admin role.',
+    }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __param(1, (0, common_1.Param)('tenantId', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:returntype", Promise)
+], AdminTenantUserController.prototype, "reactivateMembership", null);
+__decorate([
+    (0, common_1.Delete)(':id/memberships/:tenantId'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Remove a client user from one tenant.',
+        description: "Ends that membership and its roles and revokes the user's credentials bound to the tenant; the account and its other memberships stay. Requires at least the global admin role.",
+    }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __param(1, (0, common_1.Param)('tenantId', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:returntype", Promise)
+], AdminTenantUserController.prototype, "removeMembership", null);
 __decorate([
     (0, common_1.Post)('list'),
     (0, swagger_1.ApiOperation)({
         summary: 'List, search and filter client (tenant-scoped) users.',
-        description: 'Scoped to tenant users and joined to their tenant, so rows carry `tenant_name` alongside `tenant_id`. Requires the global super admin role.',
+        description: 'Scoped to tenant users, one row per membership, joined to its tenant so rows carry `membership_id` and `tenant_name` alongside `tenant_id`. A user in no tenant appears once with no tenant. Requires the global super admin role.',
     }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
@@ -112,7 +179,7 @@ __decorate([
     (0, common_1.Delete)(':id'),
     (0, swagger_1.ApiOperation)({
         summary: 'Delete a client user.',
-        description: "Soft delete, with the user's sessions and refresh tokens revoked in the same transaction so tokens already issued stop working immediately. Requires the global admin role.",
+        description: "Soft delete of the user and every membership, with the user's sessions and refresh tokens revoked in the same transaction so tokens already issued stop working immediately. Requires the global admin role.",
     }),
     __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
     __metadata("design:type", Function),
@@ -124,6 +191,7 @@ exports.AdminTenantUserController = AdminTenantUserController = __decorate([
     __metadata("design:paramtypes", [admin_access_service_1.AdminAccessService,
         tenant_service_1.TenantService,
         tenant_user_onboarded_mail_job_1.TenantUserOnboardedMailJob,
-        list_filter_service_1.ListFilterService])
+        list_filter_service_1.ListFilterService,
+        tenant_membership_service_1.TenantMembershipService])
 ], AdminTenantUserController);
 //# sourceMappingURL=admin.tenant.user.controller.js.map

package/dist/admin/controllers/admin.tenant.user.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.tenant.user.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.tenant.user.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAA+C;AAC/C,iEAA6D;AAC7D,oEAA2D;AAC3D,2EAAsE;AACtE,mEAA6D;AAC7D,qEAA+D;AAC/D,uEAAiE;AACjE,oFAA8E;AAC9E,wFAAkF;AAClF,4FAAsF;AACtF,wFAAkF;AAClF,2EAAsE;AACtE,yEAAqE;AACrE,2GAAoG;AACpG,mFAA8E;AAGvE,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACpC,YACqB,kBAAsC,EACtC,aAA4B,EAC5B,0BAAsD,EACxD,iBAAoC;QAHlC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,kBAAa,GAAb,aAAa,CAAe;QAC5B,+BAA0B,GAA1B,0BAA0B,CAA4B;QACxD,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,gBAAgB,CAAU,EAAE,EAAE,EAAmB;QACrD,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,wBAAU,CAAC,OAAO,CAAC;YACpC,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,yBAAQ,CAAC,WAAW,EAAE;YAC9C,SAAS,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;SAC7D,CAAC,CAAC;QACH,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,mCAAmC,CAAC,CAAC;QAE5E,OAAO,IAAI,CAAC;IACd,CAAC;IAQK,AAAN,KAAK,CAAC,aAAa,CAAS,GAAqB;QAC/C,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC9C,OAAO,IAAI,oDAAuB,CAChC,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,0BAA0B,CAChC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAOK,AAAN,KAAK,CAAC,kBAAkB,CAAS,GAAoB;QACnD,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC9C,OAAO,IAAI,gDAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAQK,AAAN,KAAK,CAAC,eAAe,CAAS,GAAsB;QAClD,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,oDAAuB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC;IAQK,AAAN,KAAK,CAAC,gBAAgB,CAA6B,EAAU;QAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,wDAAyB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;CACF,CAAA;AAvEY,8DAAyB;AAc9B;IANL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,qTAAqT;KACxT,CAAC;IACsB,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;iEAUtD;AAQK;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+DAA+D;QACxE,WAAW,EACT,wUAAwU;KAC3U,CAAC;IACmB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,sCAAgB;;8DAMhD;AAOK;IALL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,uCAAuC;KACrD,CAAC;IACwB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,oCAAe;;mEAGpD;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uDAAuD;QAChE,WAAW,EACT,6IAA6I;KAChJ,CAAC;IACqB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,wCAAiB;;gEAGnD;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,6KAA6K;KAChL,CAAC;IACsB,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;iEAGjD;oCAtEU,yBAAyB;IADrC,IAAA,mBAAU,EAAC,wBAAwB,CAAC;qCAGM,yCAAkB;QACvB,8BAAa;QACA,2DAA0B;QACrC,uCAAiB;GAL5C,yBAAyB,CAuErC"}
+{"version":3,"file":"admin.tenant.user.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.tenant.user.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAA+C;AAC/C,iEAA6D;AAC7D,oEAA2D;AAC3D,2EAAsE;AACtE,mEAA6D;AAC7D,qEAA+D;AAC/D,uEAAiE;AACjE,oFAA8E;AAC9E,wFAAkF;AAClF,4FAAsF;AACtF,wFAAkF;AAClF,2EAAsE;AACtE,yEAAqE;AACrE,2GAAoG;AACpG,mFAA8E;AAC9E,6FAAwF;AACxF,iFAA2E;AAC3E,oGAA8F;AAGvF,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACpC,YACqB,kBAAsC,EACtC,aAA4B,EAC5B,0BAAsD,EACxD,iBAAoC,EACpC,uBAAgD;QAJ9C,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,kBAAa,GAAb,aAAa,CAAe;QAC5B,+BAA0B,GAA1B,0BAA0B,CAA4B;QACxD,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,4BAAuB,GAAvB,uBAAuB,CAAyB;IAChE,CAAC;IAQE,AAAN,KAAK,CAAC,gBAAgB,CAAU,EAAE,EAAE,EAAmB;QACrD,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,wBAAU,CAAC,OAAO,CAAC;YACpC,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,yBAAQ,CAAC,WAAW,EAAE;YAC9C,SAAS,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;SACxE,CAAC,CAAC;QACH,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,0BAAiB,CAAC,mCAAmC,CAAC,CAAC;QAE5E,OAAO,IAAI,CAAC;IACd,CAAC;IAQK,AAAN,KAAK,CAAC,aAAa,CAAS,GAAqB;QAC/C,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC9C,OAAO,IAAI,oDAAuB,CAChC,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,0BAA0B,CAChC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAOK,AAAN,KAAK,CAAC,kBAAkB,CAAS,GAAoB;QACnD,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC9C,OAAO,IAAI,gDAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAQK,AAAN,KAAK,CAAC,aAAa,CAAS,GAA2B;QACrD,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC9C,OAAO,IAAI,gEAA6B,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5E,CAAC;IAQK,AAAN,KAAK,CAAC,oBAAoB,CACI,EAAU,EACJ,QAAgB;QAElD,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CACjD,EAAE,EACF,QAAQ,EACR,KAAK,EACL,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAOK,AAAN,KAAK,CAAC,oBAAoB,CACI,EAAU,EACJ,QAAgB;QAElD,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CACjD,EAAE,EACF,QAAQ,EACR,IAAI,EACJ,SAAS,EACT,KAAK,CACN,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,gBAAgB,CACQ,EAAU,EACJ,QAAgB;QAElD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAC9C,EAAE,EACF,QAAQ,EACR,IAAI,CAAC,EAAE,EACP,KAAK,CACN,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,eAAe,CAAS,GAAsB;QAClD,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,oDAAuB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC;IAQK,AAAN,KAAK,CAAC,gBAAgB,CAA6B,EAAU;QAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,wDAAyB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC;CACF,CAAA;AA7IY,8DAAyB;AAe9B;IANL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,6WAA6W;KAChX,CAAC;IACsB,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;iEAUtD;AAQK;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+DAA+D;QACxE,WAAW,EACT,+XAA+X;KAClY,CAAC;IACmB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,sCAAgB;;8DAMhD;AAOK;IALL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,uCAAuC;KACrD,CAAC;IACwB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,oCAAe;;mEAGpD;AAQK;IANL,IAAA,aAAI,EAAC,aAAa,CAAC;IACnB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EACT,kJAAkJ;KACrJ,CAAC;IACmB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,kDAAsB;;8DAGtD;AAQK;IANL,IAAA,aAAI,EAAC,sCAAsC,CAAC;IAC5C,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,sDAAsD;QAC/D,WAAW,EACT,gKAAgK;KACnK,CAAC;IAEC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAC1B,WAAA,IAAA,cAAK,EAAC,UAAU,EAAE,sBAAa,CAAC,CAAA;;;;qEAUlC;AAOK;IALL,IAAA,aAAI,EAAC,sCAAsC,CAAC;IAC5C,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,sDAAsD;QAC/D,WAAW,EAAE,0CAA0C;KACxD,CAAC;IAEC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAC1B,WAAA,IAAA,cAAK,EAAC,UAAU,EAAE,sBAAa,CAAC,CAAA;;;;qEAUlC;AAQK;IANL,IAAA,eAAM,EAAC,2BAA2B,CAAC;IACnC,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uCAAuC;QAChD,WAAW,EACT,iLAAiL;KACpL,CAAC;IAEC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAC1B,WAAA,IAAA,cAAK,EAAC,UAAU,EAAE,sBAAa,CAAC,CAAA;;;;iEASlC;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uDAAuD;QAChE,WAAW,EACT,oOAAoO;KACvO,CAAC;IACqB,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,wCAAiB;;gEAGnD;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uBAAuB;QAChC,WAAW,EACT,8MAA8M;KACjN,CAAC;IACsB,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;iEAGjD;oCA5IU,yBAAyB;IADrC,IAAA,mBAAU,EAAC,wBAAwB,CAAC;qCAGM,yCAAkB;QACvB,8BAAa;QACA,2DAA0B;QACrC,uCAAiB;QACX,mDAAuB;GANxD,yBAAyB,CA6IrC"}

package/dist/admin/dtos/add.client.membership.dto.d.ts

@@ -0,0 +1,6 @@
+export declare class AddClientMembershipDto {
+    user_id: string;
+    tenant_id: string;
+    role_ids?: string[];
+}
+//# sourceMappingURL=add.client.membership.dto.d.ts.map

package/dist/admin/dtos/add.client.membership.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.client.membership.dto.d.ts","sourceRoot":"","sources":["../../../src/admin/dtos/add.client.membership.dto.ts"],"names":[],"mappings":"AAIA,qBAAa,sBAAsB;IAIjC,OAAO,EAAE,MAAM,CAAC;IAKhB,SAAS,EAAE,MAAM,CAAC;IAUlB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB"}