@neohm/nestend 4.0.1 → 4.1.0

package/dist/auth/controllers/impersonation.controller.d.ts

@@ -2,11 +2,11 @@ import type { Request } from 'express';
 import { TenantEntity } from '../../tenant/entities/tenant.entity';
 import { ImpersonationLoginDto } from '../dtos/impersonation.login.dto';
 import { ImpersonationService } from '../services/impersonation.service';
-import { ImpersonationSession } from '../types/auth.types';
+import { OrganizationSession } from '../types/auth.types';
 export declare class ImpersonationController {
     private readonly impersonationService;
     constructor(impersonationService: ImpersonationService);
-    login(dto: ImpersonationLoginDto, request: Request): Promise<ImpersonationSession>;
+    login(dto: ImpersonationLoginDto, request: Request): Promise<OrganizationSession>;
     tenants(): Promise<TenantEntity[]>;
     private contextOf;
 }

package/dist/auth/controllers/impersonation.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"impersonation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/impersonation.controller.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAqB,MAAM,qBAAqB,CAAC;AAE9E,qBAEa,uBAAuB;IACtB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;gBAApB,oBAAoB,EAAE,oBAAoB;IAQjE,KAAK,CACD,GAAG,EAAE,qBAAqB,EAC3B,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,oBAAoB,CAAC;IAW1B,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAIxC,OAAO,CAAC,SAAS;CAMlB"}
+{"version":3,"file":"impersonation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/impersonation.controller.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAqB,MAAM,qBAAqB,CAAC;AAE7E,qBAEa,uBAAuB;IACtB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;gBAApB,oBAAoB,EAAE,oBAAoB;IAQjE,KAAK,CACD,GAAG,EAAE,qBAAqB,EAC3B,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,mBAAmB,CAAC;IAWzB,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAIxC,OAAO,CAAC,SAAS;CAMlB"}

package/dist/auth/controllers/tenant.invitation.controller.d.ts

@@ -0,0 +1,18 @@
+import { CommonParamsDto } from '../../common/dtos/common.params.dto';
+import { ListFilterService } from '../../common/services/list.filter.service';
+import { InviteTenantUserDto } from '../dtos/invite.tenant.user.dto';
+import { TenantInvitationListDto } from '../dtos/tenant.invitation.list.dto';
+import { AuthService } from '../services/auth.service';
+import { TenantInvitationService } from '../services/tenant.invitation.service';
+export declare class TenantInvitationController {
+    private readonly authService;
+    private readonly tenantInvitationService;
+    private readonly listFilterService;
+    constructor(authService: AuthService, tenantInvitationService: TenantInvitationService, listFilterService: ListFilterService);
+    invite(dto: InviteTenantUserDto): Promise<import("../..").TenantInvitationEntity>;
+    roles(): Promise<import("../..").SystemRoleEntity[]>;
+    list(dto: TenantInvitationListDto): Promise<import("../..").CommonListResult>;
+    resend({ id }: CommonParamsDto): Promise<import("../..").TenantInvitationEntity>;
+    revoke({ id }: CommonParamsDto): Promise<import("../..").TenantInvitationEntity>;
+}
+//# sourceMappingURL=tenant.invitation.controller.d.ts.map

package/dist/auth/controllers/tenant.invitation.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.invitation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.invitation.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAI7E,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,qBAGa,0BAA0B;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB,EAChD,iBAAiB,EAAE,iBAAiB;IASjD,MAAM,CAAS,GAAG,EAAE,mBAAmB;IAgBvC,KAAK;IAUL,IAAI,CAAS,GAAG,EAAE,uBAAuB;IAgBzC,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAgBvC,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;CAU9C"}

package/dist/auth/controllers/tenant.invitation.controller.js

@@ -0,0 +1,120 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantInvitationController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const common_params_dto_1 = require("../../common/dtos/common.params.dto");
+const list_filter_service_1 = require("../../common/services/list.filter.service");
+const invite_tenant_user_dto_1 = require("../dtos/invite.tenant.user.dto");
+const tenant_invitation_list_dto_1 = require("../dtos/tenant.invitation.list.dto");
+const tenant_role_enum_1 = require("../enums/tenant.role.enum");
+const tenant_invitation_data_processor_1 = require("../processors/tenant.invitation.data.processor");
+const tenant_invitation_list_processor_1 = require("../processors/tenant.invitation.list.processor");
+const auth_service_1 = require("../services/auth.service");
+const tenant_invitation_service_1 = require("../services/tenant.invitation.service");
+let TenantInvitationController = class TenantInvitationController {
+    constructor(authService, tenantInvitationService, listFilterService) {
+        this.authService = authService;
+        this.tenantInvitationService = tenantInvitationService;
+        this.listFilterService = listFilterService;
+    }
+    async invite(dto) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return new tenant_invitation_data_processor_1.TenantInvitationDataProcessor(user, this.tenantInvitationService).process(dto);
+    }
+    async roles() {
+        await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return this.tenantInvitationService.grantableRoles();
+    }
+    async list(dto) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return new tenant_invitation_list_processor_1.TenantInvitationListProcessor(this.listFilterService).process({
+            ...dto,
+            tenant_id: user.organization_id,
+        });
+    }
+    async resend({ id }) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return this.tenantInvitationService.resend(id, user.organization_id, user.id);
+    }
+    async revoke({ id }) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return this.tenantInvitationService.revoke(id, user.organization_id, user.id);
+    }
+};
+exports.TenantInvitationController = TenantInvitationController;
+__decorate([
+    (0, common_1.Post)(),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Invite an email into the session organization.',
+        description: 'The roles in `role_ids` are granted in this organization when the invitee accepts. An email with no account gets one — named `full_name`, with a random one-time password mailed to it that must be changed at first sign-in. Refused for an existing member, a system account, or an email with a pending invitation here. Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [invite_tenant_user_dto_1.InviteTenantUserDto]),
+    __metadata("design:returntype", Promise)
+], TenantInvitationController.prototype, "invite", null);
+__decorate([
+    (0, common_1.Get)('roles'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Roles an invitation may grant.',
+        description: 'The active `sys_roles` catalogue, for the invite form. Requires the `global.admin` tenant role.',
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], TenantInvitationController.prototype, "roles", null);
+__decorate([
+    (0, common_1.Post)('list'),
+    (0, swagger_1.ApiOperation)({
+        summary: "List the session organization's invitations.",
+        description: 'Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [tenant_invitation_list_dto_1.TenantInvitationListDto]),
+    __metadata("design:returntype", Promise)
+], TenantInvitationController.prototype, "list", null);
+__decorate([
+    (0, common_1.Post)(':id/resend'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Give a pending invitation a fresh expiry.',
+        description: 'Also revives one that expired unanswered. When the invitation created the account and nobody has signed in to it yet, a fresh one-time password is mailed. Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:returntype", Promise)
+], TenantInvitationController.prototype, "resend", null);
+__decorate([
+    (0, common_1.Delete)(':id'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Revoke a pending invitation.',
+        description: 'Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:returntype", Promise)
+], TenantInvitationController.prototype, "revoke", null);
+exports.TenantInvitationController = TenantInvitationController = __decorate([
+    (0, swagger_1.ApiTags)('Organization Invitations'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('api/organization/invitations'),
+    __metadata("design:paramtypes", [auth_service_1.AuthService,
+        tenant_invitation_service_1.TenantInvitationService,
+        list_filter_service_1.ListFilterService])
+], TenantInvitationController);
+//# sourceMappingURL=tenant.invitation.controller.js.map

package/dist/auth/controllers/tenant.invitation.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.invitation.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.invitation.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4E;AAC5E,6CAAuE;AACvE,2EAAsE;AACtE,mFAA8E;AAC9E,2EAAqE;AACrE,mFAA6E;AAC7E,gEAAuD;AACvD,qGAA+F;AAC/F,qGAA+F;AAC/F,2DAAuD;AACvD,qFAAgF;AAMzE,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YACmB,WAAwB,EACxB,uBAAgD,EAChD,iBAAoC;QAFpC,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,MAAM,CAAS,GAAwB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,gEAA6B,CACtC,IAAI,EACJ,IAAI,CAAC,uBAAuB,CAC7B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAQK,AAAN,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,6BAAU,CAAC,YAAY,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,CAAC;IACvD,CAAC;IAOK,AAAN,KAAK,CAAC,IAAI,CAAS,GAA4B;QAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,gEAA6B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;YACvE,GAAG,GAAG;YACN,SAAS,EAAE,IAAI,CAAC,eAAe;SAChC,CAAC,CAAC;IACL,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACxC,EAAE,EACF,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAOK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACxC,EAAE,EACF,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;CACF,CAAA;AAjFY,gEAA0B;AAa/B;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EACT,sWAAsW;KACzW,CAAC;IACY,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,4CAAmB;;wDAQ5C;AAQK;IANL,IAAA,YAAG,EAAC,OAAO,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,iGAAiG;KACpG,CAAC;;;;uDAID;AAOK;IALL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,0CAA0C;KACxD,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,oDAAuB;;sDAQ9C;AAQK;IANL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,qMAAqM;KACxM,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;wDAS5C;AAOK;IALL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,0CAA0C;KACxD,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;wDAS5C;qCAhFU,0BAA0B;IAHtC,IAAA,iBAAO,EAAC,0BAA0B,CAAC;IACnC,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,8BAA8B,CAAC;qCAGT,0BAAW;QACC,mDAAuB;QAC7B,uCAAiB;GAJ5C,0BAA0B,CAiFtC"}

package/dist/auth/controllers/tenant.member.controller.d.ts

@@ -0,0 +1,18 @@
+import { ListFilterService } from '../../common/services/list.filter.service';
+import { MemberRolesDto } from '../dtos/member.roles.dto';
+import { TenantMemberListDto } from '../dtos/tenant.member.list.dto';
+import { AuthService } from '../services/auth.service';
+import { TenantMembershipService } from '../services/tenant.membership.service';
+export declare class TenantMemberController {
+    private readonly authService;
+    private readonly tenantMembershipService;
+    private readonly listFilterService;
+    constructor(authService: AuthService, tenantMembershipService: TenantMembershipService, listFilterService: ListFilterService);
+    list(dto: TenantMemberListDto): Promise<import("../..").CommonListResult>;
+    setRoles(userId: string, dto: MemberRolesDto): Promise<import("../..").SystemRoleEntity[]>;
+    deactivate(userId: string): Promise<import("../..").TenantUserEntity>;
+    reactivate(userId: string): Promise<import("../..").TenantUserEntity>;
+    remove(userId: string): Promise<import("../..").DeleteResult>;
+    private refuseSelf;
+}
+//# sourceMappingURL=tenant.member.controller.d.ts.map

package/dist/auth/controllers/tenant.member.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.member.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.member.controller.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAGrE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,qBAGa,sBAAsB;IAE/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB,EAChD,iBAAiB,EAAE,iBAAiB;IASjD,IAAI,CAAS,GAAG,EAAE,mBAAmB;IAgBrC,QAAQ,CACoB,MAAM,EAAE,MAAM,EACtC,GAAG,EAAE,cAAc;IAoBvB,UAAU,CAAiC,MAAM,EAAE,MAAM;IAoBzD,UAAU,CAAiC,MAAM,EAAE,MAAM;IAkBzD,MAAM,CAAiC,MAAM,EAAE,MAAM;IAa3D,OAAO,CAAC,UAAU;CAMnB"}

package/dist/auth/controllers/tenant.member.controller.js

@@ -0,0 +1,129 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantMemberController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const list_filter_service_1 = require("../../common/services/list.filter.service");
+const operation_exception_1 = require("../../global/exceptions/operation.exception");
+const member_roles_dto_1 = require("../dtos/member.roles.dto");
+const tenant_member_list_dto_1 = require("../dtos/tenant.member.list.dto");
+const tenant_role_enum_1 = require("../enums/tenant.role.enum");
+const tenant_member_list_processor_1 = require("../processors/tenant.member.list.processor");
+const auth_service_1 = require("../services/auth.service");
+const tenant_membership_service_1 = require("../services/tenant.membership.service");
+let TenantMemberController = class TenantMemberController {
+    constructor(authService, tenantMembershipService, listFilterService) {
+        this.authService = authService;
+        this.tenantMembershipService = tenantMembershipService;
+        this.listFilterService = listFilterService;
+    }
+    async list(dto) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return new tenant_member_list_processor_1.TenantMemberListProcessor(this.listFilterService).process({
+            ...dto,
+            tenant_id: user.organization_id,
+        });
+    }
+    async setRoles(userId, dto) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return this.tenantMembershipService.setMemberRoles(userId, user.organization_id, dto.role_ids, user.id);
+    }
+    async deactivate(userId) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        this.refuseSelf(userId, user.id);
+        return this.tenantMembershipService.setMemberActive(userId, user.organization_id, false, user.id);
+    }
+    async reactivate(userId) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return this.tenantMembershipService.setMemberActive(userId, user.organization_id, true, user.id);
+    }
+    async remove(userId) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        this.refuseSelf(userId, user.id);
+        return this.tenantMembershipService.removeMember(userId, user.organization_id, user.id);
+    }
+    refuseSelf(userId, callerId) {
+        if (userId === callerId)
+            throw new operation_exception_1.OperationException('Act on your own membership by leaving the organization.');
+    }
+};
+exports.TenantMemberController = TenantMemberController;
+__decorate([
+    (0, common_1.Post)('list'),
+    (0, swagger_1.ApiOperation)({
+        summary: "List the session organization's members.",
+        description: 'Each row carries the roles held in this organization. Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [tenant_member_list_dto_1.TenantMemberListDto]),
+    __metadata("design:returntype", Promise)
+], TenantMemberController.prototype, "list", null);
+__decorate([
+    (0, common_1.Post)(':userId/roles'),
+    (0, swagger_1.ApiOperation)({
+        summary: "Replace a member's roles in the session organization.",
+        description: '`role_ids` is the complete set; omitted roles are revoked. Refused when it would leave the organization without a `global.admin`. Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Param)('userId', common_1.ParseUUIDPipe)),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, member_roles_dto_1.MemberRolesDto]),
+    __metadata("design:returntype", Promise)
+], TenantMemberController.prototype, "setRoles", null);
+__decorate([
+    (0, common_1.Post)(':userId/deactivate'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: "Deactivate a member's membership of the session organization.",
+        description: 'The member keeps their roles but can no longer work in this organization, and their credentials bound to it are revoked. Their account and other memberships are untouched. Not for the caller, and refused for the last active `global.admin`. Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Param)('userId', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], TenantMemberController.prototype, "deactivate", null);
+__decorate([
+    (0, common_1.Post)(':userId/reactivate'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: "Reactivate a member's membership of the session organization.",
+        description: 'Restores it with the roles it kept. Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Param)('userId', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], TenantMemberController.prototype, "reactivate", null);
+__decorate([
+    (0, common_1.Delete)(':userId'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Remove a member from the session organization.',
+        description: 'Ends the membership and its roles and revokes their credentials bound to this organization; the account and its other memberships stay. Not for the caller — use `POST /auth/organizations/:id/leave`. Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Param)('userId', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], TenantMemberController.prototype, "remove", null);
+exports.TenantMemberController = TenantMemberController = __decorate([
+    (0, swagger_1.ApiTags)('Organization Members'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('api/organization/members'),
+    __metadata("design:paramtypes", [auth_service_1.AuthService,
+        tenant_membership_service_1.TenantMembershipService,
+        list_filter_service_1.ListFilterService])
+], TenantMemberController);
+//# sourceMappingURL=tenant.member.controller.js.map

package/dist/auth/controllers/tenant.member.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.member.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.member.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAuE;AACvE,mFAA8E;AAC9E,qFAAiF;AACjF,+DAA0D;AAC1D,2EAAqE;AACrE,gEAAuD;AACvD,6FAAuF;AACvF,2DAAuD;AACvD,qFAAgF;AAMzE,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YACmB,WAAwB,EACxB,uBAAgD,EAChD,iBAAoC;QAFpC,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CAAS,GAAwB;QACzC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,wDAAyB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;YACnE,GAAG,GAAG;YACN,SAAS,EAAE,IAAI,CAAC,eAAe;SAChC,CAAC,CAAC;IACL,CAAC;IAQK,AAAN,KAAK,CAAC,QAAQ,CACoB,MAAc,EACtC,GAAmB;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAChD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,GAAG,CAAC,QAAQ,EACZ,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,UAAU,CAAiC,MAAc;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CACjD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,KAAK,EACL,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,UAAU,CAAiC,MAAc;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CACjD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,IAAI,EACJ,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAiC,MAAc;QACzD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAC9C,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAGO,UAAU,CAAC,MAAc,EAAE,QAAgB;QACjD,IAAI,MAAM,KAAK,QAAQ;YACrB,MAAM,IAAI,wCAAkB,CAC1B,yDAAyD,CAC1D,CAAC;IACN,CAAC;CACF,CAAA;AA5GY,wDAAsB;AAa3B;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0CAA0C;QACnD,WAAW,EACT,gGAAgG;KACnG,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,4CAAmB;;kDAQ1C;AAQK;IANL,IAAA,aAAI,EAAC,eAAe,CAAC;IACrB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uDAAuD;QAChE,WAAW,EACT,4KAA4K;KAC/K,CAAC;IAEC,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;IAC9B,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAM,iCAAc;;sDAW5B;AASK;IAPL,IAAA,aAAI,EAAC,oBAAoB,CAAC;IAC1B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+DAA+D;QACxE,WAAW,EACT,0RAA0R;KAC7R,CAAC;IACgB,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;wDAW/C;AASK;IAPL,IAAA,aAAI,EAAC,oBAAoB,CAAC;IAC1B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+DAA+D;QACxE,WAAW,EACT,8EAA8E;KACjF,CAAC;IACgB,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;wDAU/C;AAQK;IANL,IAAA,eAAM,EAAC,SAAS,CAAC;IACjB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EACT,iPAAiP;KACpP,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;oDAU3C;iCAnGU,sBAAsB;IAHlC,IAAA,iBAAO,EAAC,sBAAsB,CAAC;IAC/B,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,0BAA0B,CAAC;qCAGL,0BAAW;QACC,mDAAuB;QAC7B,uCAAiB;GAJ5C,sBAAsB,CA4GlC"}

package/dist/auth/controllers/user.invitation.controller.d.ts

@@ -0,0 +1,12 @@
+import { CommonParamsDto } from '../../common/dtos/common.params.dto';
+import { AuthService } from '../services/auth.service';
+import { TenantInvitationService } from '../services/tenant.invitation.service';
+export declare class UserInvitationController {
+    private readonly authService;
+    private readonly tenantInvitationService;
+    constructor(authService: AuthService, tenantInvitationService: TenantInvitationService);
+    pending(): Promise<import("../..").PendingInvitation[]>;
+    accept({ id }: CommonParamsDto): Promise<import("../..").OrganizationSummary>;
+    decline({ id }: CommonParamsDto): Promise<import("../..").TenantInvitationEntity>;
+}
+//# sourceMappingURL=user.invitation.controller.d.ts.map

package/dist/auth/controllers/user.invitation.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.invitation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/user.invitation.controller.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,qBAGa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;gBADvB,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB;IAS7D,OAAO;IAYP,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAOvC,OAAO,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;CAG/C"}

package/dist/auth/controllers/user.invitation.controller.js

@@ -0,0 +1,76 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserInvitationController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const common_params_dto_1 = require("../../common/dtos/common.params.dto");
+const auth_service_1 = require("../services/auth.service");
+const tenant_invitation_service_1 = require("../services/tenant.invitation.service");
+let UserInvitationController = class UserInvitationController {
+    constructor(authService, tenantInvitationService) {
+        this.authService = authService;
+        this.tenantInvitationService = tenantInvitationService;
+    }
+    async pending() {
+        const { user } = await this.authService.validateRole();
+        return this.tenantInvitationService.pendingFor(user);
+    }
+    async accept({ id }) {
+        return this.tenantInvitationService.accept(id);
+    }
+    async decline({ id }) {
+        return this.tenantInvitationService.decline(id);
+    }
+};
+exports.UserInvitationController = UserInvitationController;
+__decorate([
+    (0, common_1.Get)(),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Pending invitations addressed to the caller.',
+        description: 'Also returned by `GET /auth/me`. Works on a tenantless session, so a user with no organization yet can see and accept one.',
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], UserInvitationController.prototype, "pending", null);
+__decorate([
+    (0, common_1.Post)(':id/accept'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Accept an invitation and join its organization.',
+        description: 'Adds the membership and the invited roles, and returns the organization. The session stays where it is — call `POST /auth/organizations/switch` to work in the new one.',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:returntype", Promise)
+], UserInvitationController.prototype, "accept", null);
+__decorate([
+    (0, common_1.Post)(':id/decline'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({ summary: 'Decline an invitation.' }),
+    __param(0, (0, common_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:returntype", Promise)
+], UserInvitationController.prototype, "decline", null);
+exports.UserInvitationController = UserInvitationController = __decorate([
+    (0, swagger_1.ApiTags)('Auth'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('api/auth/invitations'),
+    __metadata("design:paramtypes", [auth_service_1.AuthService,
+        tenant_invitation_service_1.TenantInvitationService])
+], UserInvitationController);
+//# sourceMappingURL=user.invitation.controller.js.map

package/dist/auth/controllers/user.invitation.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.invitation.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/user.invitation.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,6CAAuE;AACvE,2EAAsE;AACtE,2DAAuD;AACvD,qFAAgF;AAMzE,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,WAAwB,EACxB,uBAAgD;QADhD,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;IAChE,CAAC;IAQE,AAAN,KAAK,CAAC,OAAO;QACX,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IASK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC;IAKK,AAAN,KAAK,CAAC,OAAO,CAAU,EAAE,EAAE,EAAmB;QAC5C,OAAO,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AAlCY,4DAAwB;AAY7B;IANL,IAAA,YAAG,GAAE;IACL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EACT,4HAA4H;KAC/H,CAAC;;;;uDAID;AASK;IAPL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iDAAiD;QAC1D,WAAW,EACT,yKAAyK;KAC5K,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;sDAE5C;AAKK;IAHL,IAAA,aAAI,EAAC,aAAa,CAAC;IACnB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACrC,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;uDAE7C;mCAjCU,wBAAwB;IAHpC,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,sBAAsB,CAAC;qCAGD,0BAAW;QACC,mDAAuB;GAHxD,wBAAwB,CAkCpC"}

package/dist/auth/controllers/user.organization.controller.d.ts

@@ -0,0 +1,17 @@
+import type { Request } from 'express';
+import { CommonParamsDto } from '../../common/dtos/common.params.dto';
+import { RefreshTokenDto } from '../dtos/refresh.token.dto';
+import { SwitchOrganizationDto } from '../dtos/switch.organization.dto';
+import { AuthService } from '../services/auth.service';
+import { TenantMembershipService } from '../services/tenant.membership.service';
+import { AuthTokenPair, OrganizationSession, OrganizationSummary } from '../types/auth.types';
+export declare class UserOrganizationController {
+    private readonly authService;
+    private readonly tenantMembershipService;
+    constructor(authService: AuthService, tenantMembershipService: TenantMembershipService);
+    organizations(): Promise<OrganizationSummary[]>;
+    switch(dto: SwitchOrganizationDto, request: Request): Promise<OrganizationSession>;
+    leave({ id }: CommonParamsDto, dto: RefreshTokenDto, request: Request): Promise<AuthTokenPair>;
+    private contextOf;
+}
+//# sourceMappingURL=user.organization.controller.d.ts.map

package/dist/auth/controllers/user.organization.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.organization.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/user.organization.controller.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EAEpB,MAAM,qBAAqB,CAAC;AAG7B,qBAGa,0BAA0B;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;gBADvB,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB;IAK7D,aAAa,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAY/C,MAAM,CACF,GAAG,EAAE,qBAAqB,EAC3B,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,mBAAmB,CAAC;IAczB,KAAK,CACA,EAAE,EAAE,EAAE,EAAE,eAAe,EACxB,GAAG,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAIzB,OAAO,CAAC,SAAS;CAMlB"}

package/dist/auth/controllers/user.organization.controller.js

@@ -0,0 +1,88 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserOrganizationController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const common_params_dto_1 = require("../../common/dtos/common.params.dto");
+const refresh_token_dto_1 = require("../dtos/refresh.token.dto");
+const switch_organization_dto_1 = require("../dtos/switch.organization.dto");
+const auth_service_1 = require("../services/auth.service");
+const tenant_membership_service_1 = require("../services/tenant.membership.service");
+let UserOrganizationController = class UserOrganizationController {
+    constructor(authService, tenantMembershipService) {
+        this.authService = authService;
+        this.tenantMembershipService = tenantMembershipService;
+    }
+    async organizations() {
+        const { user } = await this.authService.validateRole();
+        return this.tenantMembershipService.organizationsOf(user.id);
+    }
+    async switch(dto, request) {
+        return this.tenantMembershipService.switchOrganization(dto, this.contextOf(request));
+    }
+    async leave({ id }, dto, request) {
+        return this.tenantMembershipService.leave(id, dto, this.contextOf(request));
+    }
+    contextOf(request) {
+        return {
+            ip_address: request.ip,
+            user_agent: request.headers['user-agent'],
+        };
+    }
+};
+exports.UserOrganizationController = UserOrganizationController;
+__decorate([
+    (0, common_1.Get)(),
+    (0, swagger_1.ApiOperation)({ summary: 'Active organizations the caller is a member of.' }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], UserOrganizationController.prototype, "organizations", null);
+__decorate([
+    (0, common_1.Post)('switch'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Move the session into another of the caller’s organizations.',
+        description: 'Retires the current session and the supplied refresh token, and returns a pair bound to `tenant_id`. The choice is remembered: the next login lands there. Global-access accounts use the impersonation login instead.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [switch_organization_dto_1.SwitchOrganizationDto, Object]),
+    __metadata("design:returntype", Promise)
+], UserOrganizationController.prototype, "switch", null);
+__decorate([
+    (0, common_1.Post)(':id/leave'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Leave an organization.',
+        description: 'Ends the membership and its roles, and revokes the caller’s credentials bound to that organization. Retires the supplied refresh token and returns a new pair in whichever organization a login would now land in (tenantless when none). Refused for the organization’s last `global.admin`.',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto,
+        refresh_token_dto_1.RefreshTokenDto, Object]),
+    __metadata("design:returntype", Promise)
+], UserOrganizationController.prototype, "leave", null);
+exports.UserOrganizationController = UserOrganizationController = __decorate([
+    (0, swagger_1.ApiTags)('Auth'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('api/auth/organizations'),
+    __metadata("design:paramtypes", [auth_service_1.AuthService,
+        tenant_membership_service_1.TenantMembershipService])
+], UserOrganizationController);
+//# sourceMappingURL=user.organization.controller.js.map

package/dist/auth/controllers/user.organization.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.organization.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/user.organization.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAuE;AAEvE,2EAAsE;AACtE,iEAA4D;AAC5D,6EAAwE;AACxE,2DAAuD;AACvD,qFAAgF;AAYzE,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YACmB,WAAwB,EACxB,uBAAgD;QADhD,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;IAChE,CAAC;IAIE,AAAN,KAAK,CAAC,aAAa;QACjB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;IASK,AAAN,KAAK,CAAC,MAAM,CACF,GAA0B,EAC3B,OAAgB;QAEvB,OAAO,IAAI,CAAC,uBAAuB,CAAC,kBAAkB,CACpD,GAAG,EACH,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,KAAK,CACA,EAAE,EAAE,EAAmB,EACxB,GAAoB,EACrB,OAAgB;QAEvB,OAAO,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;IAEO,SAAS,CAAC,OAAgB;QAChC,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;SAC1C,CAAC;IACJ,CAAC;CACF,CAAA;AAnDY,gEAA0B;AAQ/B;IAFL,IAAA,YAAG,GAAE;IACL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;;;;+DAI5E;AASK;IAPL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8DAA8D;QACvE,WAAW,EACT,wNAAwN;KAC3N,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,+CAAqB;;wDAOnC;AASK;IAPL,IAAA,aAAI,EAAC,WAAW,CAAC;IACjB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wBAAwB;QACjC,WAAW,EACT,+RAA+R;KAClS,CAAC;IAEC,WAAA,IAAA,cAAK,GAAE,CAAA;IACP,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCAFW,mCAAe;QACnB,mCAAe;;uDAI7B;qCA3CU,0BAA0B;IAHtC,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,wBAAwB,CAAC;qCAGH,0BAAW;QACC,mDAAuB;GAHxD,0BAA0B,CAmDtC"}

package/dist/auth/dtos/invite.tenant.user.dto.d.ts

@@ -0,0 +1,6 @@
+export declare class InviteTenantUserDto {
+    email: string;
+    full_name?: string;
+    role_ids: string[];
+}
+//# sourceMappingURL=invite.tenant.user.dto.d.ts.map

package/dist/auth/dtos/invite.tenant.user.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.tenant.user.dto.d.ts","sourceRoot":"","sources":["../../../src/auth/dtos/invite.tenant.user.dto.ts"],"names":[],"mappings":"AAYA,qBAAa,mBAAmB;IAI9B,KAAK,EAAE,MAAM,CAAC;IAUd,SAAS,CAAC,EAAE,MAAM,CAAC;IAUnB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB"}

package/dist/auth/dtos/invite.tenant.user.dto.js

@@ -0,0 +1,45 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InviteTenantUserDto = void 0;
+const class_validator_1 = require("class-validator");
+const swagger_1 = require("@nestjs/swagger");
+class InviteTenantUserDto {
+}
+exports.InviteTenantUserDto = InviteTenantUserDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'jane@acme.com' }),
+    (0, class_validator_1.IsEmail)(),
+    (0, class_validator_1.MaxLength)(255),
+    __metadata("design:type", String)
+], InviteTenantUserDto.prototype, "email", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        example: 'Jane Doe',
+        description: 'Name for the account created when the email has none; defaults to the part before the @.',
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(255),
+    __metadata("design:type", String)
+], InviteTenantUserDto.prototype, "full_name", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        type: [String],
+        format: 'uuid',
+        description: 'sys_roles uuids granted in the organization on acceptance.',
+    }),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayMinSize)(1),
+    (0, class_validator_1.IsUUID)('all', { each: true }),
+    __metadata("design:type", Array)
+], InviteTenantUserDto.prototype, "role_ids", void 0);
+//# sourceMappingURL=invite.tenant.user.dto.js.map

package/dist/auth/dtos/invite.tenant.user.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.tenant.user.dto.js","sourceRoot":"","sources":["../../../src/auth/dtos/invite.tenant.user.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAQyB;AACzB,6CAAmE;AAGnE,MAAa,mBAAmB;CAyB/B;AAzBD,kDAyBC;AArBC;IAHC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IACzC,IAAA,yBAAO,GAAE;IACT,IAAA,2BAAS,EAAC,GAAG,CAAC;;kDACD;AAUd;IARC,IAAA,6BAAmB,EAAC;QACnB,OAAO,EAAE,UAAU;QACnB,WAAW,EACT,0FAA0F;KAC7F,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;IACV,IAAA,2BAAS,EAAC,GAAG,CAAC;;sDACI;AAUnB;IARC,IAAA,qBAAW,EAAC;QACX,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,4DAA4D;KAC1E,CAAC;IACD,IAAA,yBAAO,GAAE;IACT,IAAA,8BAAY,EAAC,CAAC,CAAC;IACf,IAAA,wBAAM,EAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;qDACX"}

package/dist/auth/dtos/member.roles.dto.d.ts

@@ -0,0 +1,4 @@
+export declare class MemberRolesDto {
+    role_ids: string[];
+}
+//# sourceMappingURL=member.roles.dto.d.ts.map

package/dist/auth/dtos/member.roles.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"member.roles.dto.d.ts","sourceRoot":"","sources":["../../../src/auth/dtos/member.roles.dto.ts"],"names":[],"mappings":"AAIA,qBAAa,cAAc;IASzB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB"}