@neohm/nestend 4.0.1 → 4.1.0

package/dist/auth/services/tenant.invitation.service.js

@@ -0,0 +1,212 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var TenantInvitationService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantInvitationService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const access_exception_1 = require("../../global/exceptions/access.exception");
+const not_found_exception_1 = require("../../global/exceptions/not.found.exception");
+const operation_exception_1 = require("../../global/exceptions/operation.exception");
+const tenant_entity_1 = require("../../tenant/entities/tenant.entity");
+const system_role_entity_1 = require("../entities/system.role.entity");
+const tenant_invitation_entity_1 = require("../entities/tenant.invitation.entity");
+const user_entity_1 = require("../entities/user.entity");
+const tenant_invitation_status_enum_1 = require("../enums/tenant.invitation.status.enum");
+const user_type_enum_1 = require("../enums/user.type.enum");
+const tenant_invitation_default_enum_1 = require("../enums/tenant.invitation.default.enum");
+const auth_utilities_1 = require("../utilities/auth.utilities");
+const tenant_access_1 = require("../utilities/tenant.access");
+const tenant_user_invited_mail_job_1 = require("../../notification/jobs/tenant.user.invited.mail.job");
+const auth_service_1 = require("./auth.service");
+let TenantInvitationService = TenantInvitationService_1 = class TenantInvitationService {
+    constructor(authService, dataSource, invitedMailJob) {
+        this.authService = authService;
+        this.dataSource = dataSource;
+        this.invitedMailJob = invitedMailJob;
+        this.logger = new common_1.Logger(TenantInvitationService_1.name);
+    }
+    async pendingFor(user) {
+        if (user.user_type === user_type_enum_1.UserType.SYSTEM_USER)
+            return [];
+        const invitations = await this.invitationRepository
+            .createQueryBuilder('i')
+            .innerJoinAndSelect('i.tenant', 't', 't.is_active = true and t.deleted_at is null')
+            .leftJoinAndSelect('i.creator', 'c')
+            .where('i.email = :email', { email: user.email.toLowerCase() })
+            .andWhere('i.status = :status', {
+            status: tenant_invitation_status_enum_1.TenantInvitationStatus.PENDING,
+        })
+            .andWhere('i.expires_at > now()')
+            .orderBy('i.created_at', 'DESC')
+            .getMany();
+        const roleIds = [...new Set(invitations.flatMap((i) => i.role_ids))];
+        const roles = roleIds.length
+            ? await this.dataSource
+                .getRepository(system_role_entity_1.SystemRoleEntity)
+                .findBy({ id: (0, typeorm_1.In)(roleIds), is_active: true })
+            : [];
+        const roleById = new Map(roles.map((role) => [role.id, role]));
+        return invitations.map((invitation) => ({
+            id: invitation.id,
+            tenant_id: invitation.tenant_id,
+            tenant_name: invitation.tenant.name,
+            invited_by: invitation.creator?.full_name ?? null,
+            roles: invitation.role_ids
+                .map((roleId) => roleById.get(roleId))
+                .filter((role) => !!role)
+                .map(({ id, identifier, name }) => ({ id, identifier, name })),
+            expires_at: invitation.expires_at,
+            created_at: invitation.created_at,
+        }));
+    }
+    async accept(invitationId) {
+        const { user } = await this.authService.validateRole();
+        const invitation = await this.answerable(invitationId, user);
+        const tenant = await this.dataSource.getRepository(tenant_entity_1.TenantEntity).findOne({
+            where: { id: invitation.tenant_id, is_active: true },
+            select: { id: true, name: true, slug: true, logo_url: true },
+        });
+        if (!tenant)
+            throw new operation_exception_1.OperationException('This organization is no longer active.');
+        await this.dataSource.transaction(async (trx) => {
+            await this.settle(trx, invitation.id, tenant_invitation_status_enum_1.TenantInvitationStatus.ACCEPTED, user.id);
+            await tenant_access_1.TenantAccess.join(trx, user.id, tenant.id, invitation.role_ids, invitation.created_by);
+            await trx.update(user_entity_1.UserEntity, { id: user.id, organization_id: (0, typeorm_1.IsNull)() }, { organization_id: tenant.id });
+        });
+        return tenant;
+    }
+    async decline(invitationId) {
+        const { user } = await this.authService.validateRole();
+        const invitation = await this.answerable(invitationId, user);
+        await this.settle(this.dataSource.manager, invitation.id, tenant_invitation_status_enum_1.TenantInvitationStatus.DECLINED, user.id);
+        return this.invitationRepository.findOneByOrFail({ id: invitation.id });
+    }
+    async revoke(invitationId, tenantId, actorId) {
+        const exists = await this.invitationRepository.existsBy({
+            id: invitationId,
+            tenant_id: tenantId,
+        });
+        if (!exists)
+            throw new not_found_exception_1.NotFoundException('No invitation exists for this id');
+        const { affected } = await this.invitationRepository.update({
+            id: invitationId,
+            tenant_id: tenantId,
+            status: tenant_invitation_status_enum_1.TenantInvitationStatus.PENDING,
+        }, { status: tenant_invitation_status_enum_1.TenantInvitationStatus.REVOKED, updated_by: actorId });
+        if (affected !== 1)
+            throw new operation_exception_1.OperationException('Only a pending invitation can be revoked.');
+        return this.invitationRepository.findOneByOrFail({ id: invitationId });
+    }
+    async resend(invitationId, tenantId, actorId) {
+        const exists = await this.invitationRepository.existsBy({
+            id: invitationId,
+            tenant_id: tenantId,
+        });
+        if (!exists)
+            throw new not_found_exception_1.NotFoundException('No invitation exists for this id');
+        const { affected } = await this.invitationRepository.update({
+            id: invitationId,
+            tenant_id: tenantId,
+            status: tenant_invitation_status_enum_1.TenantInvitationStatus.PENDING,
+        }, { expires_at: TenantInvitationService_1.expiresAt(), updated_by: actorId });
+        if (affected !== 1)
+            throw new operation_exception_1.OperationException('Only a pending invitation can be resent.');
+        const invitation = await this.invitationRepository.findOneOrFail({
+            where: { id: invitationId },
+            relations: { tenant: true, creator: true },
+        });
+        const invitee = await this.dataSource.getRepository(user_entity_1.UserEntity).findOne({
+            where: { email: user_entity_1.UserEntity.emailMatching(invitation.email) },
+        });
+        if (invitee?.password_change_required) {
+            const oneTimePassword = auth_utilities_1.AuthUtility.generateOneTimePassword();
+            await this.dataSource
+                .getRepository(user_entity_1.UserEntity)
+                .update({ id: invitee.id }, { password: await auth_utilities_1.AuthUtility.hashPassword(oneTimePassword) });
+            await this.mailOneTimePassword(invitee, invitation, oneTimePassword);
+        }
+        return invitation;
+    }
+    async mailOneTimePassword(user, invitation, oneTimePassword) {
+        const [tenant, inviter, roles] = await Promise.all([
+            invitation.tenant ??
+                this.dataSource
+                    .getRepository(tenant_entity_1.TenantEntity)
+                    .findOneBy({ id: invitation.tenant_id }),
+            invitation.creator ??
+                (invitation.created_by
+                    ? this.dataSource
+                        .getRepository(user_entity_1.UserEntity)
+                        .findOneBy({ id: invitation.created_by })
+                    : null),
+            this.dataSource
+                .getRepository(system_role_entity_1.SystemRoleEntity)
+                .findBy({ id: (0, typeorm_1.In)(invitation.role_ids) }),
+        ]);
+        const data = {
+            user_name: user.full_name,
+            user_email: user.email,
+            tenant_name: tenant?.name ?? '',
+            invited_by: inviter?.full_name ?? '',
+            roles: roles.map((role) => role.name).join(', '),
+            one_time_password: oneTimePassword,
+            expires_on: invitation.expires_at.toISOString(),
+        };
+        try {
+            await this.invitedMailJob.dispatch(data);
+        }
+        catch (error) {
+            this.logger.warn(`Failed to queue the invitation email for ${user.email}: ${error.message}`);
+        }
+    }
+    static expiresAt() {
+        const expiry = process.env.TENANT_INVITATION_EXPIRY || tenant_invitation_default_enum_1.TenantInvitationDefault.EXPIRY;
+        return new Date(Date.now() + auth_utilities_1.AuthUtility.parseExpiryMs(expiry));
+    }
+    async grantableRoles() {
+        return this.dataSource.getRepository(system_role_entity_1.SystemRoleEntity).find({
+            where: { is_active: true },
+            select: { id: true, identifier: true, name: true, description: true },
+            order: { name: 'ASC' },
+        });
+    }
+    async answerable(invitationId, user) {
+        if (user.user_type === user_type_enum_1.UserType.SYSTEM_USER)
+            throw new access_exception_1.AccessException('This account cannot join an organization.');
+        const invitation = await this.invitationRepository.findOne({
+            where: { id: invitationId, email: user.email.toLowerCase() },
+        });
+        if (!invitation)
+            throw new not_found_exception_1.NotFoundException('No invitation exists for this id');
+        if (invitation.status !== tenant_invitation_status_enum_1.TenantInvitationStatus.PENDING)
+            throw new operation_exception_1.OperationException('This invitation has already been answered.');
+        if (invitation.expires_at.getTime() <= Date.now())
+            throw new operation_exception_1.OperationException('This invitation has expired.');
+        return invitation;
+    }
+    async settle(manager, invitationId, status, userId) {
+        const { affected } = await manager.update(tenant_invitation_entity_1.TenantInvitationEntity, { id: invitationId, status: tenant_invitation_status_enum_1.TenantInvitationStatus.PENDING }, { status, user_id: userId, responded_at: new Date(), updated_by: userId });
+        if (affected !== 1)
+            throw new operation_exception_1.OperationException('This invitation has already been answered.');
+    }
+    get invitationRepository() {
+        return this.dataSource.getRepository(tenant_invitation_entity_1.TenantInvitationEntity);
+    }
+};
+exports.TenantInvitationService = TenantInvitationService;
+exports.TenantInvitationService = TenantInvitationService = TenantInvitationService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [auth_service_1.AuthService,
+        typeorm_1.DataSource,
+        tenant_user_invited_mail_job_1.TenantUserInvitedMailJob])
+], TenantInvitationService);
+//# sourceMappingURL=tenant.invitation.service.js.map

package/dist/auth/services/tenant.invitation.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.invitation.service.js","sourceRoot":"","sources":["../../../src/auth/services/tenant.invitation.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAAoD;AACpD,qCAA4E;AAC5E,+EAA2E;AAC3E,qFAAgF;AAChF,qFAAiF;AACjF,uEAAmE;AACnE,uEAAkE;AAClE,mFAA8E;AAC9E,yDAAqD;AACrD,0FAAgF;AAChF,4DAAmD;AACnD,4FAAkF;AAClF,gEAA0D;AAE1D,8DAA0D;AAC1D,uGAAgG;AAEhG,iDAA6C;AAWtC,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAGlC,YACmB,WAAwB,EACxB,UAAsB,EACtB,cAAwC;QAFxC,gBAAW,GAAX,WAAW,CAAa;QACxB,eAAU,GAAV,UAAU,CAAY;QACtB,mBAAc,GAAd,cAAc,CAA0B;QAL1C,WAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;IAMhE,CAAC;IAGJ,KAAK,CAAC,UAAU,CAAC,IAAgB;QAC/B,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YAAE,OAAO,EAAE,CAAC;QAEvD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,oBAAoB;aAChD,kBAAkB,CAAC,GAAG,CAAC;aACvB,kBAAkB,CACjB,UAAU,EACV,GAAG,EACH,6CAA6C,CAC9C;aACA,iBAAiB,CAAC,WAAW,EAAE,GAAG,CAAC;aACnC,KAAK,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;aAC9D,QAAQ,CAAC,oBAAoB,EAAE;YAC9B,MAAM,EAAE,sDAAsB,CAAC,OAAO;SACvC,CAAC;aACD,QAAQ,CAAC,sBAAsB,CAAC;aAChC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC;aAC/B,OAAO,EAAE,CAAC;QAEb,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM;YAC1B,CAAC,CAAC,MAAM,IAAI,CAAC,UAAU;iBAClB,aAAa,CAAC,qCAAgB,CAAC;iBAC/B,MAAM,CAAC,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACjD,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAE/D,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACtC,EAAE,EAAE,UAAU,CAAC,EAAE;YACjB,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI;YACnC,UAAU,EAAE,UAAU,CAAC,OAAO,EAAE,SAAS,IAAI,IAAI;YACjD,KAAK,EAAE,UAAU,CAAC,QAAQ;iBACvB,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;iBACrC,MAAM,CAAC,CAAC,IAAI,EAA4B,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClD,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,UAAU,EAAE,UAAU,CAAC,UAAU;SAClC,CAAC,CAAC,CAAC;IACN,CAAC;IAOD,KAAK,CAAC,MAAM,CAAC,YAAoB;QAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAE7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,4BAAY,CAAC,CAAC,OAAO,CAAC;YACvE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE;YACpD,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC7D,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,wCAAkB,CAAC,wCAAwC,CAAC,CAAC;QAEzE,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAG9C,MAAM,IAAI,CAAC,MAAM,CACf,GAAG,EACH,UAAU,CAAC,EAAE,EACb,sDAAsB,CAAC,QAAQ,EAC/B,IAAI,CAAC,EAAE,CACR,CAAC;YAEF,MAAM,4BAAY,CAAC,IAAI,CACrB,GAAG,EACH,IAAI,CAAC,EAAE,EACP,MAAM,CAAC,EAAE,EACT,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,UAAU,CACtB,CAAC;YAGF,MAAM,GAAG,CAAC,MAAM,CACd,wBAAU,EACV,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,IAAA,gBAAM,GAAE,EAAE,EAC1C,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,EAAE,CAC/B,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAE7D,MAAM,IAAI,CAAC,MAAM,CACf,IAAI,CAAC,UAAU,CAAC,OAAO,EACvB,UAAU,CAAC,EAAE,EACb,sDAAsB,CAAC,QAAQ,EAC/B,IAAI,CAAC,EAAE,CACR,CAAC;QACF,OAAO,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAGD,KAAK,CAAC,MAAM,CACV,YAAoB,EACpB,QAAgB,EAChB,OAAe;QAEf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC;YACtD,EAAE,EAAE,YAAY;YAChB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,uCAAiB,CAAC,kCAAkC,CAAC,CAAC;QAElE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CACzD;YACE,EAAE,EAAE,YAAY;YAChB,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,sDAAsB,CAAC,OAAO;SACvC,EACD,EAAE,MAAM,EAAE,sDAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAChE,CAAC;QACF,IAAI,QAAQ,KAAK,CAAC;YAChB,MAAM,IAAI,wCAAkB,CAAC,2CAA2C,CAAC,CAAC;QAE5E,OAAO,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;IACzE,CAAC;IAGD,KAAK,CAAC,MAAM,CACV,YAAoB,EACpB,QAAgB,EAChB,OAAe;QAEf,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC;YACtD,EAAE,EAAE,YAAY;YAChB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,uCAAiB,CAAC,kCAAkC,CAAC,CAAC;QAElE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CACzD;YACE,EAAE,EAAE,YAAY;YAChB,SAAS,EAAE,QAAQ;YACnB,MAAM,EAAE,sDAAsB,CAAC,OAAO;SACvC,EACD,EAAE,UAAU,EAAE,yBAAuB,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CACzE,CAAC;QACF,IAAI,QAAQ,KAAK,CAAC;YAChB,MAAM,IAAI,wCAAkB,CAAC,0CAA0C,CAAC,CAAC;QAE3E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC;YAC/D,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE;YAC3B,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;SAC3C,CAAC,CAAC;QAIH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,wBAAU,CAAC,CAAC,OAAO,CAAC;YACtE,KAAK,EAAE,EAAE,KAAK,EAAE,wBAAU,CAAC,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE;SAC7D,CAAC,CAAC;QACH,IAAI,OAAO,EAAE,wBAAwB,EAAE,CAAC;YACtC,MAAM,eAAe,GAAG,4BAAW,CAAC,uBAAuB,EAAE,CAAC;YAC9D,MAAM,IAAI,CAAC,UAAU;iBAClB,aAAa,CAAC,wBAAU,CAAC;iBACzB,MAAM,CACL,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,EAClB,EAAE,QAAQ,EAAE,MAAM,4BAAW,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,CAC9D,CAAC;YACJ,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;QACvE,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAOD,KAAK,CAAC,mBAAmB,CACvB,IAAgB,EAChB,UAAkC,EAClC,eAAuB;QAEvB,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjD,UAAU,CAAC,MAAM;gBACf,IAAI,CAAC,UAAU;qBACZ,aAAa,CAAC,4BAAY,CAAC;qBAC3B,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;YAC5C,UAAU,CAAC,OAAO;gBAChB,CAAC,UAAU,CAAC,UAAU;oBACpB,CAAC,CAAC,IAAI,CAAC,UAAU;yBACZ,aAAa,CAAC,wBAAU,CAAC;yBACzB,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC;oBAC7C,CAAC,CAAC,IAAI,CAAC;YACX,IAAI,CAAC,UAAU;iBACZ,aAAa,CAAC,qCAAgB,CAAC;iBAC/B,MAAM,CAAC,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;SAC3C,CAAC,CAAC;QAEH,MAAM,IAAI,GAA6B;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU,EAAE,IAAI,CAAC,KAAK;YACtB,WAAW,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE;YAC/B,UAAU,EAAE,OAAO,EAAE,SAAS,IAAI,EAAE;YACpC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAChD,iBAAiB,EAAE,eAAe;YAClC,UAAU,EAAE,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE;SAChD,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,4CAA4C,IAAI,CAAC,KAAK,KAAM,KAAe,CAAC,OAAO,EAAE,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAGD,MAAM,CAAC,SAAS;QACd,MAAM,MAAM,GACV,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,wDAAuB,CAAC,MAAM,CAAC;QACzE,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,4BAAW,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAClE,CAAC;IAGD,KAAK,CAAC,cAAc;QAClB,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,qCAAgB,CAAC,CAAC,IAAI,CAAC;YAC1D,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YAC1B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE;YACrE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;SACvB,CAAC,CAAC;IACL,CAAC;IAGO,KAAK,CAAC,UAAU,CACtB,YAAoB,EACpB,IAAgB;QAEhB,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YACzC,MAAM,IAAI,kCAAe,CAAC,2CAA2C,CAAC,CAAC;QAGzE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;YACzD,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE;SAC7D,CAAC,CAAC;QACH,IAAI,CAAC,UAAU;YACb,MAAM,IAAI,uCAAiB,CAAC,kCAAkC,CAAC,CAAC;QAClE,IAAI,UAAU,CAAC,MAAM,KAAK,sDAAsB,CAAC,OAAO;YACtD,MAAM,IAAI,wCAAkB,CAC1B,4CAA4C,CAC7C,CAAC;QACJ,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE;YAC/C,MAAM,IAAI,wCAAkB,CAAC,8BAA8B,CAAC,CAAC;QAE/D,OAAO,UAAU,CAAC;IACpB,CAAC;IAGO,KAAK,CAAC,MAAM,CAClB,OAAsB,EACtB,YAAoB,EACpB,MAA8B,EAC9B,MAAc;QAEd,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CACvC,iDAAsB,EACtB,EAAE,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,sDAAsB,CAAC,OAAO,EAAE,EAC5D,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAC1E,CAAC;QACF,IAAI,QAAQ,KAAK,CAAC;YAChB,MAAM,IAAI,wCAAkB,CAC1B,4CAA4C,CAC7C,CAAC;IACN,CAAC;IAED,IAAY,oBAAoB;QAC9B,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,iDAAsB,CAAC,CAAC;IAC/D,CAAC;CACF,CAAA;AAlSY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAKqB,0BAAW;QACZ,oBAAU;QACN,uDAAwB;GANhD,uBAAuB,CAkSnC"}

package/dist/auth/services/tenant.membership.service.d.ts

@@ -0,0 +1,29 @@
+import { DataSource } from 'typeorm';
+import { DeleteResult } from '../../common/types/common.response.types';
+import { RefreshTokenDto } from '../dtos/refresh.token.dto';
+import { SwitchOrganizationDto } from '../dtos/switch.organization.dto';
+import { SystemRoleEntity } from '../entities/system.role.entity';
+import { TenantUserEntity } from '../entities/tenant.user.entity';
+import { UserEntity } from '../entities/user.entity';
+import { AuthTokenPair, OrganizationSession, OrganizationSummary, TokenIssueContext } from '../types/auth.types';
+import { AuthService } from './auth.service';
+export declare class TenantMembershipService {
+    private readonly authService;
+    private readonly dataSource;
+    constructor(authService: AuthService, dataSource: DataSource);
+    organizationsOf(userId: string): Promise<OrganizationSummary[]>;
+    sessionOrganization(user: UserEntity): Promise<OrganizationSummary | null>;
+    landingTenant(user: UserEntity): Promise<string | undefined>;
+    switchOrganization(dto: SwitchOrganizationDto, context?: TokenIssueContext): Promise<OrganizationSession>;
+    leave(tenantId: string, dto: RefreshTokenDto, context?: TokenIssueContext): Promise<AuthTokenPair>;
+    setMemberRoles(userId: string, tenantId: string, roleIds: string[], actorId?: string, guardAdmin?: boolean): Promise<SystemRoleEntity[]>;
+    removeMember(userId: string, tenantId: string, actorId: string, guardAdmin?: boolean): Promise<DeleteResult>;
+    private assertLiveRoles;
+    setMemberActive(userId: string, tenantId: string, active: boolean, actorId?: string, guardAdmin?: boolean): Promise<TenantUserEntity>;
+    private requireMembership;
+    private assertAdminRemains;
+    private assertTenantUser;
+    private get tenantRepository();
+    private get userRepository();
+}
+//# sourceMappingURL=tenant.membership.service.d.ts.map

package/dist/auth/services/tenant.membership.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.membership.service.d.ts","sourceRoot":"","sources":["../../../src/auth/services/tenant.membership.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAkB,MAAM,SAAS,CAAC;AAIrD,OAAO,EAAE,YAAY,EAAE,MAAM,0CAA0C,CAAC;AAExE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAIrD,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAO7C,qBACa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,WAAW,EAAE,WAAW,EACxB,UAAU,EAAE,UAAU;IAInC,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAmB/D,mBAAmB,CACvB,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAahC,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IAe5D,kBAAkB,CACtB,GAAG,EAAE,qBAAqB,EAC1B,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,mBAAmB,CAAC;IA6BzB,KAAK,CACT,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,eAAe,EACpB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,aAAa,CAAC;IAsBnB,cAAc,CAClB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,UAAO,GAChB,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAexB,YAAY,CAChB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,UAAU,UAAO,GAChB,OAAO,CAAC,YAAY,CAAC;YAWV,eAAe;IAyBvB,eAAe,CACnB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,EACf,OAAO,CAAC,EAAE,MAAM,EAChB,UAAU,UAAO,GAChB,OAAO,CAAC,gBAAgB,CAAC;YAiBd,iBAAiB;YAiBjB,kBAAkB;IAiChC,OAAO,CAAC,gBAAgB;IAOxB,OAAO,KAAK,gBAAgB,GAE3B;IAED,OAAO,KAAK,cAAc,GAEzB;CACF"}

package/dist/auth/services/tenant.membership.service.js

@@ -0,0 +1,178 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantMembershipService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const access_exception_1 = require("../../global/exceptions/access.exception");
+const not_found_exception_1 = require("../../global/exceptions/not.found.exception");
+const operation_exception_1 = require("../../global/exceptions/operation.exception");
+const tenant_entity_1 = require("../../tenant/entities/tenant.entity");
+const system_role_entity_1 = require("../entities/system.role.entity");
+const tenant_user_entity_1 = require("../entities/tenant.user.entity");
+const user_entity_1 = require("../entities/user.entity");
+const user_role_entity_1 = require("../entities/user.role.entity");
+const tenant_role_enum_1 = require("../enums/tenant.role.enum");
+const user_type_enum_1 = require("../enums/user.type.enum");
+const access_revocation_1 = require("../utilities/access.revocation");
+const tenant_access_1 = require("../utilities/tenant.access");
+const auth_service_1 = require("./auth.service");
+let TenantMembershipService = class TenantMembershipService {
+    constructor(authService, dataSource) {
+        this.authService = authService;
+        this.dataSource = dataSource;
+    }
+    async organizationsOf(userId) {
+        return this.tenantRepository
+            .createQueryBuilder('t')
+            .select(['t.id', 't.name', 't.slug', 't.logo_url'])
+            .innerJoin(tenant_user_entity_1.TenantUserEntity, 'tu', 'tu.tenant_id = t.id and tu.deleted_at is null and tu.is_active = true')
+            .where('tu.user_id = :userId', { userId })
+            .andWhere('t.is_active = true')
+            .orderBy('t.name', 'ASC')
+            .getMany();
+    }
+    async sessionOrganization(user) {
+        if (!user.organization_id)
+            return null;
+        return this.tenantRepository.findOne({
+            where: { id: user.organization_id },
+            select: { id: true, name: true, slug: true, logo_url: true },
+        });
+    }
+    async landingTenant(user) {
+        if (user.user_type === user_type_enum_1.UserType.SYSTEM_USER)
+            return undefined;
+        const organizations = await this.organizationsOf(user.id);
+        const remembered = organizations.find((tenant) => tenant.id === user.organization_id);
+        return (remembered ?? organizations[0])?.id;
+    }
+    async switchOrganization(dto, context) {
+        const { user } = await this.authService.validateRole();
+        this.assertTenantUser(user);
+        const organizations = await this.organizationsOf(user.id);
+        const tenant = organizations.find((organization) => organization.id === dto.tenant_id);
+        if (!tenant)
+            throw new access_exception_1.AccessException('You are not a member of this organization.');
+        await this.authService.logout(dto.refresh_token);
+        await this.userRepository.update({ id: user.id }, { organization_id: tenant.id });
+        const tokens = await this.authService.issueTokens(user, {
+            ...context,
+            tenant_id: tenant.id,
+        });
+        return { ...tokens, tenant_id: tenant.id, tenant_name: tenant.name };
+    }
+    async leave(tenantId, dto, context) {
+        const { user } = await this.authService.validateRole();
+        this.assertTenantUser(user);
+        await this.requireMembership(user.id, tenantId);
+        await this.assertAdminRemains(tenantId, user.id);
+        await this.dataSource.transaction((trx) => tenant_access_1.TenantAccess.remove(trx, user.id, tenantId));
+        await this.authService.logout(dto.refresh_token);
+        const row = await this.userRepository.findOneByOrFail({ id: user.id });
+        return this.authService.issueTokens(row, {
+            ...context,
+            tenant_id: await this.landingTenant(row),
+        });
+    }
+    async setMemberRoles(userId, tenantId, roleIds, actorId, guardAdmin = true) {
+        await this.requireMembership(userId, tenantId);
+        await this.assertLiveRoles(roleIds);
+        if (guardAdmin)
+            await this.assertAdminRemains(tenantId, userId, roleIds);
+        await this.dataSource.transaction((trx) => tenant_access_1.TenantAccess.reconcileRoles(trx, userId, tenantId, roleIds, actorId));
+        return this.authService.tenantRoles(userId, tenantId);
+    }
+    async removeMember(userId, tenantId, actorId, guardAdmin = true) {
+        const membership = await this.requireMembership(userId, tenantId);
+        if (guardAdmin)
+            await this.assertAdminRemains(tenantId, userId);
+        await this.dataSource.transaction((trx) => tenant_access_1.TenantAccess.remove(trx, userId, tenantId));
+        return { id: membership.id, deleted: true, deleted_by: actorId };
+    }
+    async assertLiveRoles(roleIds) {
+        const unique = [...new Set(roleIds)];
+        if (!unique.length)
+            return;
+        const found = await this.dataSource
+            .getRepository(system_role_entity_1.SystemRoleEntity)
+            .findBy({ id: (0, typeorm_1.In)(unique), is_active: true });
+        const foundIds = new Set(found.map((role) => role.id));
+        const missing = unique.filter((roleId) => !foundIds.has(roleId));
+        if (missing.length)
+            throw new common_1.BadRequestException({
+                message: 'Validation failed',
+                errors: {
+                    role_ids: missing.map((roleId) => `Role '${roleId}' not found or inactive`),
+                },
+            });
+    }
+    async setMemberActive(userId, tenantId, active, actorId, guardAdmin = true) {
+        const membership = await this.requireMembership(userId, tenantId);
+        if (!active && guardAdmin)
+            await this.assertAdminRemains(tenantId, userId);
+        await this.dataSource.transaction(async (trx) => {
+            await trx.update(tenant_user_entity_1.TenantUserEntity, { id: membership.id }, { is_active: active, ...(actorId ? { updated_by: actorId } : {}) });
+            if (!active)
+                await access_revocation_1.AccessRevocation.revokeTenant(trx, userId, tenantId);
+        });
+        return this.dataSource
+            .getRepository(tenant_user_entity_1.TenantUserEntity)
+            .findOneByOrFail({ id: membership.id });
+    }
+    async requireMembership(userId, tenantId) {
+        const membership = await this.dataSource
+            .getRepository(tenant_user_entity_1.TenantUserEntity)
+            .findOne({ where: { user_id: userId, tenant_id: tenantId } });
+        if (!membership)
+            throw new not_found_exception_1.NotFoundException('No such member of this organization');
+        return membership;
+    }
+    async assertAdminRemains(tenantId, userId, nextRoleIds) {
+        const adminRole = await this.dataSource
+            .getRepository(system_role_entity_1.SystemRoleEntity)
+            .findOne({ where: { identifier: tenant_role_enum_1.TenantRole.GLOBAL_ADMIN } });
+        if (!adminRole)
+            return;
+        if (nextRoleIds?.includes(adminRole.id))
+            return;
+        const admins = await this.dataSource
+            .getRepository(user_role_entity_1.UserRoleEntity)
+            .createQueryBuilder('ur')
+            .innerJoin(tenant_user_entity_1.TenantUserEntity, 'tu', 'tu.user_id = ur.user_id and tu.tenant_id = ur.tenant_id and tu.deleted_at is null and tu.is_active = true')
+            .innerJoin(user_entity_1.UserEntity, 'u', 'u.id = ur.user_id and u.deleted_at is null')
+            .select('ur.user_id', 'user_id')
+            .where('ur.tenant_id = :tenantId', { tenantId })
+            .andWhere('ur.role_id = :roleId', { roleId: adminRole.id })
+            .distinct(true)
+            .getRawMany();
+        const isAdmin = admins.some((admin) => admin.user_id === userId);
+        if (isAdmin && admins.length === 1)
+            throw new operation_exception_1.OperationException('The organization needs at least one global.admin.');
+    }
+    assertTenantUser(user) {
+        if (user.user_type === user_type_enum_1.UserType.SYSTEM_USER)
+            throw new access_exception_1.AccessException('A global-access account changes organization through the impersonation login.');
+    }
+    get tenantRepository() {
+        return this.dataSource.getRepository(tenant_entity_1.TenantEntity);
+    }
+    get userRepository() {
+        return this.dataSource.getRepository(user_entity_1.UserEntity);
+    }
+};
+exports.TenantMembershipService = TenantMembershipService;
+exports.TenantMembershipService = TenantMembershipService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [auth_service_1.AuthService,
+        typeorm_1.DataSource])
+], TenantMembershipService);
+//# sourceMappingURL=tenant.membership.service.js.map

package/dist/auth/services/tenant.membership.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.membership.service.js","sourceRoot":"","sources":["../../../src/auth/services/tenant.membership.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAiE;AACjE,qCAAqD;AACrD,+EAA2E;AAC3E,qFAAgF;AAChF,qFAAiF;AAEjF,uEAAmE;AAGnE,uEAAkE;AAClE,uEAAkE;AAClE,yDAAqD;AACrD,mEAA8D;AAC9D,gEAAuD;AACvD,4DAAmD;AAOnD,sEAAkE;AAClE,8DAA0D;AAC1D,iDAA6C;AAQtC,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAClC,YACmB,WAAwB,EACxB,UAAsB;QADtB,gBAAW,GAAX,WAAW,CAAa;QACxB,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAGJ,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,gBAAgB;aACzB,kBAAkB,CAAC,GAAG,CAAC;aACvB,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;aAClD,SAAS,CACR,qCAAgB,EAChB,IAAI,EACJ,uEAAuE,CACxE;aACA,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC;aACzC,QAAQ,CAAC,oBAAoB,CAAC;aAC9B,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC;aACxB,OAAO,EAAE,CAAC;IACf,CAAC;IAMD,KAAK,CAAC,mBAAmB,CACvB,IAAgB;QAEhB,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACnC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,eAAe,EAAE;YACnC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IAOD,KAAK,CAAC,aAAa,CAAC,IAAgB;QAClC,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAE9D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CACnC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,eAAe,CAC/C,CAAC;QACF,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9C,CAAC;IAOD,KAAK,CAAC,kBAAkB,CACtB,GAA0B,EAC1B,OAA2B;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAC/B,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,GAAG,CAAC,SAAS,CACpD,CAAC;QACF,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,kCAAe,CAAC,4CAA4C,CAAC,CAAC;QAE1E,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAC9B,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EACf,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,EAAE,CAC/B,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YACtD,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,CAAC,EAAE;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IAOD,KAAK,CAAC,KAAK,CACT,QAAgB,EAChB,GAAoB,EACpB,OAA2B;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAEjD,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,4BAAY,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAC5C,CAAC;QACF,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAEjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,EAAE;YACvC,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAMD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,QAAgB,EAChB,OAAiB,EACjB,OAAgB,EAChB,UAAU,GAAG,IAAI;QAEjB,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAEzE,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,4BAAY,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CACrE,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;IAMD,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,QAAgB,EAChB,OAAe,EACf,UAAU,GAAG,IAAI;QAEjB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEhE,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,4BAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAC3C,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACnE,CAAC;IAGO,KAAK,CAAC,eAAe,CAAC,OAAiB;QAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO;QAE3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU;aAChC,aAAa,CAAC,qCAAgB,CAAC;aAC/B,MAAM,CAAC,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,IAAI,4BAAmB,CAAC;gBAC5B,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EAAE;oBACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CACnB,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,MAAM,yBAAyB,CACrD;iBACF;aACF,CAAC,CAAC;IACP,CAAC;IAOD,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,QAAgB,EAChB,MAAe,EACf,OAAgB,EAChB,UAAU,GAAG,IAAI;QAEjB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE3E,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,GAAG,CAAC,MAAM,CACd,qCAAgB,EAChB,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,EACrB,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACnE,CAAC;YACF,IAAI,CAAC,MAAM;gBAAE,MAAM,oCAAgB,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU;aACnB,aAAa,CAAC,qCAAgB,CAAC;aAC/B,eAAe,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,MAAc,EACd,QAAgB;QAEhB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU;aACrC,aAAa,CAAC,qCAAgB,CAAC;aAC/B,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU;YACb,MAAM,IAAI,uCAAiB,CAAC,qCAAqC,CAAC,CAAC;QACrE,OAAO,UAAU,CAAC;IACpB,CAAC;IAOO,KAAK,CAAC,kBAAkB,CAC9B,QAAgB,EAChB,MAAc,EACd,WAAsB;QAEtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU;aACpC,aAAa,CAAC,qCAAgB,CAAC;aAC/B,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,6BAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,IAAI,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,OAAO;QAEhD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU;aACjC,aAAa,CAAC,iCAAc,CAAC;aAC7B,kBAAkB,CAAC,IAAI,CAAC;aACxB,SAAS,CACR,qCAAgB,EAChB,IAAI,EACJ,2GAA2G,CAC5G;aACA,SAAS,CAAC,wBAAU,EAAE,GAAG,EAAE,4CAA4C,CAAC;aACxE,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;aAC/B,KAAK,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,CAAC;aAC/C,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;aAC1D,QAAQ,CAAC,IAAI,CAAC;aACd,UAAU,EAAuB,CAAC;QAErC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;QACjE,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAChC,MAAM,IAAI,wCAAkB,CAC1B,mDAAmD,CACpD,CAAC;IACN,CAAC;IAEO,gBAAgB,CAAC,IAAgB;QACvC,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YACzC,MAAM,IAAI,kCAAe,CACvB,+EAA+E,CAChF,CAAC;IACN,CAAC;IAED,IAAY,gBAAgB;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,4BAAY,CAAC,CAAC;IACrD,CAAC;IAED,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,wBAAU,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAvQY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAGqB,0BAAW;QACZ,oBAAU;GAH9B,uBAAuB,CAuQnC"}

package/dist/auth/types/auth.types.d.ts

@@ -2,6 +2,7 @@ import type { UserEntity } from '../entities/user.entity';
 import type { SystemRoleEntity } from '../entities/system.role.entity';
 import type { AdminUserEntity } from '../entities/admin.user.entity';
 import type { SystemAdminRoleEntity } from '../entities/system.admin.role.entity';
+import type { TenantEntity } from '../../tenant/entities/tenant.entity';
 export interface RequestUser {
     userId: string;
     email: string;
@@ -42,12 +43,33 @@ export interface IssueTokensUser {
 export interface TokenIssueContext {
     ip_address?: string;
     user_agent?: string;
-    impersonated_tenant_id?: string;
+    tenant_id?: string;
 }
-export interface ImpersonationSession extends AuthTokenPair {
+export interface OrganizationSession extends AuthTokenPair {
     tenant_id: string;
     tenant_name: string;
 }
+export type OrganizationSummary = Pick<TenantEntity, 'id' | 'name' | 'slug' | 'logo_url'>;
+export interface PendingInvitation {
+    id: string;
+    tenant_id: string;
+    tenant_name: string;
+    invited_by: string | null;
+    roles: {
+        id: string;
+        identifier: string;
+        name: string;
+    }[];
+    expires_at: Date;
+    created_at: Date;
+}
+export interface CurrentUserProfile {
+    user: UserEntity;
+    roles: SystemRoleEntity[];
+    organization: string | null;
+    organizations: OrganizationSummary[];
+    invitations: PendingInvitation[];
+}
 export interface AuthModuleOptions {
     dataSourceName?: string;
 }

package/dist/auth/types/auth.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.types.d.ts","sourceRoot":"","sources":["../../../src/auth/types/auth.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAElF,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAGD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAGD,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAGD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B"}
+{"version":3,"file":"auth.types.d.ts","sourceRoot":"","sources":["../../../src/auth/types/auth.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAExE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAGD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAGD,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,YAAY,EACZ,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CACpC,CAAC;AAGF,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1D,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAGD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAE1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,WAAW,EAAE,iBAAiB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAGD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/auth/utilities/access.revocation.d.ts

@@ -1,5 +1,7 @@
 import { EntityManager } from 'typeorm';
 export declare class AccessRevocation {
     static revokeAll(manager: EntityManager, userId: string, isAdmin: boolean): Promise<void>;
+    static revokeOrganization(manager: EntityManager, tenantId: string): Promise<void>;
+    static revokeTenant(manager: EntityManager, userId: string, tenantId: string): Promise<void>;
 }
 //# sourceMappingURL=access.revocation.d.ts.map

package/dist/auth/utilities/access.revocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.revocation.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/access.revocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,MAAM,SAAS,CAAC;AAgBhD,qBAAa,gBAAgB;WACd,SAAS,CACpB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC;CAejB"}
+{"version":3,"file":"access.revocation.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/access.revocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,MAAM,SAAS,CAAC;AAgBhD,qBAAa,gBAAgB;WACd,SAAS,CACpB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC;WAiBH,kBAAkB,CAC7B,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WAkBH,YAAY,CACvB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;CAgBjB"}

package/dist/auth/utilities/access.revocation.js

@@ -10,6 +10,18 @@ class AccessRevocation {
         await manager.update(system_auth_session_entity_1.SystemAuthSessionEntity, { user_id: userId, is_admin: isAdmin, invalidated_at: (0, typeorm_1.IsNull)() }, { invalidated_at: now });
         await manager.update(system_refresh_token_entity_1.SystemRefreshTokenEntity, { user_id: userId, is_admin: isAdmin, revoked_at: (0, typeorm_1.IsNull)() }, { revoked_at: now });
     }
+    static async revokeOrganization(manager, tenantId) {
+        const now = new Date();
+        const where = { is_admin: false, tenant_id: tenantId };
+        await manager.update(system_auth_session_entity_1.SystemAuthSessionEntity, { ...where, invalidated_at: (0, typeorm_1.IsNull)() }, { invalidated_at: now });
+        await manager.update(system_refresh_token_entity_1.SystemRefreshTokenEntity, { ...where, revoked_at: (0, typeorm_1.IsNull)() }, { revoked_at: now });
+    }
+    static async revokeTenant(manager, userId, tenantId) {
+        const now = new Date();
+        const where = { user_id: userId, is_admin: false, tenant_id: tenantId };
+        await manager.update(system_auth_session_entity_1.SystemAuthSessionEntity, { ...where, invalidated_at: (0, typeorm_1.IsNull)() }, { invalidated_at: now });
+        await manager.update(system_refresh_token_entity_1.SystemRefreshTokenEntity, { ...where, revoked_at: (0, typeorm_1.IsNull)() }, { revoked_at: now });
+    }
 }
 exports.AccessRevocation = AccessRevocation;
 //# sourceMappingURL=access.revocation.js.map

package/dist/auth/utilities/access.revocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.revocation.js","sourceRoot":"","sources":["../../../src/auth/utilities/access.revocation.ts"],"names":[],"mappings":";;;AAAA,qCAAgD;AAChD,uFAAiF;AACjF,yFAAmF;AAcnF,MAAa,gBAAgB;IAC3B,MAAM,CAAC,KAAK,CAAC,SAAS,CACpB,OAAsB,EACtB,MAAc,EACd,OAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,OAAO,CAAC,MAAM,CAClB,oDAAuB,EACvB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,IAAA,gBAAM,GAAE,EAAE,EAChE,EAAE,cAAc,EAAE,GAAG,EAAE,CACxB,CAAC;QAEF,MAAM,OAAO,CAAC,MAAM,CAClB,sDAAwB,EACxB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EAC5D,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;CACF;AApBD,4CAoBC"}
+{"version":3,"file":"access.revocation.js","sourceRoot":"","sources":["../../../src/auth/utilities/access.revocation.ts"],"names":[],"mappings":";;;AAAA,qCAAgD;AAChD,uFAAiF;AACjF,yFAAmF;AAcnF,MAAa,gBAAgB;IAC3B,MAAM,CAAC,KAAK,CAAC,SAAS,CACpB,OAAsB,EACtB,MAAc,EACd,OAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,OAAO,CAAC,MAAM,CAClB,oDAAuB,EACvB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,IAAA,gBAAM,GAAE,EAAE,EAChE,EAAE,cAAc,EAAE,GAAG,EAAE,CACxB,CAAC;QAEF,MAAM,OAAO,CAAC,MAAM,CAClB,sDAAwB,EACxB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EAC5D,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAC7B,OAAsB,EACtB,QAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAEvD,MAAM,OAAO,CAAC,MAAM,CAClB,oDAAuB,EACvB,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,IAAA,gBAAM,GAAE,EAAE,EACtC,EAAE,cAAc,EAAE,GAAG,EAAE,CACxB,CAAC;QAEF,MAAM,OAAO,CAAC,MAAM,CAClB,sDAAwB,EACxB,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EAClC,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,YAAY,CACvB,OAAsB,EACtB,MAAc,EACd,QAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAExE,MAAM,OAAO,CAAC,MAAM,CAClB,oDAAuB,EACvB,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,IAAA,gBAAM,GAAE,EAAE,EACtC,EAAE,cAAc,EAAE,GAAG,EAAE,CACxB,CAAC;QAEF,MAAM,OAAO,CAAC,MAAM,CAClB,sDAAwB,EACxB,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EAClC,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;CACF;AA/DD,4CA+DC"}

package/dist/auth/utilities/auth.utilities.d.ts

@@ -3,6 +3,7 @@ export declare class AuthUtility {
     static hashPassword(plain: string): Promise<string>;
     static comparePassword(plain: string, hashed: string): Promise<boolean>;
     static compareAgainstDummy(plain: string): Promise<false>;
+    static generateOneTimePassword(): string;
     static parseExpiryMs(expiry: string): number;
 }
 //# sourceMappingURL=auth.utilities.d.ts.map

package/dist/auth/utilities/auth.utilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.utilities.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/auth.utilities.ts"],"names":[],"mappings":"AAIA,qBAAa,WAAW;IAMtB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAgC;IAGxD,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKnD,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAW1D,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAM/D,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;CAqB7C"}
+{"version":3,"file":"auth.utilities.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/auth.utilities.ts"],"names":[],"mappings":"AAIA,qBAAa,WAAW;IAMtB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAgC;IAGxD,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKnD,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAW1D,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAO/D,MAAM,CAAC,uBAAuB,IAAI,MAAM;IAQxC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;CAqB7C"}

package/dist/auth/utilities/auth.utilities.js

@@ -16,6 +16,10 @@ class AuthUtility {
         await (0, bcrypt_1.compare)(plain, await AuthUtility.dummyHash);
         return false;
     }
+    static generateOneTimePassword() {
+        const alphabet = String(auth_default_enum_1.AuthDefault.ONE_TIME_PASSWORD_ALPHABET);
+        return Array.from({ length: Number(auth_default_enum_1.AuthDefault.ONE_TIME_PASSWORD_LENGTH) }, () => alphabet[(0, crypto_1.randomInt)(alphabet.length)]).join('');
+    }
     static parseExpiryMs(expiry) {
         const unit = expiry.slice(-1);
         const value = parseInt(expiry.slice(0, -1), 10);

package/dist/auth/utilities/auth.utilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.utilities.js","sourceRoot":"","sources":["../../../src/auth/utilities/auth.utilities.ts"],"names":[],"mappings":";;;AAAA,mCAAuC;AACvC,mCAAoC;AACpC,kEAAyD;AAEzD,MAAa,WAAW;IAStB,MAAM,CAAC,YAAY,CAAC,KAAa;QAC/B,OAAO,IAAA,aAAI,EAAC,KAAK,EAAE,+BAAW,CAAC,kBAAkB,CAAC,CAAC;IACrD,CAAC;IAGD,MAAM,CAAC,eAAe,CAAC,KAAa,EAAE,MAAc;QAClD,OAAO,IAAA,gBAAO,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IASD,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC5C,WAAW,CAAC,SAAS,KAAK,WAAW,CAAC,YAAY,CAAC,IAAA,mBAAU,GAAE,CAAC,CAAC;QACjE,MAAM,IAAA,gBAAO,EAAC,KAAK,EAAE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,MAAc;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhD,IAAI,KAAK,CAAC,KAAK,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,GAAG,CAAC,CAAC;QAC9D,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,IAAI,CAAC;YACtB,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC;YAC3B,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAChC,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACrC;gBACE,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,SAAS,MAAM,uBAAuB,CACnE,CAAC;QACN,CAAC;IACH,CAAC;;AAnDH,kCAoDC;AA9CgB,qBAAS,GAA2B,IAAI,CAAC"}
+{"version":3,"file":"auth.utilities.js","sourceRoot":"","sources":["../../../src/auth/utilities/auth.utilities.ts"],"names":[],"mappings":";;;AAAA,mCAAuC;AACvC,mCAA+C;AAC/C,kEAAyD;AAEzD,MAAa,WAAW;IAStB,MAAM,CAAC,YAAY,CAAC,KAAa;QAC/B,OAAO,IAAA,aAAI,EAAC,KAAK,EAAE,+BAAW,CAAC,kBAAkB,CAAC,CAAC;IACrD,CAAC;IAGD,MAAM,CAAC,eAAe,CAAC,KAAa,EAAE,MAAc;QAClD,OAAO,IAAA,gBAAO,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IASD,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC5C,WAAW,CAAC,SAAS,KAAK,WAAW,CAAC,YAAY,CAAC,IAAA,mBAAU,GAAE,CAAC,CAAC;QACjE,MAAM,IAAA,gBAAO,EAAC,KAAK,EAAE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAGD,MAAM,CAAC,uBAAuB;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,+BAAW,CAAC,0BAA0B,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC,IAAI,CACf,EAAE,MAAM,EAAE,MAAM,CAAC,+BAAW,CAAC,wBAAwB,CAAC,EAAE,EACxD,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAA,kBAAS,EAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC3C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,MAAc;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhD,IAAI,KAAK,CAAC,KAAK,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,GAAG,CAAC,CAAC;QAC9D,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,IAAI,CAAC;YACtB,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC;YAC3B,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAChC,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACrC;gBACE,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,SAAS,MAAM,uBAAuB,CACnE,CAAC;QACN,CAAC;IACH,CAAC;;AA5DH,kCA6DC;AAvDgB,qBAAS,GAA2B,IAAI,CAAC"}

package/dist/auth/utilities/tenant.access.d.ts

@@ -0,0 +1,8 @@
+import { EntityManager } from 'typeorm';
+export declare class TenantAccess {
+    static join(manager: EntityManager, userId: string, tenantId: string, roleIds: string[], actorId?: string): Promise<void>;
+    static reconcileRoles(manager: EntityManager, userId: string, tenantId: string, roleIds: string[], actorId?: string): Promise<void>;
+    static remove(manager: EntityManager, userId: string, tenantId: string): Promise<void>;
+    private static liveRoleIds;
+}
+//# sourceMappingURL=tenant.access.d.ts.map

package/dist/auth/utilities/tenant.access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.access.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/tenant.access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAM,MAAM,SAAS,CAAC;AAa5C,qBAAa,YAAY;WAEV,IAAI,CACf,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WA6BH,cAAc,CACzB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WA8BH,MAAM,CACjB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;mBAQK,WAAW;CAajC"}