@neohm/nestend 4.0.2 → 4.1.0

package/dist/auth/services/tenant.membership.service.js

@@ -0,0 +1,178 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantMembershipService = void 0;
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
+const access_exception_1 = require("../../global/exceptions/access.exception");
+const not_found_exception_1 = require("../../global/exceptions/not.found.exception");
+const operation_exception_1 = require("../../global/exceptions/operation.exception");
+const tenant_entity_1 = require("../../tenant/entities/tenant.entity");
+const system_role_entity_1 = require("../entities/system.role.entity");
+const tenant_user_entity_1 = require("../entities/tenant.user.entity");
+const user_entity_1 = require("../entities/user.entity");
+const user_role_entity_1 = require("../entities/user.role.entity");
+const tenant_role_enum_1 = require("../enums/tenant.role.enum");
+const user_type_enum_1 = require("../enums/user.type.enum");
+const access_revocation_1 = require("../utilities/access.revocation");
+const tenant_access_1 = require("../utilities/tenant.access");
+const auth_service_1 = require("./auth.service");
+let TenantMembershipService = class TenantMembershipService {
+    constructor(authService, dataSource) {
+        this.authService = authService;
+        this.dataSource = dataSource;
+    }
+    async organizationsOf(userId) {
+        return this.tenantRepository
+            .createQueryBuilder('t')
+            .select(['t.id', 't.name', 't.slug', 't.logo_url'])
+            .innerJoin(tenant_user_entity_1.TenantUserEntity, 'tu', 'tu.tenant_id = t.id and tu.deleted_at is null and tu.is_active = true')
+            .where('tu.user_id = :userId', { userId })
+            .andWhere('t.is_active = true')
+            .orderBy('t.name', 'ASC')
+            .getMany();
+    }
+    async sessionOrganization(user) {
+        if (!user.organization_id)
+            return null;
+        return this.tenantRepository.findOne({
+            where: { id: user.organization_id },
+            select: { id: true, name: true, slug: true, logo_url: true },
+        });
+    }
+    async landingTenant(user) {
+        if (user.user_type === user_type_enum_1.UserType.SYSTEM_USER)
+            return undefined;
+        const organizations = await this.organizationsOf(user.id);
+        const remembered = organizations.find((tenant) => tenant.id === user.organization_id);
+        return (remembered ?? organizations[0])?.id;
+    }
+    async switchOrganization(dto, context) {
+        const { user } = await this.authService.validateRole();
+        this.assertTenantUser(user);
+        const organizations = await this.organizationsOf(user.id);
+        const tenant = organizations.find((organization) => organization.id === dto.tenant_id);
+        if (!tenant)
+            throw new access_exception_1.AccessException('You are not a member of this organization.');
+        await this.authService.logout(dto.refresh_token);
+        await this.userRepository.update({ id: user.id }, { organization_id: tenant.id });
+        const tokens = await this.authService.issueTokens(user, {
+            ...context,
+            tenant_id: tenant.id,
+        });
+        return { ...tokens, tenant_id: tenant.id, tenant_name: tenant.name };
+    }
+    async leave(tenantId, dto, context) {
+        const { user } = await this.authService.validateRole();
+        this.assertTenantUser(user);
+        await this.requireMembership(user.id, tenantId);
+        await this.assertAdminRemains(tenantId, user.id);
+        await this.dataSource.transaction((trx) => tenant_access_1.TenantAccess.remove(trx, user.id, tenantId));
+        await this.authService.logout(dto.refresh_token);
+        const row = await this.userRepository.findOneByOrFail({ id: user.id });
+        return this.authService.issueTokens(row, {
+            ...context,
+            tenant_id: await this.landingTenant(row),
+        });
+    }
+    async setMemberRoles(userId, tenantId, roleIds, actorId, guardAdmin = true) {
+        await this.requireMembership(userId, tenantId);
+        await this.assertLiveRoles(roleIds);
+        if (guardAdmin)
+            await this.assertAdminRemains(tenantId, userId, roleIds);
+        await this.dataSource.transaction((trx) => tenant_access_1.TenantAccess.reconcileRoles(trx, userId, tenantId, roleIds, actorId));
+        return this.authService.tenantRoles(userId, tenantId);
+    }
+    async removeMember(userId, tenantId, actorId, guardAdmin = true) {
+        const membership = await this.requireMembership(userId, tenantId);
+        if (guardAdmin)
+            await this.assertAdminRemains(tenantId, userId);
+        await this.dataSource.transaction((trx) => tenant_access_1.TenantAccess.remove(trx, userId, tenantId));
+        return { id: membership.id, deleted: true, deleted_by: actorId };
+    }
+    async assertLiveRoles(roleIds) {
+        const unique = [...new Set(roleIds)];
+        if (!unique.length)
+            return;
+        const found = await this.dataSource
+            .getRepository(system_role_entity_1.SystemRoleEntity)
+            .findBy({ id: (0, typeorm_1.In)(unique), is_active: true });
+        const foundIds = new Set(found.map((role) => role.id));
+        const missing = unique.filter((roleId) => !foundIds.has(roleId));
+        if (missing.length)
+            throw new common_1.BadRequestException({
+                message: 'Validation failed',
+                errors: {
+                    role_ids: missing.map((roleId) => `Role '${roleId}' not found or inactive`),
+                },
+            });
+    }
+    async setMemberActive(userId, tenantId, active, actorId, guardAdmin = true) {
+        const membership = await this.requireMembership(userId, tenantId);
+        if (!active && guardAdmin)
+            await this.assertAdminRemains(tenantId, userId);
+        await this.dataSource.transaction(async (trx) => {
+            await trx.update(tenant_user_entity_1.TenantUserEntity, { id: membership.id }, { is_active: active, ...(actorId ? { updated_by: actorId } : {}) });
+            if (!active)
+                await access_revocation_1.AccessRevocation.revokeTenant(trx, userId, tenantId);
+        });
+        return this.dataSource
+            .getRepository(tenant_user_entity_1.TenantUserEntity)
+            .findOneByOrFail({ id: membership.id });
+    }
+    async requireMembership(userId, tenantId) {
+        const membership = await this.dataSource
+            .getRepository(tenant_user_entity_1.TenantUserEntity)
+            .findOne({ where: { user_id: userId, tenant_id: tenantId } });
+        if (!membership)
+            throw new not_found_exception_1.NotFoundException('No such member of this organization');
+        return membership;
+    }
+    async assertAdminRemains(tenantId, userId, nextRoleIds) {
+        const adminRole = await this.dataSource
+            .getRepository(system_role_entity_1.SystemRoleEntity)
+            .findOne({ where: { identifier: tenant_role_enum_1.TenantRole.GLOBAL_ADMIN } });
+        if (!adminRole)
+            return;
+        if (nextRoleIds?.includes(adminRole.id))
+            return;
+        const admins = await this.dataSource
+            .getRepository(user_role_entity_1.UserRoleEntity)
+            .createQueryBuilder('ur')
+            .innerJoin(tenant_user_entity_1.TenantUserEntity, 'tu', 'tu.user_id = ur.user_id and tu.tenant_id = ur.tenant_id and tu.deleted_at is null and tu.is_active = true')
+            .innerJoin(user_entity_1.UserEntity, 'u', 'u.id = ur.user_id and u.deleted_at is null')
+            .select('ur.user_id', 'user_id')
+            .where('ur.tenant_id = :tenantId', { tenantId })
+            .andWhere('ur.role_id = :roleId', { roleId: adminRole.id })
+            .distinct(true)
+            .getRawMany();
+        const isAdmin = admins.some((admin) => admin.user_id === userId);
+        if (isAdmin && admins.length === 1)
+            throw new operation_exception_1.OperationException('The organization needs at least one global.admin.');
+    }
+    assertTenantUser(user) {
+        if (user.user_type === user_type_enum_1.UserType.SYSTEM_USER)
+            throw new access_exception_1.AccessException('A global-access account changes organization through the impersonation login.');
+    }
+    get tenantRepository() {
+        return this.dataSource.getRepository(tenant_entity_1.TenantEntity);
+    }
+    get userRepository() {
+        return this.dataSource.getRepository(user_entity_1.UserEntity);
+    }
+};
+exports.TenantMembershipService = TenantMembershipService;
+exports.TenantMembershipService = TenantMembershipService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [auth_service_1.AuthService,
+        typeorm_1.DataSource])
+], TenantMembershipService);
+//# sourceMappingURL=tenant.membership.service.js.map

package/dist/auth/services/tenant.membership.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.membership.service.js","sourceRoot":"","sources":["../../../src/auth/services/tenant.membership.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAAiE;AACjE,qCAAqD;AACrD,+EAA2E;AAC3E,qFAAgF;AAChF,qFAAiF;AAEjF,uEAAmE;AAGnE,uEAAkE;AAClE,uEAAkE;AAClE,yDAAqD;AACrD,mEAA8D;AAC9D,gEAAuD;AACvD,4DAAmD;AAOnD,sEAAkE;AAClE,8DAA0D;AAC1D,iDAA6C;AAQtC,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAClC,YACmB,WAAwB,EACxB,UAAsB;QADtB,gBAAW,GAAX,WAAW,CAAa;QACxB,eAAU,GAAV,UAAU,CAAY;IACtC,CAAC;IAGJ,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,OAAO,IAAI,CAAC,gBAAgB;aACzB,kBAAkB,CAAC,GAAG,CAAC;aACvB,MAAM,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;aAClD,SAAS,CACR,qCAAgB,EAChB,IAAI,EACJ,uEAAuE,CACxE;aACA,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC;aACzC,QAAQ,CAAC,oBAAoB,CAAC;aAC9B,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC;aACxB,OAAO,EAAE,CAAC;IACf,CAAC;IAMD,KAAK,CAAC,mBAAmB,CACvB,IAAgB;QAEhB,IAAI,CAAC,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QACvC,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;YACnC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,eAAe,EAAE;YACnC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IAOD,KAAK,CAAC,aAAa,CAAC,IAAgB;QAClC,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAE9D,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CACnC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,eAAe,CAC/C,CAAC;QACF,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC9C,CAAC;IAOD,KAAK,CAAC,kBAAkB,CACtB,GAA0B,EAC1B,OAA2B;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5B,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAC/B,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,KAAK,GAAG,CAAC,SAAS,CACpD,CAAC;QACF,IAAI,CAAC,MAAM;YACT,MAAM,IAAI,kCAAe,CAAC,4CAA4C,CAAC,CAAC;QAE1E,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAC9B,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EACf,EAAE,eAAe,EAAE,MAAM,CAAC,EAAE,EAAE,CAC/B,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YACtD,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,CAAC,EAAE;SACrB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACvE,CAAC;IAOD,KAAK,CAAC,KAAK,CACT,QAAgB,EAChB,GAAoB,EACpB,OAA2B;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAEjD,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,4BAAY,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,CAC5C,CAAC;QACF,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAEjD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,EAAE;YACvC,GAAG,OAAO;YACV,SAAS,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAMD,KAAK,CAAC,cAAc,CAClB,MAAc,EACd,QAAgB,EAChB,OAAiB,EACjB,OAAgB,EAChB,UAAU,GAAG,IAAI;QAEjB,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAEzE,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,4BAAY,CAAC,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CACrE,CAAC;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACxD,CAAC;IAMD,KAAK,CAAC,YAAY,CAChB,MAAc,EACd,QAAgB,EAChB,OAAe,EACf,UAAU,GAAG,IAAI;QAEjB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAEhE,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CACxC,4BAAY,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAC3C,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;IACnE,CAAC;IAGO,KAAK,CAAC,eAAe,CAAC,OAAiB;QAC7C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO;QAE3B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU;aAChC,aAAa,CAAC,qCAAgB,CAAC;aAC/B,MAAM,CAAC,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,IAAI,4BAAmB,CAAC;gBAC5B,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EAAE;oBACN,QAAQ,EAAE,OAAO,CAAC,GAAG,CACnB,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,MAAM,yBAAyB,CACrD;iBACF;aACF,CAAC,CAAC;IACP,CAAC;IAOD,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,QAAgB,EAChB,MAAe,EACf,OAAgB,EAChB,UAAU,GAAG,IAAI;QAEjB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,IAAI,UAAU;YAAE,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAE3E,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC9C,MAAM,GAAG,CAAC,MAAM,CACd,qCAAgB,EAChB,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,EACrB,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CACnE,CAAC;YACF,IAAI,CAAC,MAAM;gBAAE,MAAM,oCAAgB,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,UAAU;aACnB,aAAa,CAAC,qCAAgB,CAAC;aAC/B,eAAe,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAC7B,MAAc,EACd,QAAgB;QAEhB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,UAAU;aACrC,aAAa,CAAC,qCAAgB,CAAC;aAC/B,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU;YACb,MAAM,IAAI,uCAAiB,CAAC,qCAAqC,CAAC,CAAC;QACrE,OAAO,UAAU,CAAC;IACpB,CAAC;IAOO,KAAK,CAAC,kBAAkB,CAC9B,QAAgB,EAChB,MAAc,EACd,WAAsB;QAEtB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,UAAU;aACpC,aAAa,CAAC,qCAAgB,CAAC;aAC/B,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,6BAAU,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS;YAAE,OAAO;QACvB,IAAI,WAAW,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,OAAO;QAEhD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU;aACjC,aAAa,CAAC,iCAAc,CAAC;aAC7B,kBAAkB,CAAC,IAAI,CAAC;aACxB,SAAS,CACR,qCAAgB,EAChB,IAAI,EACJ,2GAA2G,CAC5G;aACA,SAAS,CAAC,wBAAU,EAAE,GAAG,EAAE,4CAA4C,CAAC;aACxE,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC;aAC/B,KAAK,CAAC,0BAA0B,EAAE,EAAE,QAAQ,EAAE,CAAC;aAC/C,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC;aAC1D,QAAQ,CAAC,IAAI,CAAC;aACd,UAAU,EAAuB,CAAC;QAErC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;QACjE,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAChC,MAAM,IAAI,wCAAkB,CAC1B,mDAAmD,CACpD,CAAC;IACN,CAAC;IAEO,gBAAgB,CAAC,IAAgB;QACvC,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YACzC,MAAM,IAAI,kCAAe,CACvB,+EAA+E,CAChF,CAAC;IACN,CAAC;IAED,IAAY,gBAAgB;QAC1B,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,4BAAY,CAAC,CAAC;IACrD,CAAC;IAED,IAAY,cAAc;QACxB,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,wBAAU,CAAC,CAAC;IACnD,CAAC;CACF,CAAA;AAvQY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAGqB,0BAAW;QACZ,oBAAU;GAH9B,uBAAuB,CAuQnC"}

package/dist/auth/types/auth.types.d.ts

@@ -2,6 +2,7 @@ import type { UserEntity } from '../entities/user.entity';
 import type { SystemRoleEntity } from '../entities/system.role.entity';
 import type { AdminUserEntity } from '../entities/admin.user.entity';
 import type { SystemAdminRoleEntity } from '../entities/system.admin.role.entity';
+import type { TenantEntity } from '../../tenant/entities/tenant.entity';
 export interface RequestUser {
     userId: string;
     email: string;
@@ -42,12 +43,33 @@ export interface IssueTokensUser {
 export interface TokenIssueContext {
     ip_address?: string;
     user_agent?: string;
-    impersonated_tenant_id?: string;
+    tenant_id?: string;
 }
-export interface ImpersonationSession extends AuthTokenPair {
+export interface OrganizationSession extends AuthTokenPair {
     tenant_id: string;
     tenant_name: string;
 }
+export type OrganizationSummary = Pick<TenantEntity, 'id' | 'name' | 'slug' | 'logo_url'>;
+export interface PendingInvitation {
+    id: string;
+    tenant_id: string;
+    tenant_name: string;
+    invited_by: string | null;
+    roles: {
+        id: string;
+        identifier: string;
+        name: string;
+    }[];
+    expires_at: Date;
+    created_at: Date;
+}
+export interface CurrentUserProfile {
+    user: UserEntity;
+    roles: SystemRoleEntity[];
+    organization: string | null;
+    organizations: OrganizationSummary[];
+    invitations: PendingInvitation[];
+}
 export interface AuthModuleOptions {
     dataSourceName?: string;
 }

package/dist/auth/types/auth.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.types.d.ts","sourceRoot":"","sources":["../../../src/auth/types/auth.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAElF,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAGD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAGD,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAGD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B"}
+{"version":3,"file":"auth.types.d.ts","sourceRoot":"","sources":["../../../src/auth/types/auth.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAClF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAExE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAGD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,eAAe,CAAC;IACtB,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAGD,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAGD,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,YAAY,EACZ,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CACpC,CAAC;AAGF,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC1D,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAGD,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAE1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,EAAE,mBAAmB,EAAE,CAAC;IACrC,WAAW,EAAE,iBAAiB,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAGD,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B"}

package/dist/auth/utilities/access.revocation.d.ts

@@ -1,5 +1,7 @@
 import { EntityManager } from 'typeorm';
 export declare class AccessRevocation {
     static revokeAll(manager: EntityManager, userId: string, isAdmin: boolean): Promise<void>;
+    static revokeOrganization(manager: EntityManager, tenantId: string): Promise<void>;
+    static revokeTenant(manager: EntityManager, userId: string, tenantId: string): Promise<void>;
 }
 //# sourceMappingURL=access.revocation.d.ts.map

package/dist/auth/utilities/access.revocation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.revocation.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/access.revocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,MAAM,SAAS,CAAC;AAgBhD,qBAAa,gBAAgB;WACd,SAAS,CACpB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC;CAejB"}
+{"version":3,"file":"access.revocation.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/access.revocation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAU,MAAM,SAAS,CAAC;AAgBhD,qBAAa,gBAAgB;WACd,SAAS,CACpB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,IAAI,CAAC;WAiBH,kBAAkB,CAC7B,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WAkBH,YAAY,CACvB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;CAgBjB"}

package/dist/auth/utilities/access.revocation.js

@@ -10,6 +10,18 @@ class AccessRevocation {
         await manager.update(system_auth_session_entity_1.SystemAuthSessionEntity, { user_id: userId, is_admin: isAdmin, invalidated_at: (0, typeorm_1.IsNull)() }, { invalidated_at: now });
         await manager.update(system_refresh_token_entity_1.SystemRefreshTokenEntity, { user_id: userId, is_admin: isAdmin, revoked_at: (0, typeorm_1.IsNull)() }, { revoked_at: now });
     }
+    static async revokeOrganization(manager, tenantId) {
+        const now = new Date();
+        const where = { is_admin: false, tenant_id: tenantId };
+        await manager.update(system_auth_session_entity_1.SystemAuthSessionEntity, { ...where, invalidated_at: (0, typeorm_1.IsNull)() }, { invalidated_at: now });
+        await manager.update(system_refresh_token_entity_1.SystemRefreshTokenEntity, { ...where, revoked_at: (0, typeorm_1.IsNull)() }, { revoked_at: now });
+    }
+    static async revokeTenant(manager, userId, tenantId) {
+        const now = new Date();
+        const where = { user_id: userId, is_admin: false, tenant_id: tenantId };
+        await manager.update(system_auth_session_entity_1.SystemAuthSessionEntity, { ...where, invalidated_at: (0, typeorm_1.IsNull)() }, { invalidated_at: now });
+        await manager.update(system_refresh_token_entity_1.SystemRefreshTokenEntity, { ...where, revoked_at: (0, typeorm_1.IsNull)() }, { revoked_at: now });
+    }
 }
 exports.AccessRevocation = AccessRevocation;
 //# sourceMappingURL=access.revocation.js.map

package/dist/auth/utilities/access.revocation.js.map

@@ -1 +1 @@
-{"version":3,"file":"access.revocation.js","sourceRoot":"","sources":["../../../src/auth/utilities/access.revocation.ts"],"names":[],"mappings":";;;AAAA,qCAAgD;AAChD,uFAAiF;AACjF,yFAAmF;AAcnF,MAAa,gBAAgB;IAC3B,MAAM,CAAC,KAAK,CAAC,SAAS,CACpB,OAAsB,EACtB,MAAc,EACd,OAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,OAAO,CAAC,MAAM,CAClB,oDAAuB,EACvB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,IAAA,gBAAM,GAAE,EAAE,EAChE,EAAE,cAAc,EAAE,GAAG,EAAE,CACxB,CAAC;QAEF,MAAM,OAAO,CAAC,MAAM,CAClB,sDAAwB,EACxB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EAC5D,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;CACF;AApBD,4CAoBC"}
+{"version":3,"file":"access.revocation.js","sourceRoot":"","sources":["../../../src/auth/utilities/access.revocation.ts"],"names":[],"mappings":";;;AAAA,qCAAgD;AAChD,uFAAiF;AACjF,yFAAmF;AAcnF,MAAa,gBAAgB;IAC3B,MAAM,CAAC,KAAK,CAAC,SAAS,CACpB,OAAsB,EACtB,MAAc,EACd,OAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAEvB,MAAM,OAAO,CAAC,MAAM,CAClB,oDAAuB,EACvB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,IAAA,gBAAM,GAAE,EAAE,EAChE,EAAE,cAAc,EAAE,GAAG,EAAE,CACxB,CAAC;QAEF,MAAM,OAAO,CAAC,MAAM,CAClB,sDAAwB,EACxB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EAC5D,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAC7B,OAAsB,EACtB,QAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAEvD,MAAM,OAAO,CAAC,MAAM,CAClB,oDAAuB,EACvB,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,IAAA,gBAAM,GAAE,EAAE,EACtC,EAAE,cAAc,EAAE,GAAG,EAAE,CACxB,CAAC;QAEF,MAAM,OAAO,CAAC,MAAM,CAClB,sDAAwB,EACxB,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EAClC,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,YAAY,CACvB,OAAsB,EACtB,MAAc,EACd,QAAgB;QAEhB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAExE,MAAM,OAAO,CAAC,MAAM,CAClB,oDAAuB,EACvB,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,IAAA,gBAAM,GAAE,EAAE,EACtC,EAAE,cAAc,EAAE,GAAG,EAAE,CACxB,CAAC;QAEF,MAAM,OAAO,CAAC,MAAM,CAClB,sDAAwB,EACxB,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAA,gBAAM,GAAE,EAAE,EAClC,EAAE,UAAU,EAAE,GAAG,EAAE,CACpB,CAAC;IACJ,CAAC;CACF;AA/DD,4CA+DC"}

package/dist/auth/utilities/auth.utilities.d.ts

@@ -3,6 +3,7 @@ export declare class AuthUtility {
     static hashPassword(plain: string): Promise<string>;
     static comparePassword(plain: string, hashed: string): Promise<boolean>;
     static compareAgainstDummy(plain: string): Promise<false>;
+    static generateOneTimePassword(): string;
     static parseExpiryMs(expiry: string): number;
 }
 //# sourceMappingURL=auth.utilities.d.ts.map

package/dist/auth/utilities/auth.utilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.utilities.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/auth.utilities.ts"],"names":[],"mappings":"AAIA,qBAAa,WAAW;IAMtB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAgC;IAGxD,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKnD,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAW1D,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAM/D,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;CAqB7C"}
+{"version":3,"file":"auth.utilities.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/auth.utilities.ts"],"names":[],"mappings":"AAIA,qBAAa,WAAW;IAMtB,OAAO,CAAC,MAAM,CAAC,SAAS,CAAgC;IAGxD,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAKnD,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;WAW1D,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAO/D,MAAM,CAAC,uBAAuB,IAAI,MAAM;IAQxC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;CAqB7C"}

package/dist/auth/utilities/auth.utilities.js

@@ -16,6 +16,10 @@ class AuthUtility {
         await (0, bcrypt_1.compare)(plain, await AuthUtility.dummyHash);
         return false;
     }
+    static generateOneTimePassword() {
+        const alphabet = String(auth_default_enum_1.AuthDefault.ONE_TIME_PASSWORD_ALPHABET);
+        return Array.from({ length: Number(auth_default_enum_1.AuthDefault.ONE_TIME_PASSWORD_LENGTH) }, () => alphabet[(0, crypto_1.randomInt)(alphabet.length)]).join('');
+    }
     static parseExpiryMs(expiry) {
         const unit = expiry.slice(-1);
         const value = parseInt(expiry.slice(0, -1), 10);

package/dist/auth/utilities/auth.utilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.utilities.js","sourceRoot":"","sources":["../../../src/auth/utilities/auth.utilities.ts"],"names":[],"mappings":";;;AAAA,mCAAuC;AACvC,mCAAoC;AACpC,kEAAyD;AAEzD,MAAa,WAAW;IAStB,MAAM,CAAC,YAAY,CAAC,KAAa;QAC/B,OAAO,IAAA,aAAI,EAAC,KAAK,EAAE,+BAAW,CAAC,kBAAkB,CAAC,CAAC;IACrD,CAAC;IAGD,MAAM,CAAC,eAAe,CAAC,KAAa,EAAE,MAAc;QAClD,OAAO,IAAA,gBAAO,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IASD,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC5C,WAAW,CAAC,SAAS,KAAK,WAAW,CAAC,YAAY,CAAC,IAAA,mBAAU,GAAE,CAAC,CAAC;QACjE,MAAM,IAAA,gBAAO,EAAC,KAAK,EAAE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,MAAc;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhD,IAAI,KAAK,CAAC,KAAK,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,GAAG,CAAC,CAAC;QAC9D,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,IAAI,CAAC;YACtB,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC;YAC3B,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAChC,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACrC;gBACE,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,SAAS,MAAM,uBAAuB,CACnE,CAAC;QACN,CAAC;IACH,CAAC;;AAnDH,kCAoDC;AA9CgB,qBAAS,GAA2B,IAAI,CAAC"}
+{"version":3,"file":"auth.utilities.js","sourceRoot":"","sources":["../../../src/auth/utilities/auth.utilities.ts"],"names":[],"mappings":";;;AAAA,mCAAuC;AACvC,mCAA+C;AAC/C,kEAAyD;AAEzD,MAAa,WAAW;IAStB,MAAM,CAAC,YAAY,CAAC,KAAa;QAC/B,OAAO,IAAA,aAAI,EAAC,KAAK,EAAE,+BAAW,CAAC,kBAAkB,CAAC,CAAC;IACrD,CAAC;IAGD,MAAM,CAAC,eAAe,CAAC,KAAa,EAAE,MAAc;QAClD,OAAO,IAAA,gBAAO,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IASD,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,KAAa;QAC5C,WAAW,CAAC,SAAS,KAAK,WAAW,CAAC,YAAY,CAAC,IAAA,mBAAU,GAAE,CAAC,CAAC;QACjE,MAAM,IAAA,gBAAO,EAAC,KAAK,EAAE,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAGD,MAAM,CAAC,uBAAuB;QAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,+BAAW,CAAC,0BAA0B,CAAC,CAAC;QAChE,OAAO,KAAK,CAAC,IAAI,CACf,EAAE,MAAM,EAAE,MAAM,CAAC,+BAAW,CAAC,wBAAwB,CAAC,EAAE,EACxD,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAA,kBAAS,EAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC3C,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,MAAc;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAEhD,IAAI,KAAK,CAAC,KAAK,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,GAAG,CAAC,CAAC;QAC9D,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,IAAI,CAAC;YACtB,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,IAAI,CAAC;YAC3B,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YAChC,KAAK,GAAG;gBACN,OAAO,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;YACrC;gBACE,MAAM,IAAI,KAAK,CACb,wBAAwB,IAAI,SAAS,MAAM,uBAAuB,CACnE,CAAC;QACN,CAAC;IACH,CAAC;;AA5DH,kCA6DC;AAvDgB,qBAAS,GAA2B,IAAI,CAAC"}

package/dist/auth/utilities/tenant.access.d.ts

@@ -0,0 +1,8 @@
+import { EntityManager } from 'typeorm';
+export declare class TenantAccess {
+    static join(manager: EntityManager, userId: string, tenantId: string, roleIds: string[], actorId?: string): Promise<void>;
+    static reconcileRoles(manager: EntityManager, userId: string, tenantId: string, roleIds: string[], actorId?: string): Promise<void>;
+    static remove(manager: EntityManager, userId: string, tenantId: string): Promise<void>;
+    private static liveRoleIds;
+}
+//# sourceMappingURL=tenant.access.d.ts.map

package/dist/auth/utilities/tenant.access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.access.d.ts","sourceRoot":"","sources":["../../../src/auth/utilities/tenant.access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAM,MAAM,SAAS,CAAC;AAa5C,qBAAa,YAAY;WAEV,IAAI,CACf,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WA6BH,cAAc,CACzB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EAAE,EACjB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;WA8BH,MAAM,CACjB,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC;mBAQK,WAAW;CAajC"}

package/dist/auth/utilities/tenant.access.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantAccess = void 0;
+const typeorm_1 = require("typeorm");
+const system_role_entity_1 = require("../entities/system.role.entity");
+const tenant_user_entity_1 = require("../entities/tenant.user.entity");
+const user_role_entity_1 = require("../entities/user.role.entity");
+const access_revocation_1 = require("./access.revocation");
+class TenantAccess {
+    static async join(manager, userId, tenantId, roleIds, actorId) {
+        const membership = { user_id: userId, tenant_id: tenantId };
+        if (!(await manager.existsBy(tenant_user_entity_1.TenantUserEntity, membership)))
+            await manager.save(manager.create(tenant_user_entity_1.TenantUserEntity, {
+                ...membership,
+                created_by: actorId,
+            }));
+        const held = await manager.findBy(user_role_entity_1.UserRoleEntity, membership);
+        const heldRoleIds = new Set(held.map((grant) => grant.role_id));
+        const missing = (await TenantAccess.liveRoleIds(manager, roleIds)).filter((roleId) => !heldRoleIds.has(roleId));
+        if (missing.length)
+            await manager.save(missing.map((roleId) => manager.create(user_role_entity_1.UserRoleEntity, {
+                ...membership,
+                role_id: roleId,
+                created_by: actorId,
+            })));
+    }
+    static async reconcileRoles(manager, userId, tenantId, roleIds, actorId) {
+        const membership = { user_id: userId, tenant_id: tenantId };
+        const wanted = new Set(await TenantAccess.liveRoleIds(manager, roleIds));
+        const held = await manager.findBy(user_role_entity_1.UserRoleEntity, membership);
+        const revoked = held.filter((grant) => !wanted.has(grant.role_id));
+        if (revoked.length)
+            await manager.softDelete(user_role_entity_1.UserRoleEntity, revoked.map((grant) => grant.id));
+        const heldRoleIds = new Set(held.map((grant) => grant.role_id));
+        const granted = [...wanted].filter((roleId) => !heldRoleIds.has(roleId));
+        if (granted.length)
+            await manager.save(granted.map((roleId) => manager.create(user_role_entity_1.UserRoleEntity, {
+                ...membership,
+                role_id: roleId,
+                created_by: actorId,
+            })));
+    }
+    static async remove(manager, userId, tenantId) {
+        const membership = { user_id: userId, tenant_id: tenantId };
+        await manager.softDelete(user_role_entity_1.UserRoleEntity, membership);
+        await manager.softDelete(tenant_user_entity_1.TenantUserEntity, membership);
+        await access_revocation_1.AccessRevocation.revokeTenant(manager, userId, tenantId);
+    }
+    static async liveRoleIds(manager, roleIds) {
+        const unique = [...new Set(roleIds)];
+        if (!unique.length)
+            return [];
+        const roles = await manager.findBy(system_role_entity_1.SystemRoleEntity, {
+            id: (0, typeorm_1.In)(unique),
+            is_active: true,
+        });
+        return roles.map((role) => role.id);
+    }
+}
+exports.TenantAccess = TenantAccess;
+//# sourceMappingURL=tenant.access.js.map

package/dist/auth/utilities/tenant.access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.access.js","sourceRoot":"","sources":["../../../src/auth/utilities/tenant.access.ts"],"names":[],"mappings":";;;AAAA,qCAA4C;AAC5C,uEAAkE;AAClE,uEAAkE;AAClE,mEAA8D;AAC9D,2DAAuD;AASvD,MAAa,YAAY;IAEvB,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,OAAsB,EACtB,MAAc,EACd,QAAgB,EAChB,OAAiB,EACjB,OAAgB;QAEhB,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAE5D,IAAI,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,qCAAgB,EAAE,UAAU,CAAC,CAAC;YACzD,MAAM,OAAO,CAAC,IAAI,CAChB,OAAO,CAAC,MAAM,CAAC,qCAAgB,EAAE;gBAC/B,GAAG,UAAU;gBACb,UAAU,EAAE,OAAO;aACpB,CAAC,CACH,CAAC;QAEJ,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,iCAAc,EAAE,UAAU,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CACvE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CACrC,CAAC;QACF,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,OAAO,CAAC,IAAI,CAChB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,OAAO,CAAC,MAAM,CAAC,iCAAc,EAAE;gBAC7B,GAAG,UAAU;gBACb,OAAO,EAAE,MAAM;gBACf,UAAU,EAAE,OAAO;aACpB,CAAC,CACH,CACF,CAAC;IACN,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,cAAc,CACzB,OAAsB,EACtB,MAAc,EACd,QAAgB,EAChB,OAAiB,EACjB,OAAgB;QAEhB,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,iCAAc,EAAE,UAAU,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,OAAO,CAAC,UAAU,CACtB,iCAAc,EACd,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CACjC,CAAC;QAEJ,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAChE,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,MAAM;YAChB,MAAM,OAAO,CAAC,IAAI,CAChB,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACrB,OAAO,CAAC,MAAM,CAAC,iCAAc,EAAE;gBAC7B,GAAG,UAAU;gBACb,OAAO,EAAE,MAAM;gBACf,UAAU,EAAE,OAAO;aACpB,CAAC,CACH,CACF,CAAC;IACN,CAAC;IAMD,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,OAAsB,EACtB,MAAc,EACd,QAAgB;QAEhB,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC5D,MAAM,OAAO,CAAC,UAAU,CAAC,iCAAc,EAAE,UAAU,CAAC,CAAC;QACrD,MAAM,OAAO,CAAC,UAAU,CAAC,qCAAgB,EAAE,UAAU,CAAC,CAAC;QACvD,MAAM,oCAAgB,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;IAGO,MAAM,CAAC,KAAK,CAAC,WAAW,CAC9B,OAAsB,EACtB,OAAiB;QAEjB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAE9B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,qCAAgB,EAAE;YACnD,EAAE,EAAE,IAAA,YAAE,EAAC,MAAM,CAAC;YACd,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;CACF;AAlGD,oCAkGC"}

package/dist/common/es6.classes.d.ts

@@ -23,8 +23,8 @@ import { SystemScheduledTaskSubscriber } from './subscribers/system.scheduled.ta
 export declare const es6Classes: {
     controllers: any[];
     services: readonly [typeof AuditService, typeof CacheService, typeof EncryptionService, typeof MonitoringService, typeof QueueService, typeof RemoteRequestService, typeof SqlService, typeof SystemPropertyService];
-    libraries: (typeof CommonDataProcessor | typeof CommonListProcessor | typeof CronScheduleResolver | typeof IntervalScheduleResolver | typeof OnceScheduleResolver)[];
-    dtos: (typeof FilterDto | typeof SortDto | typeof CommonListFilterDto | typeof CommonDataDto | typeof DatabaseEventDto)[];
+    libraries: (typeof CronScheduleResolver | typeof IntervalScheduleResolver | typeof OnceScheduleResolver | typeof CommonDataProcessor | typeof CommonListProcessor)[];
+    dtos: (typeof FilterDto | typeof SortDto | typeof CommonListFilterDto | typeof DatabaseEventDto | typeof CommonDataDto)[];
     jobs: (typeof DispatchScheduledEventJob | typeof SetScheduledEventJob | typeof SystemScheduledTaskJob)[];
     subscribers: (typeof SystemScheduledTaskSubscriber)[];
 };

package/dist/constants/entity.constants.d.ts

@@ -28,5 +28,7 @@ export declare const baseEntityConstants: {
     readonly scope: "scope";
     readonly apiScope: "api.scope";
     readonly tenantScope: "tenant.scope";
+    readonly tenantUser: "tenant.user";
+    readonly tenantInvitation: "tenant.invitation";
 };
 //# sourceMappingURL=entity.constants.d.ts.map

package/dist/constants/entity.constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity.constants.d.ts","sourceRoot":"","sources":["../../src/constants/entity.constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BtB,CAAC"}
+{"version":3,"file":"entity.constants.d.ts","sourceRoot":"","sources":["../../src/constants/entity.constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCtB,CAAC"}

package/dist/constants/entity.constants.js

@@ -31,5 +31,7 @@ exports.baseEntityConstants = {
     scope: 'scope',
     apiScope: 'api.scope',
     tenantScope: 'tenant.scope',
+    tenantUser: 'tenant.user',
+    tenantInvitation: 'tenant.invitation',
 };
 //# sourceMappingURL=entity.constants.js.map

package/dist/constants/entity.constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"entity.constants.js","sourceRoot":"","sources":["../../src/constants/entity.constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,mBAAmB,GAAG;IACjC,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,aAAa;IAC1B,UAAU,EAAE,aAAa;IACzB,QAAQ,EAAE,WAAW;IACrB,kBAAkB,EAAE,sBAAsB;IAC1C,kBAAkB,EAAE,sBAAsB;IAC1C,cAAc,EAAE,iBAAiB;IACjC,eAAe,EAAE,mBAAmB;IACpC,cAAc,EAAE,iBAAiB;IACjC,kBAAkB,EAAE,qBAAqB;IACzC,cAAc,EAAE,kBAAkB;IAClC,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,iBAAiB;IACjC,WAAW,EAAE,cAAc;IAC3B,MAAM,EAAE,QAAQ;IAChB,eAAe,EAAE,mBAAmB;IACpC,MAAM,EAAE,SAAS;IACjB,cAAc,EAAE,iBAAiB;IACjC,mBAAmB,EAAE,uBAAuB;IAC5C,aAAa,EAAE,gBAAgB;IAC/B,WAAW,EAAE,cAAc;IAC3B,oBAAoB,EAAE,wBAAwB;IAC9C,SAAS,EAAE,YAAY;IACvB,eAAe,EAAE,mBAAmB;IACpC,mBAAmB,EAAE,wBAAwB;IAC7C,iBAAiB,EAAE,qBAAqB;IACxC,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,cAAc;CACnB,CAAC"}
+{"version":3,"file":"entity.constants.js","sourceRoot":"","sources":["../../src/constants/entity.constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,mBAAmB,GAAG;IACjC,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,aAAa;IAC1B,UAAU,EAAE,aAAa;IACzB,QAAQ,EAAE,WAAW;IACrB,kBAAkB,EAAE,sBAAsB;IAC1C,kBAAkB,EAAE,sBAAsB;IAC1C,cAAc,EAAE,iBAAiB;IACjC,eAAe,EAAE,mBAAmB;IACpC,cAAc,EAAE,iBAAiB;IACjC,kBAAkB,EAAE,qBAAqB;IACzC,cAAc,EAAE,kBAAkB;IAClC,QAAQ,EAAE,UAAU;IACpB,cAAc,EAAE,iBAAiB;IACjC,WAAW,EAAE,cAAc;IAC3B,MAAM,EAAE,QAAQ;IAChB,eAAe,EAAE,mBAAmB;IACpC,MAAM,EAAE,SAAS;IACjB,cAAc,EAAE,iBAAiB;IACjC,mBAAmB,EAAE,uBAAuB;IAC5C,aAAa,EAAE,gBAAgB;IAC/B,WAAW,EAAE,cAAc;IAC3B,oBAAoB,EAAE,wBAAwB;IAC9C,SAAS,EAAE,YAAY;IACvB,eAAe,EAAE,mBAAmB;IACpC,mBAAmB,EAAE,wBAAwB;IAC7C,iBAAiB,EAAE,qBAAqB;IACxC,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,cAAc;IAC3B,UAAU,EAAE,aAAa;IACzB,gBAAgB,EAAE,mBAAmB;CAC7B,CAAC"}

package/dist/constants/entity.maps.d.ts

@@ -11,6 +11,8 @@ import { SystemAuthSessionEntity } from '../auth/entities/system.auth.session.en
 import { ScopeEntity } from '../auth/entities/scope.entity';
 import { ApiScopeEntity } from '../auth/entities/api.scope.entity';
 import { TenantScopeEntity } from '../auth/entities/tenant.scope.entity';
+import { TenantUserEntity } from '../auth/entities/tenant.user.entity';
+import { TenantInvitationEntity } from '../auth/entities/tenant.invitation.entity';
 import { ActivityLogEntity } from '../common/entities/activity.log.entity';
 import { DocumentEntity } from '../document/entities/document.entity';
 import { DocumentUploadEntity } from '../document/entities/document.upload.entity';
@@ -57,5 +59,7 @@ export declare const baseEntityMaps: {
     readonly scope: typeof ScopeEntity;
     readonly "api.scope": typeof ApiScopeEntity;
     readonly "tenant.scope": typeof TenantScopeEntity;
+    readonly "tenant.user": typeof TenantUserEntity;
+    readonly "tenant.invitation": typeof TenantInvitationEntity;
 };
 //# sourceMappingURL=entity.maps.d.ts.map

package/dist/constants/entity.maps.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entity.maps.d.ts","sourceRoot":"","sources":["../../src/constants/entity.maps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAKhE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8BjB,CAAC"}
+{"version":3,"file":"entity.maps.d.ts","sourceRoot":"","sources":["../../src/constants/entity.maps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,8CAA8C,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AAClF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAC3F,OAAO,EAAE,uBAAuB,EAAE,MAAM,6CAA6C,CAAC;AACtF,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0CAA0C,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,wBAAwB,EAAE,MAAM,gDAAgD,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAC;AAC5F,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACpG,OAAO,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAKhE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgCjB,CAAC"}

package/dist/constants/entity.maps.js

@@ -14,6 +14,8 @@ const system_auth_session_entity_1 = require("../auth/entities/system.auth.sessi
 const scope_entity_1 = require("../auth/entities/scope.entity");
 const api_scope_entity_1 = require("../auth/entities/api.scope.entity");
 const tenant_scope_entity_1 = require("../auth/entities/tenant.scope.entity");
+const tenant_user_entity_1 = require("../auth/entities/tenant.user.entity");
+const tenant_invitation_entity_1 = require("../auth/entities/tenant.invitation.entity");
 const activity_log_entity_1 = require("../common/entities/activity.log.entity");
 const document_entity_1 = require("../document/entities/document.entity");
 const document_upload_entity_1 = require("../document/entities/document.upload.entity");
@@ -61,5 +63,7 @@ exports.baseEntityMaps = {
     [entity_constants_1.baseEntityConstants.scope]: scope_entity_1.ScopeEntity,
     [entity_constants_1.baseEntityConstants.apiScope]: api_scope_entity_1.ApiScopeEntity,
     [entity_constants_1.baseEntityConstants.tenantScope]: tenant_scope_entity_1.TenantScopeEntity,
+    [entity_constants_1.baseEntityConstants.tenantUser]: tenant_user_entity_1.TenantUserEntity,
+    [entity_constants_1.baseEntityConstants.tenantInvitation]: tenant_invitation_entity_1.TenantInvitationEntity,
 };
 //# sourceMappingURL=entity.maps.js.map

package/dist/constants/entity.maps.js.map

@@ -1 +1 @@
-{"version":3,"file":"entity.maps.js","sourceRoot":"","sources":["../../src/constants/entity.maps.ts"],"names":[],"mappings":";;;AAAA,oEAA+D;AAC/D,8FAAwF;AACxF,4EAAuE;AACvE,8EAAyE;AACzE,8DAA0D;AAC1D,wEAAmE;AACnE,0EAAqE;AACrE,wFAAkF;AAClF,kGAA2F;AAC3F,4FAAsF;AACtF,gEAA4D;AAC5D,wEAAmE;AACnE,8EAAyE;AACzE,gFAA2E;AAC3E,0EAAsE;AACtE,wFAAmF;AACnF,kFAA6E;AAC7E,sFAAiF;AACjF,wFAAkF;AAClF,sFAAiF;AACjF,gGAA0F;AAC1F,0FAAoF;AACpF,8FAAyF;AACzF,sFAAiF;AACjF,kGAA4F;AAC5F,0GAAoG;AACpG,0FAAqF;AACrF,gGAA0F;AAC1F,oEAAgE;AAChE,yDAAyD;AAI5C,QAAA,cAAc,GAAG;IAC5B,CAAC,sCAAmB,CAAC,IAAI,CAAC,EAAE,wBAAU;IACtC,CAAC,sCAAmB,CAAC,WAAW,CAAC,EAAE,uCAAiB;IACpD,CAAC,sCAAmB,CAAC,UAAU,CAAC,EAAE,qCAAgB;IAClD,CAAC,sCAAmB,CAAC,QAAQ,CAAC,EAAE,iCAAc;IAC9C,CAAC,sCAAmB,CAAC,kBAAkB,CAAC,EAAE,sDAAwB;IAClE,CAAC,sCAAmB,CAAC,kBAAkB,CAAC,EAAE,sDAAwB;IAClE,CAAC,sCAAmB,CAAC,cAAc,CAAC,EAAE,6CAAoB;IAC1D,CAAC,sCAAmB,CAAC,eAAe,CAAC,EAAE,gDAAqB;IAC5D,CAAC,sCAAmB,CAAC,cAAc,CAAC,EAAE,6CAAoB;IAC1D,CAAC,sCAAmB,CAAC,kBAAkB,CAAC,EAAE,qDAAwB;IAClE,CAAC,sCAAmB,CAAC,cAAc,CAAC,EAAE,8CAAoB;IAC1D,CAAC,sCAAmB,CAAC,QAAQ,CAAC,EAAE,gCAAc;IAC9C,CAAC,sCAAmB,CAAC,cAAc,CAAC,EAAE,6CAAoB;IAC1D,CAAC,sCAAmB,CAAC,WAAW,CAAC,EAAE,uCAAiB;IACpD,CAAC,sCAAmB,CAAC,MAAM,CAAC,EAAE,4BAAY;IAC1C,CAAC,sCAAmB,CAAC,eAAe,CAAC,EAAE,gDAAqB;IAC5D,CAAC,sCAAmB,CAAC,MAAM,CAAC,EAAE,6BAAY;IAC1C,CAAC,sCAAmB,CAAC,cAAc,CAAC,EAAE,6CAAoB;IAC1D,CAAC,sCAAmB,CAAC,mBAAmB,CAAC,EAAE,wDAAyB;IACpE,CAAC,sCAAmB,CAAC,aAAa,CAAC,EAAE,2CAAmB;IACxD,CAAC,sCAAmB,CAAC,WAAW,CAAC,EAAE,uCAAiB;IACpD,CAAC,sCAAmB,CAAC,oBAAoB,CAAC,EAAE,0DAA0B;IACtE,CAAC,sCAAmB,CAAC,SAAS,CAAC,EAAE,mCAAe;IAChD,CAAC,sCAAmB,CAAC,eAAe,CAAC,EAAE,gDAAqB;IAC5D,CAAC,sCAAmB,CAAC,mBAAmB,CAAC,EAAE,yDAAyB;IACpE,CAAC,sCAAmB,CAAC,iBAAiB,CAAC,EAAE,oDAAuB;IAChE,CAAC,sCAAmB,CAAC,KAAK,CAAC,EAAE,0BAAW;IACxC,CAAC,sCAAmB,CAAC,QAAQ,CAAC,EAAE,iCAAc;IAC9C,CAAC,sCAAmB,CAAC,WAAW,CAAC,EAAE,uCAAiB;CAC5C,CAAC"}
+{"version":3,"file":"entity.maps.js","sourceRoot":"","sources":["../../src/constants/entity.maps.ts"],"names":[],"mappings":";;;AAAA,oEAA+D;AAC/D,8FAAwF;AACxF,4EAAuE;AACvE,8EAAyE;AACzE,8DAA0D;AAC1D,wEAAmE;AACnE,0EAAqE;AACrE,wFAAkF;AAClF,kGAA2F;AAC3F,4FAAsF;AACtF,gEAA4D;AAC5D,wEAAmE;AACnE,8EAAyE;AACzE,4EAAuE;AACvE,wFAAmF;AACnF,gFAA2E;AAC3E,0EAAsE;AACtE,wFAAmF;AACnF,kFAA6E;AAC7E,sFAAiF;AACjF,wFAAkF;AAClF,sFAAiF;AACjF,gGAA0F;AAC1F,0FAAoF;AACpF,8FAAyF;AACzF,sFAAiF;AACjF,kGAA4F;AAC5F,0GAAoG;AACpG,0FAAqF;AACrF,gGAA0F;AAC1F,oEAAgE;AAChE,yDAAyD;AAI5C,QAAA,cAAc,GAAG;IAC5B,CAAC,sCAAmB,CAAC,IAAI,CAAC,EAAE,wBAAU;IACtC,CAAC,sCAAmB,CAAC,WAAW,CAAC,EAAE,uCAAiB;IACpD,CAAC,sCAAmB,CAAC,UAAU,CAAC,EAAE,qCAAgB;IAClD,CAAC,sCAAmB,CAAC,QAAQ,CAAC,EAAE,iCAAc;IAC9C,CAAC,sCAAmB,CAAC,kBAAkB,CAAC,EAAE,sDAAwB;IAClE,CAAC,sCAAmB,CAAC,kBAAkB,CAAC,EAAE,sDAAwB;IAClE,CAAC,sCAAmB,CAAC,cAAc,CAAC,EAAE,6CAAoB;IAC1D,CAAC,sCAAmB,CAAC,eAAe,CAAC,EAAE,gDAAqB;IAC5D,CAAC,sCAAmB,CAAC,cAAc,CAAC,EAAE,6CAAoB;IAC1D,CAAC,sCAAmB,CAAC,kBAAkB,CAAC,EAAE,qDAAwB;IAClE,CAAC,sCAAmB,CAAC,cAAc,CAAC,EAAE,8CAAoB;IAC1D,CAAC,sCAAmB,CAAC,QAAQ,CAAC,EAAE,gCAAc;IAC9C,CAAC,sCAAmB,CAAC,cAAc,CAAC,EAAE,6CAAoB;IAC1D,CAAC,sCAAmB,CAAC,WAAW,CAAC,EAAE,uCAAiB;IACpD,CAAC,sCAAmB,CAAC,MAAM,CAAC,EAAE,4BAAY;IAC1C,CAAC,sCAAmB,CAAC,eAAe,CAAC,EAAE,gDAAqB;IAC5D,CAAC,sCAAmB,CAAC,MAAM,CAAC,EAAE,6BAAY;IAC1C,CAAC,sCAAmB,CAAC,cAAc,CAAC,EAAE,6CAAoB;IAC1D,CAAC,sCAAmB,CAAC,mBAAmB,CAAC,EAAE,wDAAyB;IACpE,CAAC,sCAAmB,CAAC,aAAa,CAAC,EAAE,2CAAmB;IACxD,CAAC,sCAAmB,CAAC,WAAW,CAAC,EAAE,uCAAiB;IACpD,CAAC,sCAAmB,CAAC,oBAAoB,CAAC,EAAE,0DAA0B;IACtE,CAAC,sCAAmB,CAAC,SAAS,CAAC,EAAE,mCAAe;IAChD,CAAC,sCAAmB,CAAC,eAAe,CAAC,EAAE,gDAAqB;IAC5D,CAAC,sCAAmB,CAAC,mBAAmB,CAAC,EAAE,yDAAyB;IACpE,CAAC,sCAAmB,CAAC,iBAAiB,CAAC,EAAE,oDAAuB;IAChE,CAAC,sCAAmB,CAAC,KAAK,CAAC,EAAE,0BAAW;IACxC,CAAC,sCAAmB,CAAC,QAAQ,CAAC,EAAE,iCAAc;IAC9C,CAAC,sCAAmB,CAAC,WAAW,CAAC,EAAE,uCAAiB;IACpD,CAAC,sCAAmB,CAAC,UAAU,CAAC,EAAE,qCAAgB;IAClD,CAAC,sCAAmB,CAAC,gBAAgB,CAAC,EAAE,iDAAsB;CACtD,CAAC"}

package/dist/constants/job.constants.d.ts

@@ -4,6 +4,7 @@ export declare const baseJobConstants: {
     readonly systemScheduledTaskJob: "system.scheduled.task.job";
     readonly tenantOnboardedJob: "tenant.onboarded.job";
     readonly tenantUserOnboardedJob: "tenant.user.onboarded.job";
+    readonly tenantUserInvitedJob: "tenant.user.invited.job";
     readonly cleanOrphanDocumentsJob: "clean.orphan.documents.job";
 };
 //# sourceMappingURL=job.constants.d.ts.map

package/dist/constants/job.constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job.constants.d.ts","sourceRoot":"","sources":["../../src/constants/job.constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB;;;;;;;CAOnB,CAAC"}
+{"version":3,"file":"job.constants.d.ts","sourceRoot":"","sources":["../../src/constants/job.constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,gBAAgB;;;;;;;;CAQnB,CAAC"}

package/dist/constants/job.constants.js

@@ -7,6 +7,7 @@ exports.baseJobConstants = {
     systemScheduledTaskJob: 'system.scheduled.task.job',
     tenantOnboardedJob: 'tenant.onboarded.job',
     tenantUserOnboardedJob: 'tenant.user.onboarded.job',
+    tenantUserInvitedJob: 'tenant.user.invited.job',
     cleanOrphanDocumentsJob: 'clean.orphan.documents.job',
 };
 //# sourceMappingURL=job.constants.js.map

package/dist/constants/job.constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"job.constants.js","sourceRoot":"","sources":["../../src/constants/job.constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAG;IAC9B,oBAAoB,EAAE,yBAAyB;IAC/C,yBAAyB,EAAE,8BAA8B;IACzD,sBAAsB,EAAE,2BAA2B;IACnD,kBAAkB,EAAE,sBAAsB;IAC1C,sBAAsB,EAAE,2BAA2B;IACnD,uBAAuB,EAAE,4BAA4B;CAC7C,CAAC"}
+{"version":3,"file":"job.constants.js","sourceRoot":"","sources":["../../src/constants/job.constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,gBAAgB,GAAG;IAC9B,oBAAoB,EAAE,yBAAyB;IAC/C,yBAAyB,EAAE,8BAA8B;IACzD,sBAAsB,EAAE,2BAA2B;IACnD,kBAAkB,EAAE,sBAAsB;IAC1C,sBAAsB,EAAE,2BAA2B;IACnD,oBAAoB,EAAE,yBAAyB;IAC/C,uBAAuB,EAAE,4BAA4B;CAC7C,CAAC"}

package/dist/index.d.ts

@@ -21,6 +21,8 @@ export { ApiKeyEntity } from './auth/entities/api.key.entity';
 export { ScopeEntity } from './auth/entities/scope.entity';
 export { ApiScopeEntity } from './auth/entities/api.scope.entity';
 export { TenantScopeEntity } from './auth/entities/tenant.scope.entity';
+export { TenantUserEntity } from './auth/entities/tenant.user.entity';
+export { TenantInvitationEntity } from './auth/entities/tenant.invitation.entity';
 export { AdminUserEntity } from './auth/entities/admin.user.entity';
 export { SystemAdminRoleEntity } from './auth/entities/system.admin.role.entity';
 export { SystemAdminUserRoleEntity } from './auth/entities/system.admin.user.role.entity';
@@ -49,6 +51,8 @@ export { AdminAuth } from './auth/helpers/admin.auth';
 export { ApiKeyContext } from './auth/helpers/api.key.context';
 export { AuthService } from './auth/services/auth.service';
 export { AdminAuthService } from './auth/services/admin.auth.service';
+export { TenantMembershipService } from './auth/services/tenant.membership.service';
+export { TenantInvitationService } from './auth/services/tenant.invitation.service';
 export { AuthUtility } from './auth/utilities/auth.utilities';
 export { AccessRevocation } from './auth/utilities/access.revocation';
 export { JwtAuthGuard } from './auth/guards/jwt.auth.guard';
@@ -59,7 +63,8 @@ export { UserType } from './auth/enums/user.type.enum';
 export { GlobalAdminRoles } from './auth/enums/global.admin.roles.enum';
 export { RoleTier } from './auth/enums/role.tier.enum';
 export { TenantRole } from './auth/enums/tenant.role.enum';
-export { RequestUser, AuthenticatedAccess, AdminAuthenticatedAccess, AuthContextValue, AdminAuthContextValue, AuthTokenPair, IssueTokensUser, TokenIssueContext, } from './auth/types/auth.types';
+export { TenantInvitationStatus } from './auth/enums/tenant.invitation.status.enum';
+export { RequestUser, AuthenticatedAccess, AdminAuthenticatedAccess, AuthContextValue, AdminAuthContextValue, AuthTokenPair, IssueTokensUser, TokenIssueContext, OrganizationSession, OrganizationSummary, PendingInvitation, CurrentUserProfile, } from './auth/types/auth.types';
 export { ApiKeyService } from './auth/services/api.key.service';
 export { ApiKeyGuard } from './auth/guards/api.key.guard';
 export { ApiKeyScopes } from './auth/decorators/api.key.scopes.decorator';