@neohm/nestend 4.0.2 → 4.1.1

package/dist/auth/controllers/auth.controller.js

@@ -17,6 +17,8 @@ const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
 const auth_service_1 = require("../services/auth.service");
 const google_auth_service_1 = require("../services/google.auth.service");
+const tenant_membership_service_1 = require("../services/tenant.membership.service");
+const tenant_invitation_service_1 = require("../services/tenant.invitation.service");
 const login_dto_1 = require("../dtos/login.dto");
 const google_login_dto_1 = require("../dtos/google.login.dto");
 const register_dto_1 = require("../dtos/register.dto");
@@ -25,29 +27,38 @@ const change_password_dto_1 = require("../dtos/change.password.dto");
 const register_user_data_processor_1 = require("../processors/register.user.data.processor");
 const google_user_data_processor_1 = require("../processors/google.user.data.processor");
 const change_password_data_processor_1 = require("../processors/change.password.data.processor");
-const tenant_entity_1 = require("../../tenant/entities/tenant.entity");
 let AuthController = class AuthController {
-    constructor(authService, googleAuthService) {
+    constructor(authService, googleAuthService, tenantMembershipService, tenantInvitationService) {
         this.authService = authService;
         this.googleAuthService = googleAuthService;
+        this.tenantMembershipService = tenantMembershipService;
+        this.tenantInvitationService = tenantInvitationService;
     }
     async me() {
-        const { user, roles } = await this.authService.validateRole();
-        const organization = await tenant_entity_1.TenantEntity.findOne({
-            where: { id: user.organization_id },
-        });
-        return { user, roles, organization: organization.name };
+        const { user, roles } = await this.authService.validateIdentity();
+        const [current, organizations, invitations] = await Promise.all([
+            this.tenantMembershipService.sessionOrganization(user),
+            this.tenantMembershipService.organizationsOf(user.id),
+            this.tenantInvitationService.pendingFor(user),
+        ]);
+        return {
+            user,
+            roles,
+            organization: current?.name ?? null,
+            organizations,
+            invitations,
+        };
     }
     async login(dto, request) {
         const user = await this.authService.validateCredentials(dto.email, dto.password);
         this.authService.assertTenantLogin(user);
-        return this.authService.issueTokens(user, this.contextOf(request));
+        return this.signIn(user, request);
     }
     async googleLogin(dto, request) {
         const tokenInfo = await this.googleAuthService.verifyIdToken(dto.id_token);
         const user = await new google_user_data_processor_1.GoogleUserDataProcessor().process(tokenInfo);
         this.authService.assertTenantLogin(user);
-        return this.authService.issueTokens(user, this.contextOf(request));
+        return this.signIn(user, request);
     }
     async register(dto, request) {
         const user = await new register_user_data_processor_1.RegisterUserDataProcessor().process(dto);
@@ -61,10 +72,16 @@ let AuthController = class AuthController {
         return { success: true };
     }
     async changePassword(dto) {
-        const { user } = await this.authService.validateRole();
+        const { user } = await this.authService.validateIdentity();
         await new change_password_data_processor_1.ChangePasswordDataProcessor(user.id).process(dto);
         return { success: true };
     }
+    async signIn(user, request) {
+        return this.authService.issueTokens(user, {
+            ...this.contextOf(request),
+            tenant_id: await this.tenantMembershipService.landingTenant(user),
+        });
+    }
     contextOf(request) {
         return {
             ip_address: request.ip,
@@ -78,6 +95,7 @@ __decorate([
     (0, swagger_1.ApiBearerAuth)(),
     (0, swagger_1.ApiOperation)({
         summary: 'Resolve the current authenticated user and roles.',
+        description: "`roles` and `organization` belong to the session's organization. `organizations` lists every one the user may switch to, and `invitations` the pending ones addressed to them. Reachable while `user.password_change_required` is set — every other endpoint refuses until the one-time password is changed.",
     }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
@@ -87,6 +105,7 @@ __decorate([
     (0, common_1.Post)('login'),
     (0, swagger_1.ApiOperation)({
         summary: 'Authenticate and receive an access/refresh token pair.',
+        description: 'The session works in the organization last switched to, or the first the user belongs to; it has none when they belong to none.',
     }),
     __param(0, (0, common_1.Body)()),
     __param(1, (0, common_1.Req)()),
@@ -141,7 +160,10 @@ __decorate([
     (0, common_1.Post)('change-password'),
     (0, common_1.HttpCode)(common_1.HttpStatus.OK),
     (0, swagger_1.ApiBearerAuth)(),
-    (0, swagger_1.ApiOperation)({ summary: `Change the authenticated user's password.` }),
+    (0, swagger_1.ApiOperation)({
+        summary: `Change the authenticated user's password.`,
+        description: 'Also how a one-time password is replaced: send it as `current_password`. Clears `password_change_required`.',
+    }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [change_password_dto_1.ChangePasswordDto]),
@@ -151,6 +173,8 @@ exports.AuthController = AuthController = __decorate([
     (0, swagger_1.ApiTags)('Auth'),
     (0, common_1.Controller)('api/auth'),
     __metadata("design:paramtypes", [auth_service_1.AuthService,
-        google_auth_service_1.GoogleAuthService])
+        google_auth_service_1.GoogleAuthService,
+        tenant_membership_service_1.TenantMembershipService,
+        tenant_invitation_service_1.TenantInvitationService])
 ], AuthController);
 //# sourceMappingURL=auth.controller.js.map

package/dist/auth/controllers/auth.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,6CAAuE;AAEvE,2DAAuD;AACvD,yEAAoE;AAMpE,iDAA6C;AAC7C,+DAA0D;AAC1D,uDAAmD;AACnD,iEAA4D;AAC5D,qEAAgE;AAChE,6FAAuF;AACvF,yFAAmF;AACnF,iGAA2F;AAC3F,uEAAmE;AAI5D,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YACmB,WAAwB,EACxB,iBAAoC;QADpC,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAOE,AAAN,KAAK,CAAC,EAAE;QAKN,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QAC9D,MAAM,YAAY,GAAG,MAAM,4BAAY,CAAC,OAAO,CAAC;YAC9C,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,eAAe,EAAE;SACpC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,CAAC,IAAI,EAAE,CAAC;IAC1D,CAAC;IAMK,AAAN,KAAK,CAAC,KAAK,CACD,GAAa,EACd,OAAgB;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CACrD,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,QAAQ,CACb,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAMK,AAAN,KAAK,CAAC,WAAW,CACP,GAAmB,EACpB,OAAgB;QAEvB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,oDAAuB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAMK,AAAN,KAAK,CAAC,QAAQ,CACJ,GAAgB,EACjB,OAAgB;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,wDAAyB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAIK,AAAN,KAAK,CAAC,OAAO,CACH,GAAoB,EACrB,OAAgB;QAEvB,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;IASK,AAAN,KAAK,CAAC,MAAM,CAAS,GAAoB;QACvC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAMK,AAAN,KAAK,CAAC,cAAc,CACV,GAAsB;QAE9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,MAAM,IAAI,4DAA2B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAEO,SAAS,CAAC,OAAgB;QAChC,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;SAC1C,CAAC;IACJ,CAAC;CACF,CAAA;AAxGY,wCAAc;AAWnB;IALL,IAAA,YAAG,EAAC,IAAI,CAAC;IACT,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mDAAmD;KAC7D,CAAC;;;;wCAWD;AAMK;IAJL,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wDAAwD;KAClE,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,oBAAQ;;2CAStB;AAMK;IAJL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yDAAyD;KACnE,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,iCAAc;;iDAO5B;AAMK;IAJL,IAAA,aAAI,EAAC,UAAU,CAAC;IAChB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qDAAqD;KAC/D,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,0BAAW;;8CAKzB;AAIK;IAFL,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;IAE3E,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,mCAAe;;6CAI7B;AASK;IAPL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EACL,uEAAuE;KAC1E,CAAC;IACY,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,mCAAe;;4CAGxC;AAMK;IAJL,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IAEpE,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,uCAAiB;;oDAK/B;yBAhGU,cAAc;IAF1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,UAAU,CAAC;qCAGW,0BAAW;QACL,uCAAiB;GAH5C,cAAc,CAwG1B"}
+{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,6CAAuE;AAEvE,2DAAuD;AACvD,yEAAoE;AACpE,qFAAgF;AAChF,qFAAgF;AAOhF,iDAA6C;AAC7C,+DAA0D;AAC1D,uDAAmD;AACnD,iEAA4D;AAC5D,qEAAgE;AAChE,6FAAuF;AACvF,yFAAmF;AACnF,iGAA2F;AAIpF,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YACmB,WAAwB,EACxB,iBAAoC,EACpC,uBAAgD,EAChD,uBAAgD;QAHhD,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,4BAAuB,GAAvB,uBAAuB,CAAyB;IAChE,CAAC;IASE,AAAN,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAClE,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9D,IAAI,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,IAAI,CAAC;YACtD,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC;SAC9C,CAAC,CAAC;QAEH,OAAO;YACL,IAAI;YACJ,KAAK;YACL,YAAY,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;YACnC,aAAa;YACb,WAAW;SACZ,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,KAAK,CACD,GAAa,EACd,OAAgB;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CACrD,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,QAAQ,CACb,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAMK,AAAN,KAAK,CAAC,WAAW,CACP,GAAmB,EACpB,OAAgB;QAEvB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,oDAAuB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAMK,AAAN,KAAK,CAAC,QAAQ,CACJ,GAAgB,EACjB,OAAgB;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,wDAAyB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAIK,AAAN,KAAK,CAAC,OAAO,CACH,GAAoB,EACrB,OAAgB;QAEvB,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;IASK,AAAN,KAAK,CAAC,MAAM,CAAS,GAAoB;QACvC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAUK,AAAN,KAAK,CAAC,cAAc,CACV,GAAsB;QAE9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,IAAI,4DAA2B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,IAAgB,EAChB,OAAgB;QAEhB,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YACxC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC1B,SAAS,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,IAAI,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,OAAgB;QAChC,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;SAC1C,CAAC;IACJ,CAAC;CACF,CAAA;AAjIY,wCAAc;AAenB;IAPL,IAAA,YAAG,EAAC,IAAI,CAAC;IACT,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mDAAmD;QAC5D,WAAW,EACT,8SAA8S;KACjT,CAAC;;;;wCAgBD;AAQK;IANL,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wDAAwD;QACjE,WAAW,EACT,iIAAiI;KACpI,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,oBAAQ;;2CAStB;AAMK;IAJL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yDAAyD;KACnE,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,iCAAc;;iDAO5B;AAMK;IAJL,IAAA,aAAI,EAAC,UAAU,CAAC;IAChB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qDAAqD;KAC/D,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,0BAAW;;8CAKzB;AAIK;IAFL,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;IAE3E,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,mCAAe;;6CAI7B;AASK;IAPL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EACL,uEAAuE;KAC1E,CAAC;IACY,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,mCAAe;;4CAGxC;AAUK;IARL,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,6GAA6G;KAChH,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,uCAAiB;;oDAK/B;yBA/GU,cAAc;IAF1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,UAAU,CAAC;qCAGW,0BAAW;QACL,uCAAiB;QACX,mDAAuB;QACvB,mDAAuB;GALxD,cAAc,CAiI1B"}

package/dist/auth/controllers/impersonation.controller.d.ts

@@ -2,11 +2,11 @@ import type { Request } from 'express';
 import { TenantEntity } from '../../tenant/entities/tenant.entity';
 import { ImpersonationLoginDto } from '../dtos/impersonation.login.dto';
 import { ImpersonationService } from '../services/impersonation.service';
-import { ImpersonationSession } from '../types/auth.types';
+import { OrganizationSession } from '../types/auth.types';
 export declare class ImpersonationController {
     private readonly impersonationService;
     constructor(impersonationService: ImpersonationService);
-    login(dto: ImpersonationLoginDto, request: Request): Promise<ImpersonationSession>;
+    login(dto: ImpersonationLoginDto, request: Request): Promise<OrganizationSession>;
     tenants(): Promise<TenantEntity[]>;
     private contextOf;
 }

package/dist/auth/controllers/impersonation.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"impersonation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/impersonation.controller.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAqB,MAAM,qBAAqB,CAAC;AAE9E,qBAEa,uBAAuB;IACtB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;gBAApB,oBAAoB,EAAE,oBAAoB;IAQjE,KAAK,CACD,GAAG,EAAE,qBAAqB,EAC3B,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,oBAAoB,CAAC;IAW1B,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAIxC,OAAO,CAAC,SAAS;CAMlB"}
+{"version":3,"file":"impersonation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/impersonation.controller.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAqB,MAAM,qBAAqB,CAAC;AAE7E,qBAEa,uBAAuB;IACtB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;gBAApB,oBAAoB,EAAE,oBAAoB;IAQjE,KAAK,CACD,GAAG,EAAE,qBAAqB,EAC3B,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,mBAAmB,CAAC;IAWzB,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAIxC,OAAO,CAAC,SAAS;CAMlB"}

package/dist/auth/controllers/tenant.invitation.controller.d.ts

@@ -0,0 +1,18 @@
+import { CommonParamsDto } from '../../common/dtos/common.params.dto';
+import { ListFilterService } from '../../common/services/list.filter.service';
+import { InviteTenantUserDto } from '../dtos/invite.tenant.user.dto';
+import { TenantInvitationListDto } from '../dtos/tenant.invitation.list.dto';
+import { AuthService } from '../services/auth.service';
+import { TenantInvitationService } from '../services/tenant.invitation.service';
+export declare class TenantInvitationController {
+    private readonly authService;
+    private readonly tenantInvitationService;
+    private readonly listFilterService;
+    constructor(authService: AuthService, tenantInvitationService: TenantInvitationService, listFilterService: ListFilterService);
+    invite(dto: InviteTenantUserDto): Promise<import("../..").TenantInvitationEntity>;
+    roles(): Promise<import("../..").SystemRoleEntity[]>;
+    list(dto: TenantInvitationListDto): Promise<import("../..").CommonListResult>;
+    resend({ id }: CommonParamsDto): Promise<import("../..").TenantInvitationEntity>;
+    revoke({ id }: CommonParamsDto): Promise<import("../..").TenantInvitationEntity>;
+}
+//# sourceMappingURL=tenant.invitation.controller.d.ts.map

package/dist/auth/controllers/tenant.invitation.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.invitation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.invitation.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAI7E,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,qBAGa,0BAA0B;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB,EAChD,iBAAiB,EAAE,iBAAiB;IASjD,MAAM,CAAS,GAAG,EAAE,mBAAmB;IAgBvC,KAAK;IAUL,IAAI,CAAS,GAAG,EAAE,uBAAuB;IAgBzC,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAgBvC,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;CAU9C"}

package/dist/auth/controllers/tenant.invitation.controller.js

@@ -0,0 +1,120 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantInvitationController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const common_params_dto_1 = require("../../common/dtos/common.params.dto");
+const list_filter_service_1 = require("../../common/services/list.filter.service");
+const invite_tenant_user_dto_1 = require("../dtos/invite.tenant.user.dto");
+const tenant_invitation_list_dto_1 = require("../dtos/tenant.invitation.list.dto");
+const tenant_role_enum_1 = require("../enums/tenant.role.enum");
+const tenant_invitation_data_processor_1 = require("../processors/tenant.invitation.data.processor");
+const tenant_invitation_list_processor_1 = require("../processors/tenant.invitation.list.processor");
+const auth_service_1 = require("../services/auth.service");
+const tenant_invitation_service_1 = require("../services/tenant.invitation.service");
+let TenantInvitationController = class TenantInvitationController {
+    constructor(authService, tenantInvitationService, listFilterService) {
+        this.authService = authService;
+        this.tenantInvitationService = tenantInvitationService;
+        this.listFilterService = listFilterService;
+    }
+    async invite(dto) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return new tenant_invitation_data_processor_1.TenantInvitationDataProcessor(user, this.tenantInvitationService).process(dto);
+    }
+    async roles() {
+        await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return this.tenantInvitationService.grantableRoles();
+    }
+    async list(dto) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return new tenant_invitation_list_processor_1.TenantInvitationListProcessor(this.listFilterService).process({
+            ...dto,
+            tenant_id: user.organization_id,
+        });
+    }
+    async resend({ id }) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return this.tenantInvitationService.resend(id, user.organization_id, user.id);
+    }
+    async revoke({ id }) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return this.tenantInvitationService.revoke(id, user.organization_id, user.id);
+    }
+};
+exports.TenantInvitationController = TenantInvitationController;
+__decorate([
+    (0, common_1.Post)(),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Invite an email into the session organization.',
+        description: 'The roles in `role_ids` are granted in this organization when the invitee accepts. An email with no account gets one — named `full_name`, with a random one-time password mailed to it that must be changed at first sign-in. Refused for an existing member, a system account, or an email with a pending invitation here. Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [invite_tenant_user_dto_1.InviteTenantUserDto]),
+    __metadata("design:returntype", Promise)
+], TenantInvitationController.prototype, "invite", null);
+__decorate([
+    (0, common_1.Get)('roles'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Roles an invitation may grant.',
+        description: 'The active `sys_roles` catalogue, for the invite form. Requires the `global.admin` tenant role.',
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], TenantInvitationController.prototype, "roles", null);
+__decorate([
+    (0, common_1.Post)('list'),
+    (0, swagger_1.ApiOperation)({
+        summary: "List the session organization's invitations.",
+        description: 'Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [tenant_invitation_list_dto_1.TenantInvitationListDto]),
+    __metadata("design:returntype", Promise)
+], TenantInvitationController.prototype, "list", null);
+__decorate([
+    (0, common_1.Post)(':id/resend'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Give a pending invitation a fresh expiry.',
+        description: 'Also revives one that expired unanswered. When the invitation created the account and nobody has signed in to it yet, a fresh one-time password is mailed. Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:returntype", Promise)
+], TenantInvitationController.prototype, "resend", null);
+__decorate([
+    (0, common_1.Delete)(':id'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Revoke a pending invitation.',
+        description: 'Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:returntype", Promise)
+], TenantInvitationController.prototype, "revoke", null);
+exports.TenantInvitationController = TenantInvitationController = __decorate([
+    (0, swagger_1.ApiTags)('Organization Invitations'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('api/organization/invitations'),
+    __metadata("design:paramtypes", [auth_service_1.AuthService,
+        tenant_invitation_service_1.TenantInvitationService,
+        list_filter_service_1.ListFilterService])
+], TenantInvitationController);
+//# sourceMappingURL=tenant.invitation.controller.js.map

package/dist/auth/controllers/tenant.invitation.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.invitation.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.invitation.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4E;AAC5E,6CAAuE;AACvE,2EAAsE;AACtE,mFAA8E;AAC9E,2EAAqE;AACrE,mFAA6E;AAC7E,gEAAuD;AACvD,qGAA+F;AAC/F,qGAA+F;AAC/F,2DAAuD;AACvD,qFAAgF;AAMzE,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YACmB,WAAwB,EACxB,uBAAgD,EAChD,iBAAoC;QAFpC,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,MAAM,CAAS,GAAwB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,gEAA6B,CACtC,IAAI,EACJ,IAAI,CAAC,uBAAuB,CAC7B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAQK,AAAN,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,6BAAU,CAAC,YAAY,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,CAAC;IACvD,CAAC;IAOK,AAAN,KAAK,CAAC,IAAI,CAAS,GAA4B;QAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,gEAA6B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;YACvE,GAAG,GAAG;YACN,SAAS,EAAE,IAAI,CAAC,eAAe;SAChC,CAAC,CAAC;IACL,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACxC,EAAE,EACF,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAOK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACxC,EAAE,EACF,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;CACF,CAAA;AAjFY,gEAA0B;AAa/B;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EACT,sWAAsW;KACzW,CAAC;IACY,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,4CAAmB;;wDAQ5C;AAQK;IANL,IAAA,YAAG,EAAC,OAAO,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,iGAAiG;KACpG,CAAC;;;;uDAID;AAOK;IALL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,0CAA0C;KACxD,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,oDAAuB;;sDAQ9C;AAQK;IANL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,qMAAqM;KACxM,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;wDAS5C;AAOK;IALL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,0CAA0C;KACxD,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;wDAS5C;qCAhFU,0BAA0B;IAHtC,IAAA,iBAAO,EAAC,0BAA0B,CAAC;IACnC,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,8BAA8B,CAAC;qCAGT,0BAAW;QACC,mDAAuB;QAC7B,uCAAiB;GAJ5C,0BAA0B,CAiFtC"}

package/dist/auth/controllers/tenant.member.controller.d.ts

@@ -0,0 +1,18 @@
+import { ListFilterService } from '../../common/services/list.filter.service';
+import { MemberRolesDto } from '../dtos/member.roles.dto';
+import { TenantMemberListDto } from '../dtos/tenant.member.list.dto';
+import { AuthService } from '../services/auth.service';
+import { TenantMembershipService } from '../services/tenant.membership.service';
+export declare class TenantMemberController {
+    private readonly authService;
+    private readonly tenantMembershipService;
+    private readonly listFilterService;
+    constructor(authService: AuthService, tenantMembershipService: TenantMembershipService, listFilterService: ListFilterService);
+    list(dto: TenantMemberListDto): Promise<import("../..").CommonListResult>;
+    setRoles(userId: string, dto: MemberRolesDto): Promise<import("../..").SystemRoleEntity[]>;
+    deactivate(userId: string): Promise<import("../..").TenantUserEntity>;
+    reactivate(userId: string): Promise<import("../..").TenantUserEntity>;
+    remove(userId: string): Promise<import("../..").DeleteResult>;
+    private refuseSelf;
+}
+//# sourceMappingURL=tenant.member.controller.d.ts.map

package/dist/auth/controllers/tenant.member.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.member.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.member.controller.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAGrE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,qBAGa,sBAAsB;IAE/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB,EAChD,iBAAiB,EAAE,iBAAiB;IASjD,IAAI,CAAS,GAAG,EAAE,mBAAmB;IAgBrC,QAAQ,CACoB,MAAM,EAAE,MAAM,EACtC,GAAG,EAAE,cAAc;IAoBvB,UAAU,CAAiC,MAAM,EAAE,MAAM;IAoBzD,UAAU,CAAiC,MAAM,EAAE,MAAM;IAkBzD,MAAM,CAAiC,MAAM,EAAE,MAAM;IAa3D,OAAO,CAAC,UAAU;CAMnB"}

package/dist/auth/controllers/tenant.member.controller.js

@@ -0,0 +1,129 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TenantMemberController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const list_filter_service_1 = require("../../common/services/list.filter.service");
+const operation_exception_1 = require("../../global/exceptions/operation.exception");
+const member_roles_dto_1 = require("../dtos/member.roles.dto");
+const tenant_member_list_dto_1 = require("../dtos/tenant.member.list.dto");
+const tenant_role_enum_1 = require("../enums/tenant.role.enum");
+const tenant_member_list_processor_1 = require("../processors/tenant.member.list.processor");
+const auth_service_1 = require("../services/auth.service");
+const tenant_membership_service_1 = require("../services/tenant.membership.service");
+let TenantMemberController = class TenantMemberController {
+    constructor(authService, tenantMembershipService, listFilterService) {
+        this.authService = authService;
+        this.tenantMembershipService = tenantMembershipService;
+        this.listFilterService = listFilterService;
+    }
+    async list(dto) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return new tenant_member_list_processor_1.TenantMemberListProcessor(this.listFilterService).process({
+            ...dto,
+            tenant_id: user.organization_id,
+        });
+    }
+    async setRoles(userId, dto) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return this.tenantMembershipService.setMemberRoles(userId, user.organization_id, dto.role_ids, user.id);
+    }
+    async deactivate(userId) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        this.refuseSelf(userId, user.id);
+        return this.tenantMembershipService.setMemberActive(userId, user.organization_id, false, user.id);
+    }
+    async reactivate(userId) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        return this.tenantMembershipService.setMemberActive(userId, user.organization_id, true, user.id);
+    }
+    async remove(userId) {
+        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        this.refuseSelf(userId, user.id);
+        return this.tenantMembershipService.removeMember(userId, user.organization_id, user.id);
+    }
+    refuseSelf(userId, callerId) {
+        if (userId === callerId)
+            throw new operation_exception_1.OperationException('Act on your own membership by leaving the organization.');
+    }
+};
+exports.TenantMemberController = TenantMemberController;
+__decorate([
+    (0, common_1.Post)('list'),
+    (0, swagger_1.ApiOperation)({
+        summary: "List the session organization's members.",
+        description: 'Each row carries the roles held in this organization. Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [tenant_member_list_dto_1.TenantMemberListDto]),
+    __metadata("design:returntype", Promise)
+], TenantMemberController.prototype, "list", null);
+__decorate([
+    (0, common_1.Post)(':userId/roles'),
+    (0, swagger_1.ApiOperation)({
+        summary: "Replace a member's roles in the session organization.",
+        description: '`role_ids` is the complete set; omitted roles are revoked. Refused when it would leave the organization without a `global.admin`. Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Param)('userId', common_1.ParseUUIDPipe)),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, member_roles_dto_1.MemberRolesDto]),
+    __metadata("design:returntype", Promise)
+], TenantMemberController.prototype, "setRoles", null);
+__decorate([
+    (0, common_1.Post)(':userId/deactivate'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: "Deactivate a member's membership of the session organization.",
+        description: 'The member keeps their roles but can no longer work in this organization, and their credentials bound to it are revoked. Their account and other memberships are untouched. Not for the caller, and refused for the last active `global.admin`. Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Param)('userId', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], TenantMemberController.prototype, "deactivate", null);
+__decorate([
+    (0, common_1.Post)(':userId/reactivate'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: "Reactivate a member's membership of the session organization.",
+        description: 'Restores it with the roles it kept. Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Param)('userId', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], TenantMemberController.prototype, "reactivate", null);
+__decorate([
+    (0, common_1.Delete)(':userId'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Remove a member from the session organization.',
+        description: 'Ends the membership and its roles and revokes their credentials bound to this organization; the account and its other memberships stay. Not for the caller — use `POST /auth/organizations/:id/leave`. Requires the `global.admin` tenant role.',
+    }),
+    __param(0, (0, common_1.Param)('userId', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], TenantMemberController.prototype, "remove", null);
+exports.TenantMemberController = TenantMemberController = __decorate([
+    (0, swagger_1.ApiTags)('Organization Members'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('api/organization/members'),
+    __metadata("design:paramtypes", [auth_service_1.AuthService,
+        tenant_membership_service_1.TenantMembershipService,
+        list_filter_service_1.ListFilterService])
+], TenantMemberController);
+//# sourceMappingURL=tenant.member.controller.js.map

package/dist/auth/controllers/tenant.member.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.member.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.member.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAuE;AACvE,mFAA8E;AAC9E,qFAAiF;AACjF,+DAA0D;AAC1D,2EAAqE;AACrE,gEAAuD;AACvD,6FAAuF;AACvF,2DAAuD;AACvD,qFAAgF;AAMzE,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YACmB,WAAwB,EACxB,uBAAgD,EAChD,iBAAoC;QAFpC,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CAAS,GAAwB;QACzC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,wDAAyB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;YACnE,GAAG,GAAG;YACN,SAAS,EAAE,IAAI,CAAC,eAAe;SAChC,CAAC,CAAC;IACL,CAAC;IAQK,AAAN,KAAK,CAAC,QAAQ,CACoB,MAAc,EACtC,GAAmB;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAChD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,GAAG,CAAC,QAAQ,EACZ,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,UAAU,CAAiC,MAAc;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CACjD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,KAAK,EACL,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,UAAU,CAAiC,MAAc;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CACjD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,IAAI,EACJ,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAiC,MAAc;QACzD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAC9C,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAGO,UAAU,CAAC,MAAc,EAAE,QAAgB;QACjD,IAAI,MAAM,KAAK,QAAQ;YACrB,MAAM,IAAI,wCAAkB,CAC1B,yDAAyD,CAC1D,CAAC;IACN,CAAC;CACF,CAAA;AA5GY,wDAAsB;AAa3B;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0CAA0C;QACnD,WAAW,EACT,gGAAgG;KACnG,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,4CAAmB;;kDAQ1C;AAQK;IANL,IAAA,aAAI,EAAC,eAAe,CAAC;IACrB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uDAAuD;QAChE,WAAW,EACT,4KAA4K;KAC/K,CAAC;IAEC,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;IAC9B,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAM,iCAAc;;sDAW5B;AASK;IAPL,IAAA,aAAI,EAAC,oBAAoB,CAAC;IAC1B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+DAA+D;QACxE,WAAW,EACT,0RAA0R;KAC7R,CAAC;IACgB,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;wDAW/C;AASK;IAPL,IAAA,aAAI,EAAC,oBAAoB,CAAC;IAC1B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+DAA+D;QACxE,WAAW,EACT,8EAA8E;KACjF,CAAC;IACgB,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;wDAU/C;AAQK;IANL,IAAA,eAAM,EAAC,SAAS,CAAC;IACjB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EACT,iPAAiP;KACpP,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;oDAU3C;iCAnGU,sBAAsB;IAHlC,IAAA,iBAAO,EAAC,sBAAsB,CAAC;IAC/B,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,0BAA0B,CAAC;qCAGL,0BAAW;QACC,mDAAuB;QAC7B,uCAAiB;GAJ5C,sBAAsB,CA4GlC"}

package/dist/auth/controllers/user.invitation.controller.d.ts

@@ -0,0 +1,12 @@
+import { CommonParamsDto } from '../../common/dtos/common.params.dto';
+import { AuthService } from '../services/auth.service';
+import { TenantInvitationService } from '../services/tenant.invitation.service';
+export declare class UserInvitationController {
+    private readonly authService;
+    private readonly tenantInvitationService;
+    constructor(authService: AuthService, tenantInvitationService: TenantInvitationService);
+    pending(): Promise<import("../..").PendingInvitation[]>;
+    accept({ id }: CommonParamsDto): Promise<import("../..").OrganizationSummary>;
+    decline({ id }: CommonParamsDto): Promise<import("../..").TenantInvitationEntity>;
+}
+//# sourceMappingURL=user.invitation.controller.d.ts.map

package/dist/auth/controllers/user.invitation.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.invitation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/user.invitation.controller.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,qBAGa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;gBADvB,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB;IAS7D,OAAO;IAYP,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAOvC,OAAO,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;CAG/C"}

package/dist/auth/controllers/user.invitation.controller.js

@@ -0,0 +1,76 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserInvitationController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const common_params_dto_1 = require("../../common/dtos/common.params.dto");
+const auth_service_1 = require("../services/auth.service");
+const tenant_invitation_service_1 = require("../services/tenant.invitation.service");
+let UserInvitationController = class UserInvitationController {
+    constructor(authService, tenantInvitationService) {
+        this.authService = authService;
+        this.tenantInvitationService = tenantInvitationService;
+    }
+    async pending() {
+        const { user } = await this.authService.validateRole();
+        return this.tenantInvitationService.pendingFor(user);
+    }
+    async accept({ id }) {
+        return this.tenantInvitationService.accept(id);
+    }
+    async decline({ id }) {
+        return this.tenantInvitationService.decline(id);
+    }
+};
+exports.UserInvitationController = UserInvitationController;
+__decorate([
+    (0, common_1.Get)(),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Pending invitations addressed to the caller.',
+        description: 'Also returned by `GET /auth/me`. Works on a tenantless session, so a user with no organization yet can see and accept one.',
+    }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], UserInvitationController.prototype, "pending", null);
+__decorate([
+    (0, common_1.Post)(':id/accept'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Accept an invitation and join its organization.',
+        description: 'Adds the membership and the invited roles, and returns the organization. The session stays where it is — call `POST /auth/organizations/switch` to work in the new one.',
+    }),
+    __param(0, (0, common_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:returntype", Promise)
+], UserInvitationController.prototype, "accept", null);
+__decorate([
+    (0, common_1.Post)(':id/decline'),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({ summary: 'Decline an invitation.' }),
+    __param(0, (0, common_1.Param)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:returntype", Promise)
+], UserInvitationController.prototype, "decline", null);
+exports.UserInvitationController = UserInvitationController = __decorate([
+    (0, swagger_1.ApiTags)('Auth'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('api/auth/invitations'),
+    __metadata("design:paramtypes", [auth_service_1.AuthService,
+        tenant_invitation_service_1.TenantInvitationService])
+], UserInvitationController);
+//# sourceMappingURL=user.invitation.controller.js.map

package/dist/auth/controllers/user.invitation.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.invitation.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/user.invitation.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,6CAAuE;AACvE,2EAAsE;AACtE,2DAAuD;AACvD,qFAAgF;AAMzE,IAAM,wBAAwB,GAA9B,MAAM,wBAAwB;IACnC,YACmB,WAAwB,EACxB,uBAAgD;QADhD,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;IAChE,CAAC;IAQE,AAAN,KAAK,CAAC,OAAO;QACX,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IASK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC;IAKK,AAAN,KAAK,CAAC,OAAO,CAAU,EAAE,EAAE,EAAmB;QAC5C,OAAO,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC;CACF,CAAA;AAlCY,4DAAwB;AAY7B;IANL,IAAA,YAAG,GAAE;IACL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EACT,4HAA4H;KAC/H,CAAC;;;;uDAID;AASK;IAPL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iDAAiD;QAC1D,WAAW,EACT,yKAAyK;KAC5K,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;sDAE5C;AAKK;IAHL,IAAA,aAAI,EAAC,aAAa,CAAC;IACnB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC;IACrC,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;uDAE7C;mCAjCU,wBAAwB;IAHpC,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,sBAAsB,CAAC;qCAGD,0BAAW;QACC,mDAAuB;GAHxD,wBAAwB,CAkCpC"}

package/dist/auth/controllers/user.organization.controller.d.ts

@@ -0,0 +1,17 @@
+import type { Request } from 'express';
+import { CommonParamsDto } from '../../common/dtos/common.params.dto';
+import { RefreshTokenDto } from '../dtos/refresh.token.dto';
+import { SwitchOrganizationDto } from '../dtos/switch.organization.dto';
+import { AuthService } from '../services/auth.service';
+import { TenantMembershipService } from '../services/tenant.membership.service';
+import { AuthTokenPair, OrganizationSession, OrganizationSummary } from '../types/auth.types';
+export declare class UserOrganizationController {
+    private readonly authService;
+    private readonly tenantMembershipService;
+    constructor(authService: AuthService, tenantMembershipService: TenantMembershipService);
+    organizations(): Promise<OrganizationSummary[]>;
+    switch(dto: SwitchOrganizationDto, request: Request): Promise<OrganizationSession>;
+    leave({ id }: CommonParamsDto, dto: RefreshTokenDto, request: Request): Promise<AuthTokenPair>;
+    private contextOf;
+}
+//# sourceMappingURL=user.organization.controller.d.ts.map

package/dist/auth/controllers/user.organization.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.organization.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/user.organization.controller.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,mBAAmB,EAEpB,MAAM,qBAAqB,CAAC;AAG7B,qBAGa,0BAA0B;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;gBADvB,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB;IAK7D,aAAa,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;IAY/C,MAAM,CACF,GAAG,EAAE,qBAAqB,EAC3B,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,mBAAmB,CAAC;IAczB,KAAK,CACA,EAAE,EAAE,EAAE,EAAE,eAAe,EACxB,GAAG,EAAE,eAAe,EACrB,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,aAAa,CAAC;IAIzB,OAAO,CAAC,SAAS;CAMlB"}