@neohm/nestend 4.1.0 → 5.0.0

package/dist/admin/services/admin.access.service.js

@@ -8,13 +8,14 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+var AdminAccessService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AdminAccessService = void 0;
 const common_1 = require("@nestjs/common");
 const admin_auth_service_1 = require("../../auth/services/admin.auth.service");
 const global_admin_roles_enum_1 = require("../../auth/enums/global.admin.roles.enum");
 const access_exception_1 = require("../../global/exceptions/access.exception");
-let AdminAccessService = class AdminAccessService {
+let AdminAccessService = AdminAccessService_1 = class AdminAccessService {
     constructor(adminAuthService) {
         this.adminAuthService = adminAuthService;
     }
@@ -31,32 +32,39 @@ let AdminAccessService = class AdminAccessService {
         return this.requireRole(global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_CONTENT_READER);
     }
     holdsAtLeast(access, required) {
-        return this.highestRank(access) >= this.rankOf(required);
+        return AdminAccessService_1.holds(access, required);
+    }
+    static holds(access, required) {
+        return AdminAccessService_1.highestRank(access) >= AdminAccessService_1.rankOf(required);
+    }
+    static assertHolds(access, required, action) {
+        if (!AdminAccessService_1.holds(access, required))
+            throw new access_exception_1.AccessException(`${action} requires at least the "${required}" role.`);
     }
     async requireRole(required) {
         const access = await this.adminAuthService.validateRole();
-        if (this.highestRank(access) < this.rankOf(required)) {
+        if (!AdminAccessService_1.holds(access, required)) {
             throw new access_exception_1.AccessException(`This action requires at least the "${required}" role.`);
         }
         return access;
     }
-    highestRank(access) {
+    static highestRank(access) {
         let highest = 0;
         for (const role of access.roles) {
-            const rank = this.rankOf(role.identifier);
+            const rank = AdminAccessService_1.rankOf(role.identifier);
             if (rank > highest)
                 highest = rank;
         }
         return highest;
     }
-    rankOf(roleIdentifier) {
+    static rankOf(roleIdentifier) {
         const seniority = Object.values(global_admin_roles_enum_1.GlobalAdminRoles);
         const index = seniority.indexOf(roleIdentifier);
         return index === -1 ? 0 : seniority.length - index;
     }
 };
 exports.AdminAccessService = AdminAccessService;
-exports.AdminAccessService = AdminAccessService = __decorate([
+exports.AdminAccessService = AdminAccessService = AdminAccessService_1 = __decorate([
     (0, common_1.Injectable)(),
     __metadata("design:paramtypes", [admin_auth_service_1.AdminAuthService])
 ], AdminAccessService);

package/dist/admin/services/admin.access.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.access.service.js","sourceRoot":"","sources":["../../../src/admin/services/admin.access.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAC5C,+EAA0E;AAE1E,sFAA4E;AAC5E,+EAA2E;AAiBpE,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B,YAA6B,gBAAkC;QAAlC,qBAAgB,GAAhB,gBAAgB,CAAkB;IAAG,CAAC;IAGnE,kBAAkB;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC,0CAAgB,CAAC,kBAAkB,CAAC,CAAC;IAC/D,CAAC;IAGD,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC,0CAAgB,CAAC,YAAY,CAAC,CAAC;IACzD,CAAC;IAGD,sBAAsB;QACpB,OAAO,IAAI,CAAC,WAAW,CAAC,0CAAgB,CAAC,sBAAsB,CAAC,CAAC;IACnE,CAAC;IAGD,qBAAqB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,0CAAgB,CAAC,qBAAqB,CAAC,CAAC;IAClE,CAAC;IAOD,YAAY,CACV,MAAgC,EAChC,QAA0B;QAE1B,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,QAA0B;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;QAC1D,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,kCAAe,CACvB,sCAAsC,QAAQ,SAAS,CACxD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAGO,WAAW,CAAC,MAAgC;QAClD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1C,IAAI,IAAI,GAAG,OAAO;gBAAE,OAAO,GAAG,IAAI,CAAC;QACrC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAOO,MAAM,CAAC,cAAsB;QACnC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,0CAAgB,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,cAAkC,CAAC,CAAC;QACpE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC;IACrD,CAAC;CACF,CAAA;AAnEY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAEoC,qCAAgB;GADpD,kBAAkB,CAmE9B"}
+{"version":3,"file":"admin.access.service.js","sourceRoot":"","sources":["../../../src/admin/services/admin.access.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAA4C;AAC5C,+EAA0E;AAE1E,sFAA4E;AAC5E,+EAA2E;AAiBpE,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAC7B,YAA6B,gBAAkC;QAAlC,qBAAgB,GAAhB,gBAAgB,CAAkB;IAAG,CAAC;IAGnE,kBAAkB;QAChB,OAAO,IAAI,CAAC,WAAW,CAAC,0CAAgB,CAAC,kBAAkB,CAAC,CAAC;IAC/D,CAAC;IAGD,aAAa;QACX,OAAO,IAAI,CAAC,WAAW,CAAC,0CAAgB,CAAC,YAAY,CAAC,CAAC;IACzD,CAAC;IAGD,sBAAsB;QACpB,OAAO,IAAI,CAAC,WAAW,CAAC,0CAAgB,CAAC,sBAAsB,CAAC,CAAC;IACnE,CAAC;IAGD,qBAAqB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,0CAAgB,CAAC,qBAAqB,CAAC,CAAC;IAClE,CAAC;IAGD,YAAY,CACV,MAAgC,EAChC,QAA0B;QAE1B,OAAO,oBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;IAGD,MAAM,CAAC,KAAK,CACV,MAAgC,EAChC,QAA0B;QAE1B,OAAO,oBAAkB,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,oBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvF,CAAC;IAGD,MAAM,CAAC,WAAW,CAChB,MAAgC,EAChC,QAA0B,EAC1B,MAAc;QAEd,IAAI,CAAC,oBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;YAC7C,MAAM,IAAI,kCAAe,CACvB,GAAG,MAAM,2BAA2B,QAAQ,SAAS,CACtD,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,WAAW,CACvB,QAA0B;QAE1B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,EAAE,CAAC;QAC1D,IAAI,CAAC,oBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,kCAAe,CACvB,sCAAsC,QAAQ,SAAS,CACxD,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAGO,MAAM,CAAC,WAAW,CAAC,MAAgC;QACzD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,oBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACxD,IAAI,IAAI,GAAG,OAAO;gBAAE,OAAO,GAAG,IAAI,CAAC;QACrC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAOO,MAAM,CAAC,MAAM,CAAC,cAAsB;QAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,0CAAgB,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,cAAkC,CAAC,CAAC;QACpE,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,KAAK,CAAC;IACrD,CAAC;CACF,CAAA;AAnFY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;qCAEoC,qCAAgB;GADpD,kBAAkB,CAmF9B"}

package/dist/admin/services/system.user.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system.user.service.d.ts","sourceRoot":"","sources":["../../../src/admin/services/system.user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAMxE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,qBACa,iBAAiB;IAMtB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;CAaxE"}
+{"version":3,"file":"system.user.service.d.ts","sourceRoot":"","sources":["../../../src/admin/services/system.user.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAQxE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAKpD,qBACa,iBAAiB;IAMtB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;CAoBxE"}

package/dist/admin/services/system.user.service.js

@@ -13,6 +13,10 @@ const user_type_enum_1 = require("../../auth/enums/user.type.enum");
 const access_revocation_1 = require("../../auth/utilities/access.revocation");
 const not_found_exception_1 = require("../../global/exceptions/not.found.exception");
 const operation_exception_1 = require("../../global/exceptions/operation.exception");
+const audit_action_enum_1 = require("../../common/enums/audit.action.enum");
+const entity_constants_1 = require("../../constants/entity.constants");
+const admin_audit_1 = require("../utilities/admin.audit");
+const user_data_processor_1 = require("../libraries/user.data.processor");
 let SystemUserService = class SystemUserService {
     async delete(id, actor) {
         const user = await user_entity_1.UserEntity.findOne({ where: { id } });
@@ -23,6 +27,13 @@ let SystemUserService = class SystemUserService {
         await user_entity_1.UserEntity.getRepository().manager.transaction(async (trx) => {
             await access_revocation_1.AccessRevocation.revokeAll(trx, id, false);
             await trx.softDelete(user_entity_1.UserEntity, { id });
+            await admin_audit_1.AdminAudit.record(trx, {
+                actor,
+                sourceType: entity_constants_1.baseEntityConstants.user,
+                sourceId: id,
+                action: audit_action_enum_1.AuditAction.SOFT_DELETE,
+                oldValue: admin_audit_1.AdminAudit.pick(user, user_data_processor_1.UserDataProcessor.AUDITED),
+            });
         });
         return { id, deleted: true, deleted_by: actor.id };
     }

package/dist/admin/services/system.user.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"system.user.service.js","sourceRoot":"","sources":["../../../src/admin/services/system.user.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4C;AAE5C,iEAA6D;AAC7D,oEAA2D;AAC3D,8EAA0E;AAC1E,qFAAgF;AAChF,qFAAiF;AAK1E,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAM5B,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAAsB;QAC7C,MAAM,IAAI,GAAG,MAAM,wBAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,uCAAiB,CAAC,4BAA4B,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YACzC,MAAM,IAAI,wCAAkB,CAAC,gCAAgC,CAAC,CAAC;QAEjE,MAAM,wBAAU,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,oCAAgB,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YACjD,MAAM,GAAG,CAAC,UAAU,CAAC,wBAAU,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IACrD,CAAC;CACF,CAAA;AAnBY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;GACA,iBAAiB,CAmB7B"}
+{"version":3,"file":"system.user.service.js","sourceRoot":"","sources":["../../../src/admin/services/system.user.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4C;AAE5C,iEAA6D;AAC7D,oEAA2D;AAC3D,8EAA0E;AAC1E,qFAAgF;AAChF,qFAAiF;AACjF,4EAAmE;AACnE,uEAAuE;AAEvE,0DAAsD;AACtD,0EAAqE;AAI9D,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAM5B,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAAsB;QAC7C,MAAM,IAAI,GAAG,MAAM,wBAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,uCAAiB,CAAC,4BAA4B,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YACzC,MAAM,IAAI,wCAAkB,CAAC,gCAAgC,CAAC,CAAC;QAEjE,MAAM,wBAAU,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,oCAAgB,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YACjD,MAAM,GAAG,CAAC,UAAU,CAAC,wBAAU,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACzC,MAAM,wBAAU,CAAC,MAAM,CAAC,GAAG,EAAE;gBAC3B,KAAK;gBACL,UAAU,EAAE,sCAAmB,CAAC,IAAI;gBACpC,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,+BAAW,CAAC,WAAW;gBAC/B,QAAQ,EAAE,wBAAU,CAAC,IAAI,CAAC,IAAI,EAAE,uCAAiB,CAAC,OAAO,CAAC;aAC3D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IACrD,CAAC;CACF,CAAA;AA1BY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;GACA,iBAAiB,CA0B7B"}

package/dist/admin/services/template.service.d.ts

@@ -3,5 +3,6 @@ import { DeleteResult } from '../types/admin.types';
 export declare class TemplateService {
     deleteEmailTemplate(id: string, actor: AdminUserEntity): Promise<DeleteResult>;
     deletePdfTemplate(id: string, actor: AdminUserEntity): Promise<DeleteResult>;
+    private softDeleteById;
 }
 //# sourceMappingURL=template.service.d.ts.map

package/dist/admin/services/template.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template.service.d.ts","sourceRoot":"","sources":["../../../src/admin/services/template.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAIxE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAepD,qBACa,eAAe;IAEpB,mBAAmB,CACvB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,YAAY,CAAC;IAUlB,iBAAiB,CACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,YAAY,CAAC;CAQzB"}
+{"version":3,"file":"template.service.d.ts","sourceRoot":"","sources":["../../../src/admin/services/template.service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAMxE,OAAO,EAAE,YAAY,EAAe,MAAM,sBAAsB,CAAC;AAOjE,qBACa,eAAe;IAC1B,mBAAmB,CACjB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,YAAY,CAAC;IAUxB,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;YAU9D,cAAc;CAwB7B"}

package/dist/admin/services/template.service.js

@@ -8,22 +8,35 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TemplateService = void 0;
 const common_1 = require("@nestjs/common");
+const audit_action_enum_1 = require("../../common/enums/audit.action.enum");
+const entity_constants_1 = require("../../constants/entity.constants");
 const pdf_template_entity_1 = require("../../document/entities/pdf.template.entity");
 const email_template_entity_1 = require("../../notification/entities/email.template.entity");
 const not_found_exception_1 = require("../../global/exceptions/not.found.exception");
+const admin_audit_1 = require("../utilities/admin.audit");
 let TemplateService = class TemplateService {
-    async deleteEmailTemplate(id, actor) {
-        const emailTemplate = await email_template_entity_1.EmailTemplateEntity.findOne({ where: { id } });
-        if (!emailTemplate)
-            throw new not_found_exception_1.NotFoundException('No email template exists for this id');
-        await emailTemplate.softDelete();
-        return { id, deleted: true, deleted_by: actor.id };
+    deleteEmailTemplate(id, actor) {
+        return this.softDeleteById(email_template_entity_1.EmailTemplateEntity, entity_constants_1.baseEntityConstants.emailTemplate, 'email template', id, actor);
+    }
+    deletePdfTemplate(id, actor) {
+        return this.softDeleteById(pdf_template_entity_1.PdfTemplateEntity, entity_constants_1.baseEntityConstants.pdfTemplate, 'PDF template', id, actor);
     }
-    async deletePdfTemplate(id, actor) {
-        const pdfTemplate = await pdf_template_entity_1.PdfTemplateEntity.findOne({ where: { id } });
-        if (!pdfTemplate)
-            throw new not_found_exception_1.NotFoundException('No PDF template exists for this id');
-        await pdfTemplate.softDelete();
+    async softDeleteById(target, sourceType, label, id, actor) {
+        const entity = target;
+        await target.getRepository().manager.transaction(async (trx) => {
+            const template = await trx.findOne(entity, { where: { id } });
+            if (!template)
+                throw new not_found_exception_1.NotFoundException(`No ${label} exists for this id`);
+            await trx.update(entity, { id }, { updated_by: actor.id });
+            await trx.softDelete(entity, { id });
+            await admin_audit_1.AdminAudit.record(trx, {
+                actor,
+                sourceType,
+                sourceId: id,
+                action: audit_action_enum_1.AuditAction.SOFT_DELETE,
+                oldValue: admin_audit_1.AdminAudit.pick(template, ['identifier', 'path']),
+            });
+        });
         return { id, deleted: true, deleted_by: actor.id };
     }
 };

package/dist/admin/services/template.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"template.service.js","sourceRoot":"","sources":["../../../src/admin/services/template.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4C;AAE5C,qFAAgF;AAChF,6FAAwF;AACxF,qFAAgF;AAiBzE,IAAM,eAAe,GAArB,MAAM,eAAe;IAE1B,KAAK,CAAC,mBAAmB,CACvB,EAAU,EACV,KAAsB;QAEtB,MAAM,aAAa,GAAG,MAAM,2CAAmB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3E,IAAI,CAAC,aAAa;YAChB,MAAM,IAAI,uCAAiB,CAAC,sCAAsC,CAAC,CAAC;QAEtE,MAAM,aAAa,CAAC,UAAU,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IACrD,CAAC;IAGD,KAAK,CAAC,iBAAiB,CACrB,EAAU,EACV,KAAsB;QAEtB,MAAM,WAAW,GAAG,MAAM,uCAAiB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,WAAW;YACd,MAAM,IAAI,uCAAiB,CAAC,oCAAoC,CAAC,CAAC;QAEpE,MAAM,WAAW,CAAC,UAAU,EAAE,CAAC;QAC/B,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IACrD,CAAC;CACF,CAAA;AA1BY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;GACA,eAAe,CA0B3B"}
+{"version":3,"file":"template.service.js","sourceRoot":"","sources":["../../../src/admin/services/template.service.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAA4C;AAG5C,4EAAmE;AACnE,uEAAuE;AACvE,qFAAgF;AAChF,6FAAwF;AACxF,qFAAgF;AAEhF,0DAAsD;AAO/C,IAAM,eAAe,GAArB,MAAM,eAAe;IAC1B,mBAAmB,CACjB,EAAU,EACV,KAAsB;QAEtB,OAAO,IAAI,CAAC,cAAc,CACxB,2CAAmB,EACnB,sCAAmB,CAAC,aAAa,EACjC,gBAAgB,EAChB,EAAE,EACF,KAAK,CACN,CAAC;IACJ,CAAC;IAED,iBAAiB,CAAC,EAAU,EAAE,KAAsB;QAClD,OAAO,IAAI,CAAC,cAAc,CACxB,uCAAiB,EACjB,sCAAmB,CAAC,WAAW,EAC/B,cAAc,EACd,EAAE,EACF,KAAK,CACN,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,cAAc,CAC1B,MAA6D,EAC7D,UAAkB,EAClB,KAAa,EACb,EAAU,EACV,KAAsB;QAEtB,MAAM,MAAM,GAA8B,MAAM,CAAC;QACjD,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YAC7D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,uCAAiB,CAAC,MAAM,KAAK,qBAAqB,CAAC,CAAC;YAE7E,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACrC,MAAM,wBAAU,CAAC,MAAM,CAAC,GAAG,EAAE;gBAC3B,KAAK;gBACL,UAAU;gBACV,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,+BAAW,CAAC,WAAW;gBAC/B,QAAQ,EAAE,wBAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IACrD,CAAC;CACF,CAAA;AAhDY,0CAAe;0BAAf,eAAe;IAD3B,IAAA,mBAAU,GAAE;GACA,eAAe,CAgD3B"}

package/dist/admin/types/admin.types.d.ts

@@ -1,7 +1,12 @@
+import type { AdminUserEntity } from '../../auth/entities/admin.user.entity';
 import type { ApiKeyEntity } from '../../auth/entities/api.key.entity';
+import type { SystemAdminRoleEntity } from '../../auth/entities/system.admin.role.entity';
 import type { ScopeEntity } from '../../auth/entities/scope.entity';
 import type { UserEntity } from '../../auth/entities/user.entity';
 import type { TenantEntity } from '../../tenant/entities/tenant.entity';
+import type { CommonAdminEntity } from '../../common/entities/common.admin.entity';
+import type { ScheduleSpec } from '../../common/types/schedule.types';
+import type { AuditAction } from '../../common/enums/audit.action.enum';
 export type { DeleteResult, DisableResult, } from '../../common/types/common.response.types';
 export interface AdminModuleOptions {
     dataSourceName?: string;
@@ -17,4 +22,26 @@ export interface IssuedApiKey {
 export type TenantDetail = TenantEntity & {
     scopes: ScopeEntity[];
 };
+export type AdminUserDetail = AdminUserEntity & {
+    roles: SystemAdminRoleEntity[];
+};
+export type TemplateRow = CommonAdminEntity & {
+    identifier: string;
+    path: string;
+};
+export interface SchedulingIntent {
+    schedule: ScheduleSpec;
+    timezone: string;
+    start_from: Date;
+}
+export type AdminAuditValue = Record<string, unknown> | null | undefined;
+export interface AdminAuditEntry {
+    actor: Pick<AdminUserEntity, 'id'>;
+    sourceType: string;
+    sourceId: string;
+    action: AuditAction | string;
+    oldValue?: AdminAuditValue;
+    newValue?: AdminAuditValue;
+    context?: Record<string, unknown>;
+}
 //# sourceMappingURL=admin.types.d.ts.map

package/dist/admin/types/admin.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.types.d.ts","sourceRoot":"","sources":["../../../src/admin/types/admin.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAGxE,YAAY,EACV,YAAY,EACZ,aAAa,GACd,MAAM,0CAA0C,CAAC;AAElD,MAAM,WAAW,kBAAkB;IACjC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAMD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAGD,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG;IAAE,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC"}
+{"version":3,"file":"admin.types.d.ts","sourceRoot":"","sources":["../../../src/admin/types/admin.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACxE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AACnF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sCAAsC,CAAC;AAGxE,YAAY,EACV,YAAY,EACZ,aAAa,GACd,MAAM,0CAA0C,CAAC;AAElD,MAAM,WAAW,kBAAkB;IACjC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAGD,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAGD,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,YAAY,CAAC;CACvB;AAGD,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG;IAAE,MAAM,EAAE,WAAW,EAAE,CAAA;CAAE,CAAC;AAGpE,MAAM,MAAM,eAAe,GAAG,eAAe,GAAG;IAC9C,KAAK,EAAE,qBAAqB,EAAE,CAAC;CAChC,CAAC;AAGF,MAAM,MAAM,WAAW,GAAG,iBAAiB,GAAG;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAGF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,YAAY,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;CAClB;AAGD,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;AAEzE,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAEnC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,eAAe,CAAC;IAE3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC"}

package/dist/admin/utilities/admin.audit.d.ts

@@ -0,0 +1,11 @@
+import { EntityManager } from 'typeorm';
+import { AdminAuditEntry, AdminAuditValue } from '../types/admin.types';
+export declare class AdminAudit {
+    static record(manager: EntityManager, entry: AdminAuditEntry): Promise<void>;
+    static pick<T extends object>(entity: T | null | undefined, fields: (keyof T)[]): Record<string, unknown> | null;
+    static diff(oldValue: AdminAuditValue, newValue: AdminAuditValue): {
+        oldValue: AdminAuditValue;
+        newValue: AdminAuditValue;
+    };
+}
+//# sourceMappingURL=admin.audit.d.ts.map

package/dist/admin/utilities/admin.audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.audit.d.ts","sourceRoot":"","sources":["../../../src/admin/utilities/admin.audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAOxE,qBAAa,UAAU;WACR,MAAM,CACjB,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,eAAe,GACrB,OAAO,CAAC,IAAI,CAAC;IAsBhB,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,MAAM,EAC1B,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,SAAS,EAC5B,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAClB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAQjC,MAAM,CAAC,IAAI,CACT,QAAQ,EAAE,eAAe,EACzB,QAAQ,EAAE,eAAe,GACxB;QAAE,QAAQ,EAAE,eAAe,CAAC;QAAC,QAAQ,EAAE,eAAe,CAAA;KAAE;CAe5D"}

package/dist/admin/utilities/admin.audit.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminAudit = void 0;
+const system_audit_log_entity_1 = require("../../common/entities/system.audit.log.entity");
+class AdminAudit {
+    static async record(manager, entry) {
+        const { oldValue, newValue } = AdminAudit.diff(entry.oldValue, entry.newValue);
+        const row = {
+            source_type: entry.sourceType,
+            source_id: entry.sourceId,
+            action: entry.action,
+            user_id: entry.actor.id,
+            attributes: {
+                actor_type: 'admin',
+                admin_user_id: entry.actor.id,
+                ...(entry.context ?? {}),
+            },
+        };
+        if (oldValue)
+            row.old_value = oldValue;
+        if (newValue)
+            row.new_value = newValue;
+        await manager.insert(system_audit_log_entity_1.SystemAuditLogEntity, row);
+    }
+    static pick(entity, fields) {
+        if (!entity)
+            return null;
+        const value = {};
+        for (const field of fields)
+            value[field] = entity[field] ?? null;
+        return value;
+    }
+    static diff(oldValue, newValue) {
+        if (!oldValue || !newValue)
+            return { oldValue, newValue };
+        const changedOld = {};
+        const changedNew = {};
+        for (const key of new Set([
+            ...Object.keys(oldValue),
+            ...Object.keys(newValue),
+        ])) {
+            if (JSON.stringify(oldValue[key]) !== JSON.stringify(newValue[key])) {
+                changedOld[key] = oldValue[key];
+                changedNew[key] = newValue[key];
+            }
+        }
+        return { oldValue: changedOld, newValue: changedNew };
+    }
+}
+exports.AdminAudit = AdminAudit;
+//# sourceMappingURL=admin.audit.js.map

package/dist/admin/utilities/admin.audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.audit.js","sourceRoot":"","sources":["../../../src/admin/utilities/admin.audit.ts"],"names":[],"mappings":";;;AACA,2FAAqF;AAQrF,MAAa,UAAU;IACrB,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,OAAsB,EACtB,KAAsB;QAEtB,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,UAAU,CAAC,IAAI,CAC5C,KAAK,CAAC,QAAQ,EACd,KAAK,CAAC,QAAQ,CACf,CAAC;QACF,MAAM,GAAG,GAAkC;YACzC,WAAW,EAAE,KAAK,CAAC,UAAU;YAC7B,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;YACvB,UAAU,EAAE;gBACV,UAAU,EAAE,OAAO;gBACnB,aAAa,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE;gBAC7B,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;aACzB;SACF,CAAC;QACF,IAAI,QAAQ;YAAE,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC;QACvC,IAAI,QAAQ;YAAE,GAAG,CAAC,SAAS,GAAG,QAAQ,CAAC;QACvC,MAAM,OAAO,CAAC,MAAM,CAAC,8CAAoB,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IAGD,MAAM,CAAC,IAAI,CACT,MAA4B,EAC5B,MAAmB;QAEnB,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,KAAK,CAAC,KAAe,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IAGD,MAAM,CAAC,IAAI,CACT,QAAyB,EACzB,QAAyB;QAEzB,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAC1D,MAAM,UAAU,GAA4B,EAAE,CAAC;QAC/C,MAAM,UAAU,GAA4B,EAAE,CAAC;QAC/C,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC;YACxB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;YACxB,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;SACzB,CAAC,EAAE,CAAC;YACH,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACpE,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAChC,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACxD,CAAC;CACF;AAvDD,gCAuDC"}

package/dist/admin/utilities/admin.policy.d.ts

@@ -0,0 +1,33 @@
+import { GlobalAdminRoles } from '../../auth/enums/global.admin.roles.enum';
+export declare class AdminPolicy {
+    static changedFields<T extends object>(current: T, next: Partial<T>, fields: (keyof T)[]): (keyof T)[];
+    static scopeDeleteRole(childCount: number, grantCount: number): GlobalAdminRoles;
+    static scopeSaveRole(input: {
+        isNew: boolean;
+        parentChanged: boolean;
+        parentHasGrants: boolean;
+    }): GlobalAdminRoles;
+    static scheduledTaskSaveRole(input: {
+        isNew: boolean;
+        identifierChanged: boolean;
+        payloadChanged: boolean;
+    }): GlobalAdminRoles;
+    static intervalAllowed(intervalMs: number): boolean;
+    static cronAllowed(expression: string | undefined): boolean;
+    static apiKeyExpiry(requested: string | undefined, now?: Date): {
+        expiresAt: Date | null;
+        error?: string;
+    };
+    static manualGrantExpiry(requested: string | undefined, now?: Date): {
+        expiresAt: Date | null;
+        error?: string;
+    };
+    static superAdminEditError(input: {
+        actorId: string;
+        targetId: string;
+        holders: string[];
+        targetKeepsSuper: boolean;
+    }): string | null;
+    static isLastSuperAdmin(targetId: string, holders: string[]): boolean;
+}
+//# sourceMappingURL=admin.policy.d.ts.map

package/dist/admin/utilities/admin.policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.policy.d.ts","sourceRoot":"","sources":["../../../src/admin/utilities/admin.policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAI5E,qBAAa,WAAW;IAEtB,MAAM,CAAC,aAAa,CAAC,CAAC,SAAS,MAAM,EACnC,OAAO,EAAE,CAAC,EACV,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAChB,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,GAClB,CAAC,MAAM,CAAC,CAAC,EAAE;IASd,MAAM,CAAC,eAAe,CACpB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,GACjB,gBAAgB;IAUnB,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE;QAC1B,KAAK,EAAE,OAAO,CAAC;QACf,aAAa,EAAE,OAAO,CAAC;QACvB,eAAe,EAAE,OAAO,CAAC;KAC1B,GAAG,gBAAgB;IASpB,MAAM,CAAC,qBAAqB,CAAC,KAAK,EAAE;QAClC,KAAK,EAAE,OAAO,CAAC;QACf,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,OAAO,CAAC;KACzB,GAAG,gBAAgB;IAOpB,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO;IAKnD,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO;IAS3D,MAAM,CAAC,YAAY,CACjB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,GAAE,IAAiB,GACrB;QAAE,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IA0B7C,MAAM,CAAC,iBAAiB,CACtB,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,GAAG,GAAE,IAAiB,GACrB;QAAE,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IA2B7C,MAAM,CAAC,mBAAmB,CAAC,KAAK,EAAE;QAChC,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,gBAAgB,EAAE,OAAO,CAAC;KAC3B,GAAG,MAAM,GAAG,IAAI;IAWjB,MAAM,CAAC,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO;CAMtE"}

package/dist/admin/utilities/admin.policy.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminPolicy = void 0;
+const global_admin_roles_enum_1 = require("../../auth/enums/global.admin.roles.enum");
+const admin_default_enum_1 = require("../enums/admin.default.enum");
+class AdminPolicy {
+    static changedFields(current, next, fields) {
+        return fields.filter((field) => next[field] !== undefined &&
+            (next[field] ?? null) !== (current[field] ?? null));
+    }
+    static scopeDeleteRole(childCount, grantCount) {
+        return childCount > 0 || grantCount > 0
+            ? global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_SUPER_ADMIN
+            : global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_ADMIN;
+    }
+    static scopeSaveRole(input) {
+        if (!input.isNew && input.parentChanged)
+            return global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_SUPER_ADMIN;
+        if (input.isNew && input.parentHasGrants)
+            return global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_SUPER_ADMIN;
+        return global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_CONTENT_MANAGER;
+    }
+    static scheduledTaskSaveRole(input) {
+        return input.isNew || input.identifierChanged || input.payloadChanged
+            ? global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_ADMIN
+            : global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_CONTENT_MANAGER;
+    }
+    static intervalAllowed(intervalMs) {
+        return intervalMs >= admin_default_enum_1.AdminLimit.MIN_SCHEDULE_INTERVAL_SEC * 1000;
+    }
+    static cronAllowed(expression) {
+        if (typeof expression !== 'string')
+            return false;
+        return expression.trim().split(/\s+/).length === 5;
+    }
+    static apiKeyExpiry(requested, now = new Date()) {
+        if (!requested)
+            return {
+                expiresAt: new Date(now.getTime() +
+                    admin_default_enum_1.AdminLimit.API_KEY_DEFAULT_TTL_DAYS * admin_default_enum_1.AdminDefault.MS_PER_DAY),
+            };
+        const expiresAt = new Date(requested);
+        if (Number.isNaN(expiresAt.getTime()))
+            return { expiresAt: null, error: 'expires_at is not a valid date' };
+        if (expiresAt.getTime() <= now.getTime())
+            return { expiresAt: null, error: 'expires_at must be in the future' };
+        if (expiresAt.getTime() >
+            now.getTime() + admin_default_enum_1.AdminLimit.API_KEY_MAX_TTL_DAYS * admin_default_enum_1.AdminDefault.MS_PER_DAY)
+            return {
+                expiresAt: null,
+                error: `expires_at may be at most ${admin_default_enum_1.AdminLimit.API_KEY_MAX_TTL_DAYS} days ahead`,
+            };
+        return { expiresAt };
+    }
+    static manualGrantExpiry(requested, now = new Date()) {
+        if (!requested)
+            return {
+                expiresAt: null,
+                error: 'expires_at is required for a manual grant',
+            };
+        const expiresAt = new Date(requested);
+        if (Number.isNaN(expiresAt.getTime()))
+            return { expiresAt: null, error: 'expires_at is not a valid date' };
+        if (expiresAt.getTime() <= now.getTime())
+            return { expiresAt: null, error: 'expires_at must be in the future' };
+        if (expiresAt.getTime() >
+            now.getTime() +
+                admin_default_enum_1.AdminLimit.MANUAL_GRANT_MAX_TTL_DAYS * admin_default_enum_1.AdminDefault.MS_PER_DAY)
+            return {
+                expiresAt: null,
+                error: `expires_at may be at most ${admin_default_enum_1.AdminLimit.MANUAL_GRANT_MAX_TTL_DAYS} days ahead`,
+            };
+        return { expiresAt };
+    }
+    static superAdminEditError(input) {
+        const { actorId, targetId, holders, targetKeepsSuper } = input;
+        if (targetKeepsSuper || !holders.includes(targetId))
+            return null;
+        if (targetId === actorId)
+            return 'You cannot remove your own super admin role';
+        if (holders.every((holder) => holder === targetId))
+            return 'This is the last super admin — grant the role to someone else first';
+        return null;
+    }
+    static isLastSuperAdmin(targetId, holders) {
+        return (holders.includes(targetId) &&
+            holders.every((holder) => holder === targetId));
+    }
+}
+exports.AdminPolicy = AdminPolicy;
+//# sourceMappingURL=admin.policy.js.map

package/dist/admin/utilities/admin.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.policy.js","sourceRoot":"","sources":["../../../src/admin/utilities/admin.policy.ts"],"names":[],"mappings":";;;AAAA,sFAA4E;AAC5E,oEAAuE;AAGvE,MAAa,WAAW;IAEtB,MAAM,CAAC,aAAa,CAClB,OAAU,EACV,IAAgB,EAChB,MAAmB;QAEnB,OAAO,MAAM,CAAC,MAAM,CAClB,CAAC,KAAK,EAAE,EAAE,CACR,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS;YACzB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CACrD,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,eAAe,CACpB,UAAkB,EAClB,UAAkB;QAElB,OAAO,UAAU,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC;YACrC,CAAC,CAAC,0CAAgB,CAAC,kBAAkB;YACrC,CAAC,CAAC,0CAAgB,CAAC,YAAY,CAAC;IACpC,CAAC;IAMD,MAAM,CAAC,aAAa,CAAC,KAIpB;QACC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,aAAa;YACrC,OAAO,0CAAgB,CAAC,kBAAkB,CAAC;QAC7C,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,eAAe;YACtC,OAAO,0CAAgB,CAAC,kBAAkB,CAAC;QAC7C,OAAO,0CAAgB,CAAC,sBAAsB,CAAC;IACjD,CAAC;IAGD,MAAM,CAAC,qBAAqB,CAAC,KAI5B;QACC,OAAO,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,cAAc;YACnE,CAAC,CAAC,0CAAgB,CAAC,YAAY;YAC/B,CAAC,CAAC,0CAAgB,CAAC,sBAAsB,CAAC;IAC9C,CAAC;IAGD,MAAM,CAAC,eAAe,CAAC,UAAkB;QACvC,OAAO,UAAU,IAAI,+BAAU,CAAC,yBAAyB,GAAG,IAAI,CAAC;IACnE,CAAC;IAGD,MAAM,CAAC,WAAW,CAAC,UAA8B;QAC/C,IAAI,OAAO,UAAU,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACjD,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IACrD,CAAC;IAMD,MAAM,CAAC,YAAY,CACjB,SAA6B,EAC7B,MAAY,IAAI,IAAI,EAAE;QAEtB,IAAI,CAAC,SAAS;YACZ,OAAO;gBACL,SAAS,EAAE,IAAI,IAAI,CACjB,GAAG,CAAC,OAAO,EAAE;oBACX,+BAAU,CAAC,wBAAwB,GAAG,iCAAY,CAAC,UAAU,CAChE;aACF,CAAC;QAEJ,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;QACtE,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE;YACtC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;QACxE,IACE,SAAS,CAAC,OAAO,EAAE;YACnB,GAAG,CAAC,OAAO,EAAE,GAAG,+BAAU,CAAC,oBAAoB,GAAG,iCAAY,CAAC,UAAU;YAEzE,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,6BAA6B,+BAAU,CAAC,oBAAoB,aAAa;aACjF,CAAC;QACJ,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC;IAGD,MAAM,CAAC,iBAAiB,CACtB,SAA6B,EAC7B,MAAY,IAAI,IAAI,EAAE;QAEtB,IAAI,CAAC,SAAS;YACZ,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,2CAA2C;aACnD,CAAC;QACJ,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;QACtE,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE;YACtC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;QACxE,IACE,SAAS,CAAC,OAAO,EAAE;YACnB,GAAG,CAAC,OAAO,EAAE;gBACX,+BAAU,CAAC,yBAAyB,GAAG,iCAAY,CAAC,UAAU;YAEhE,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,6BAA6B,+BAAU,CAAC,yBAAyB,aAAa;aACtF,CAAC;QACJ,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC;IAMD,MAAM,CAAC,mBAAmB,CAAC,KAK1B;QACC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;QAC/D,IAAI,gBAAgB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACjE,IAAI,QAAQ,KAAK,OAAO;YACtB,OAAO,6CAA6C,CAAC;QACvD,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC;YAChD,OAAO,qEAAqE,CAAC;QAC/E,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,MAAM,CAAC,gBAAgB,CAAC,QAAgB,EAAE,OAAiB;QACzD,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC1B,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAC/C,CAAC;IACJ,CAAC;CACF;AAnJD,kCAmJC"}

package/dist/admin/utilities/bounded.concurrency.d.ts

@@ -0,0 +1,4 @@
+export declare class BoundedConcurrency {
+    static map<T, R>(items: readonly T[], limit: number, fn: (item: T, index: number) => Promise<R>): Promise<R[]>;
+}
+//# sourceMappingURL=bounded.concurrency.d.ts.map

package/dist/admin/utilities/bounded.concurrency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded.concurrency.d.ts","sourceRoot":"","sources":["../../../src/admin/utilities/bounded.concurrency.ts"],"names":[],"mappings":"AACA,qBAAa,kBAAkB;WAEhB,GAAG,CAAC,CAAC,EAAE,CAAC,EACnB,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GACzC,OAAO,CAAC,CAAC,EAAE,CAAC;CAahB"}

package/dist/admin/utilities/bounded.concurrency.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BoundedConcurrency = void 0;
+class BoundedConcurrency {
+    static async map(items, limit, fn) {
+        const results = new Array(items.length);
+        let next = 0;
+        const worker = async () => {
+            while (next < items.length) {
+                const index = next++;
+                results[index] = await fn(items[index], index);
+            }
+        };
+        const workers = Math.max(1, Math.min(limit, items.length));
+        await Promise.all(Array.from({ length: workers }, worker));
+        return results;
+    }
+}
+exports.BoundedConcurrency = BoundedConcurrency;
+//# sourceMappingURL=bounded.concurrency.js.map

package/dist/admin/utilities/bounded.concurrency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded.concurrency.js","sourceRoot":"","sources":["../../../src/admin/utilities/bounded.concurrency.ts"],"names":[],"mappings":";;;AACA,MAAa,kBAAkB;IAE7B,MAAM,CAAC,KAAK,CAAC,GAAG,CACd,KAAmB,EACnB,KAAa,EACb,EAA0C;QAE1C,MAAM,OAAO,GAAG,IAAI,KAAK,CAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAG,KAAK,IAAmB,EAAE;YACvC,OAAO,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC3B,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;gBACrB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;YACjD,CAAC;QACH,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AAnBD,gDAmBC"}

package/dist/admin/utilities/scope.grants.d.ts

@@ -0,0 +1,9 @@
+import { EntityManager } from 'typeorm';
+export declare class ScopeGrants {
+    static count(manager: EntityManager, scopeIds: string[]): Promise<number>;
+    static withChildren(manager: EntityManager, scopeId: string): Promise<{
+        scopeIds: string[];
+        childCount: number;
+    }>;
+}
+//# sourceMappingURL=scope.grants.d.ts.map

package/dist/admin/utilities/scope.grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.grants.d.ts","sourceRoot":"","sources":["../../../src/admin/utilities/scope.grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAM,MAAM,SAAS,CAAC;AAM5C,qBAAa,WAAW;WACT,KAAK,CAChB,OAAO,EAAE,aAAa,EACtB,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,MAAM,CAAC;WAUL,YAAY,CACvB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAUvD"}

package/dist/admin/utilities/scope.grants.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ScopeGrants = void 0;
+const typeorm_1 = require("typeorm");
+const api_scope_entity_1 = require("../../auth/entities/api.scope.entity");
+const scope_entity_1 = require("../../auth/entities/scope.entity");
+const tenant_scope_entity_1 = require("../../auth/entities/tenant.scope.entity");
+class ScopeGrants {
+    static async count(manager, scopeIds) {
+        if (!scopeIds.length)
+            return 0;
+        const where = { scope_id: (0, typeorm_1.In)(scopeIds) };
+        return ((await manager.count(tenant_scope_entity_1.TenantScopeEntity, { where })) +
+            (await manager.count(api_scope_entity_1.ApiScopeEntity, { where })));
+    }
+    static async withChildren(manager, scopeId) {
+        const children = await manager.find(scope_entity_1.ScopeEntity, {
+            where: { parent_id: scopeId },
+            select: { id: true },
+        });
+        return {
+            scopeIds: [scopeId, ...children.map((child) => child.id)],
+            childCount: children.length,
+        };
+    }
+}
+exports.ScopeGrants = ScopeGrants;
+//# sourceMappingURL=scope.grants.js.map

package/dist/admin/utilities/scope.grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.grants.js","sourceRoot":"","sources":["../../../src/admin/utilities/scope.grants.ts"],"names":[],"mappings":";;;AAAA,qCAA4C;AAC5C,2EAAsE;AACtE,mEAA+D;AAC/D,iFAA4E;AAG5E,MAAa,WAAW;IACtB,MAAM,CAAC,KAAK,CAAC,KAAK,CAChB,OAAsB,EACtB,QAAkB;QAElB,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,EAAE,QAAQ,EAAE,IAAA,YAAE,EAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,CACL,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,uCAAiB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,iCAAc,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CACjD,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,YAAY,CACvB,OAAsB,EACtB,OAAe;QAEf,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,0BAAW,EAAE;YAC/C,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE;YAC7B,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,OAAO;YACL,QAAQ,EAAE,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACzD,UAAU,EAAE,QAAQ,CAAC,MAAM;SAC5B,CAAC;IACJ,CAAC;CACF;AA3BD,kCA2BC"}

package/dist/admin/utilities/super.admin.guard.d.ts

@@ -0,0 +1,9 @@
+import { EntityManager } from 'typeorm';
+import { SystemAdminRoleEntity } from '../../auth/entities/system.admin.role.entity';
+export declare class SuperAdminGuard {
+    static readonly LOCK_KEY = "admin:super-admin-guard";
+    static lock(manager: EntityManager): Promise<void>;
+    static superRole(manager: EntityManager): Promise<SystemAdminRoleEntity | null>;
+    static holders(manager: EntityManager, superRoleId: string): Promise<string[]>;
+}
+//# sourceMappingURL=super.admin.guard.d.ts.map

package/dist/admin/utilities/super.admin.guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"super.admin.guard.d.ts","sourceRoot":"","sources":["../../../src/admin/utilities/super.admin.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAExC,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AASrF,qBAAa,eAAe;IAC1B,MAAM,CAAC,QAAQ,CAAC,QAAQ,6BAA6B;WAGxC,IAAI,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxD,MAAM,CAAC,SAAS,CACd,OAAO,EAAE,aAAa,GACrB,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;WAO3B,OAAO,CAClB,OAAO,EAAE,aAAa,EACtB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,EAAE,CAAC;CAcrB"}

package/dist/admin/utilities/super.admin.guard.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SuperAdminGuard = void 0;
+const admin_user_entity_1 = require("../../auth/entities/admin.user.entity");
+const system_admin_role_entity_1 = require("../../auth/entities/system.admin.role.entity");
+const system_admin_user_role_entity_1 = require("../../auth/entities/system.admin.user.role.entity");
+const global_admin_roles_enum_1 = require("../../auth/enums/global.admin.roles.enum");
+class SuperAdminGuard {
+    static async lock(manager) {
+        await manager.query('SELECT pg_advisory_xact_lock(hashtext($1))', [
+            SuperAdminGuard.LOCK_KEY,
+        ]);
+    }
+    static superRole(manager) {
+        return manager.findOne(system_admin_role_entity_1.SystemAdminRoleEntity, {
+            where: { identifier: global_admin_roles_enum_1.GlobalAdminRoles.GLOBAL_SUPER_ADMIN },
+        });
+    }
+    static async holders(manager, superRoleId) {
+        const rows = await manager
+            .createQueryBuilder(system_admin_user_role_entity_1.SystemAdminUserRoleEntity, 'ur')
+            .innerJoin(admin_user_entity_1.AdminUserEntity, 'au', 'au.id = ur.admin_user_id and au.deleted_at is null and au.active = true')
+            .select('distinct ur.admin_user_id', 'admin_user_id')
+            .where('ur.role_id = :roleId', { roleId: superRoleId })
+            .andWhere('ur.deleted_at is null')
+            .getRawMany();
+        return rows.map((row) => row.admin_user_id);
+    }
+}
+exports.SuperAdminGuard = SuperAdminGuard;
+SuperAdminGuard.LOCK_KEY = 'admin:super-admin-guard';
+//# sourceMappingURL=super.admin.guard.js.map

package/dist/admin/utilities/super.admin.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"super.admin.guard.js","sourceRoot":"","sources":["../../../src/admin/utilities/super.admin.guard.ts"],"names":[],"mappings":";;;AACA,6EAAwE;AACxE,2FAAqF;AACrF,qGAA8F;AAC9F,sFAA4E;AAO5E,MAAa,eAAe;IAI1B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAsB;QACtC,MAAM,OAAO,CAAC,KAAK,CAAC,4CAA4C,EAAE;YAChE,eAAe,CAAC,QAAQ;SACzB,CAAC,CAAC;IACL,CAAC;IAGD,MAAM,CAAC,SAAS,CACd,OAAsB;QAEtB,OAAO,OAAO,CAAC,OAAO,CAAC,gDAAqB,EAAE;YAC5C,KAAK,EAAE,EAAE,UAAU,EAAE,0CAAgB,CAAC,kBAAkB,EAAE;SAC3D,CAAC,CAAC;IACL,CAAC;IAGD,MAAM,CAAC,KAAK,CAAC,OAAO,CAClB,OAAsB,EACtB,WAAmB;QAEnB,MAAM,IAAI,GAAG,MAAM,OAAO;aACvB,kBAAkB,CAAC,yDAAyB,EAAE,IAAI,CAAC;aACnD,SAAS,CACR,mCAAe,EACf,IAAI,EACJ,yEAAyE,CAC1E;aACA,MAAM,CAAC,2BAA2B,EAAE,eAAe,CAAC;aACpD,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;aACtD,QAAQ,CAAC,uBAAuB,CAAC;aACjC,UAAU,EAA6B,CAAC;QAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,CAAC;;AApCH,0CAqCC;AApCiB,wBAAQ,GAAG,yBAAyB,CAAC"}

package/dist/admin/utilities/tenant.role.policy.d.ts

@@ -0,0 +1,16 @@
+import { GlobalAdminRoles } from '../../auth/enums/global.admin.roles.enum';
+export declare class TenantRolePolicy {
+    static isReserved(identifier: string | null | undefined): boolean;
+    static isPrivileged(identifier: string | null | undefined): boolean;
+    static newPrivilegedGrants<R extends {
+        id: string;
+        identifier: string;
+    }>(roles: R[], heldRoleIds?: Iterable<string>): R[];
+    static tenantUserSaveRole(input: {
+        grantsPrivileged: boolean;
+        emailChanged: boolean;
+        holdsPrivileged: boolean;
+    }): GlobalAdminRoles;
+    static emailChanged(current: string | null | undefined, next: string | null | undefined): boolean;
+}
+//# sourceMappingURL=tenant.role.policy.d.ts.map

package/dist/admin/utilities/tenant.role.policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.role.policy.d.ts","sourceRoot":"","sources":["../../../src/admin/utilities/tenant.role.policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAO5E,qBAAa,gBAAgB;IAE3B,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAKjE,MAAM,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO;IAQnE,MAAM,CAAC,mBAAmB,CAAC,CAAC,SAAS;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EACrE,KAAK,EAAE,CAAC,EAAE,EACV,WAAW,GAAE,QAAQ,CAAC,MAAM,CAAM,GACjC,CAAC,EAAE;IAYN,MAAM,CAAC,kBAAkB,CAAC,KAAK,EAAE;QAC/B,gBAAgB,EAAE,OAAO,CAAC;QAC1B,YAAY,EAAE,OAAO,CAAC;QACtB,eAAe,EAAE,OAAO,CAAC;KAC1B,GAAG,gBAAgB;IAQpB,MAAM,CAAC,YAAY,CACjB,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B,OAAO;CAIX"}