@neohm/nestend 4.1.0 → 5.0.0

package/dist/auth/controllers/auth.controller.js

@@ -15,24 +15,34 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthController = void 0;
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
+const strict_validation_pipe_1 = require("../../common/pipes/strict.validation.pipe");
 const auth_service_1 = require("../services/auth.service");
 const google_auth_service_1 = require("../services/google.auth.service");
 const tenant_membership_service_1 = require("../services/tenant.membership.service");
 const tenant_invitation_service_1 = require("../services/tenant.invitation.service");
+const login_throttle_service_1 = require("../services/login.throttle.service");
+const email_verification_service_1 = require("../services/email.verification.service");
 const login_dto_1 = require("../dtos/login.dto");
 const google_login_dto_1 = require("../dtos/google.login.dto");
 const register_dto_1 = require("../dtos/register.dto");
 const refresh_token_dto_1 = require("../dtos/refresh.token.dto");
 const change_password_dto_1 = require("../dtos/change.password.dto");
+const verify_email_dto_1 = require("../dtos/verify.email.dto");
 const register_user_data_processor_1 = require("../processors/register.user.data.processor");
 const google_user_data_processor_1 = require("../processors/google.user.data.processor");
 const change_password_data_processor_1 = require("../processors/change.password.data.processor");
+const public_decorator_1 = require("../decorators/public.decorator");
+const allow_pending_password_change_decorator_1 = require("../decorators/allow.pending.password.change.decorator");
+const auth_1 = require("../helpers/auth");
+const request_credentials_1 = require("../utilities/request.credentials");
 let AuthController = class AuthController {
-    constructor(authService, googleAuthService, tenantMembershipService, tenantInvitationService) {
+    constructor(authService, googleAuthService, tenantMembershipService, tenantInvitationService, throttle, emailVerificationService) {
         this.authService = authService;
         this.googleAuthService = googleAuthService;
         this.tenantMembershipService = tenantMembershipService;
         this.tenantInvitationService = tenantInvitationService;
+        this.throttle = throttle;
+        this.emailVerificationService = emailVerificationService;
     }
     async me() {
         const { user, roles } = await this.authService.validateIdentity();
@@ -50,22 +60,26 @@ let AuthController = class AuthController {
         };
     }
     async login(dto, request) {
-        const user = await this.authService.validateCredentials(dto.email, dto.password);
+        const user = await this.throttle.protect('login', { ip: request.ip, account: dto.email }, () => this.authService.validateCredentials(dto.email, dto.password));
         this.authService.assertTenantLogin(user);
         return this.signIn(user, request);
     }
     async googleLogin(dto, request) {
+        await this.throttle.assertAllowed('google', { ip: request.ip });
         const tokenInfo = await this.googleAuthService.verifyIdToken(dto.id_token);
         const user = await new google_user_data_processor_1.GoogleUserDataProcessor().process(tokenInfo);
         this.authService.assertTenantLogin(user);
         return this.signIn(user, request);
     }
     async register(dto, request) {
+        await this.throttle.assertAllowed('register', { ip: request.ip });
         const user = await new register_user_data_processor_1.RegisterUserDataProcessor().process(dto);
-        return this.authService.issueTokens(user, this.contextOf(request));
+        await this.emailVerificationService.requestQuietly(user.id);
+        return this.authService.issueTokens(user, request_credentials_1.RequestCredentials.issueContext(request));
     }
     async refresh(dto, request) {
-        return this.authService.refresh(dto.refresh_token, this.contextOf(request));
+        await this.throttle.assertAllowed('refresh', { ip: request.ip });
+        return this.authService.refresh(dto.refresh_token, request_credentials_1.RequestCredentials.issueContext(request));
     }
     async logout(dto) {
         await this.authService.logout(dto.refresh_token);
@@ -73,25 +87,35 @@ let AuthController = class AuthController {
     }
     async changePassword(dto) {
         const { user } = await this.authService.validateIdentity();
-        await new change_password_data_processor_1.ChangePasswordDataProcessor(user.id).process(dto);
+        await new change_password_data_processor_1.ChangePasswordDataProcessor(user.id, auth_1.Auth.session()).process(dto);
+        return { success: true };
+    }
+    async requestEmailVerification(request) {
+        const { user } = await this.authService.validateIdentity();
+        await this.throttle.assertAllowed('email.verification', {
+            ip: request.ip,
+        });
+        await this.emailVerificationService.request(user.id);
+        return { success: true };
+    }
+    async verifyEmail(dto, request) {
+        await this.throttle.assertAllowed('email.verification', {
+            ip: request.ip,
+        });
+        await this.emailVerificationService.verify(dto.token);
         return { success: true };
     }
     async signIn(user, request) {
         return this.authService.issueTokens(user, {
-            ...this.contextOf(request),
+            ...request_credentials_1.RequestCredentials.issueContext(request),
             tenant_id: await this.tenantMembershipService.landingTenant(user),
         });
     }
-    contextOf(request) {
-        return {
-            ip_address: request.ip,
-            user_agent: request.headers['user-agent'],
-        };
-    }
 };
 exports.AuthController = AuthController;
 __decorate([
     (0, common_1.Get)('me'),
+    (0, allow_pending_password_change_decorator_1.AllowPendingPasswordChange)(),
     (0, swagger_1.ApiBearerAuth)(),
     (0, swagger_1.ApiOperation)({
         summary: 'Resolve the current authenticated user and roles.',
@@ -103,9 +127,10 @@ __decorate([
 ], AuthController.prototype, "me", null);
 __decorate([
     (0, common_1.Post)('login'),
+    (0, public_decorator_1.Public)(),
     (0, swagger_1.ApiOperation)({
         summary: 'Authenticate and receive an access/refresh token pair.',
-        description: 'The session works in the organization last switched to, or the first the user belongs to; it has none when they belong to none.',
+        description: 'The session works in the organization last switched to, or the first the user belongs to. Rate-limited per IP and per account (429).',
     }),
     __param(0, (0, common_1.Body)()),
     __param(1, (0, common_1.Req)()),
@@ -115,8 +140,10 @@ __decorate([
 ], AuthController.prototype, "login", null);
 __decorate([
     (0, common_1.Post)('google'),
+    (0, public_decorator_1.Public)(),
     (0, swagger_1.ApiOperation)({
         summary: 'Authenticate with a Google ID token and receive tokens.',
+        description: 'Signs in the account bound to the Google identity, links a verified account with the same email, or takes over an unverified one (its password and sessions are cleared).',
     }),
     __param(0, (0, common_1.Body)()),
     __param(1, (0, common_1.Req)()),
@@ -126,8 +153,10 @@ __decorate([
 ], AuthController.prototype, "googleLogin", null);
 __decorate([
     (0, common_1.Post)('register'),
+    (0, public_decorator_1.Public)(),
     (0, swagger_1.ApiOperation)({
         summary: 'Self-register a new tenant user and receive tokens.',
+        description: 'Also mails an email-verification link. The address counts as proven only once that link is redeemed.',
     }),
     __param(0, (0, common_1.Body)()),
     __param(1, (0, common_1.Req)()),
@@ -137,7 +166,11 @@ __decorate([
 ], AuthController.prototype, "register", null);
 __decorate([
     (0, common_1.Post)('refresh'),
-    (0, swagger_1.ApiOperation)({ summary: 'Exchange a refresh token for a fresh token pair.' }),
+    (0, public_decorator_1.Public)(),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Exchange a refresh token for a fresh token pair.',
+        description: 'Single use: the presented token is consumed. Presenting an already-rotated token revokes every session of the account.',
+    }),
     __param(0, (0, common_1.Body)()),
     __param(1, (0, common_1.Req)()),
     __metadata("design:type", Function),
@@ -146,10 +179,11 @@ __decorate([
 ], AuthController.prototype, "refresh", null);
 __decorate([
     (0, common_1.Post)('logout'),
+    (0, allow_pending_password_change_decorator_1.AllowPendingPasswordChange)(),
     (0, common_1.HttpCode)(common_1.HttpStatus.OK),
     (0, swagger_1.ApiBearerAuth)(),
     (0, swagger_1.ApiOperation)({
-        summary: 'Revoke the supplied refresh token and invalidate the current session.',
+        summary: 'Invalidate the current session and revoke the supplied refresh token.',
     }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
@@ -158,23 +192,55 @@ __decorate([
 ], AuthController.prototype, "logout", null);
 __decorate([
     (0, common_1.Post)('change-password'),
+    (0, allow_pending_password_change_decorator_1.AllowPendingPasswordChange)(),
     (0, common_1.HttpCode)(common_1.HttpStatus.OK),
     (0, swagger_1.ApiBearerAuth)(),
     (0, swagger_1.ApiOperation)({
         summary: `Change the authenticated user's password.`,
-        description: 'Also how a one-time password is replaced: send it as `current_password`. Clears `password_change_required`.',
+        description: 'Also how a one-time password is replaced: send it as `current_password`. Clears `password_change_required`. Every other session and refresh token is revoked; the current session stays signed in.',
     }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [change_password_dto_1.ChangePasswordDto]),
     __metadata("design:returntype", Promise)
 ], AuthController.prototype, "changePassword", null);
+__decorate([
+    (0, common_1.Post)('email-verification/request'),
+    (0, allow_pending_password_change_decorator_1.AllowPendingPasswordChange)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, swagger_1.ApiOperation)({
+        summary: "Mail a fresh verification link to the caller's address.",
+        description: 'A no-op once the address is verified. Earlier links stop working.',
+    }),
+    __param(0, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "requestEmailVerification", null);
+__decorate([
+    (0, common_1.Post)('email-verification/verify'),
+    (0, public_decorator_1.Public)(),
+    (0, common_1.HttpCode)(common_1.HttpStatus.OK),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Redeem an email-verification token.',
+        description: 'Single use; sets `email_verified_at`.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [verify_email_dto_1.VerifyEmailDto, Object]),
+    __metadata("design:returntype", Promise)
+], AuthController.prototype, "verifyEmail", null);
 exports.AuthController = AuthController = __decorate([
     (0, swagger_1.ApiTags)('Auth'),
     (0, common_1.Controller)('api/auth'),
+    (0, common_1.UsePipes)(strict_validation_pipe_1.StrictValidationPipe),
     __metadata("design:paramtypes", [auth_service_1.AuthService,
         google_auth_service_1.GoogleAuthService,
         tenant_membership_service_1.TenantMembershipService,
-        tenant_invitation_service_1.TenantInvitationService])
+        tenant_invitation_service_1.TenantInvitationService,
+        login_throttle_service_1.LoginThrottleService,
+        email_verification_service_1.EmailVerificationService])
 ], AuthController);
 //# sourceMappingURL=auth.controller.js.map

package/dist/auth/controllers/auth.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAQwB;AACxB,6CAAuE;AAEvE,2DAAuD;AACvD,yEAAoE;AACpE,qFAAgF;AAChF,qFAAgF;AAOhF,iDAA6C;AAC7C,+DAA0D;AAC1D,uDAAmD;AACnD,iEAA4D;AAC5D,qEAAgE;AAChE,6FAAuF;AACvF,yFAAmF;AACnF,iGAA2F;AAIpF,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YACmB,WAAwB,EACxB,iBAAoC,EACpC,uBAAgD,EAChD,uBAAgD;QAHhD,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,4BAAuB,GAAvB,uBAAuB,CAAyB;IAChE,CAAC;IASE,AAAN,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAClE,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9D,IAAI,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,IAAI,CAAC;YACtD,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC;SAC9C,CAAC,CAAC;QAEH,OAAO;YACL,IAAI;YACJ,KAAK;YACL,YAAY,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;YACnC,aAAa;YACb,WAAW;SACZ,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,KAAK,CACD,GAAa,EACd,OAAgB;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CACrD,GAAG,CAAC,KAAK,EACT,GAAG,CAAC,QAAQ,CACb,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAMK,AAAN,KAAK,CAAC,WAAW,CACP,GAAmB,EACpB,OAAgB;QAEvB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,oDAAuB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAMK,AAAN,KAAK,CAAC,QAAQ,CACJ,GAAgB,EACjB,OAAgB;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,wDAAyB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACrE,CAAC;IAIK,AAAN,KAAK,CAAC,OAAO,CACH,GAAoB,EACrB,OAAgB;QAEvB,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9E,CAAC;IASK,AAAN,KAAK,CAAC,MAAM,CAAS,GAAoB;QACvC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAUK,AAAN,KAAK,CAAC,cAAc,CACV,GAAsB;QAE9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,IAAI,4DAA2B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5D,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,IAAgB,EAChB,OAAgB;QAEhB,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YACxC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC1B,SAAS,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,IAAI,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;IAEO,SAAS,CAAC,OAAgB;QAChC,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;SAC1C,CAAC;IACJ,CAAC;CACF,CAAA;AAjIY,wCAAc;AAenB;IAPL,IAAA,YAAG,EAAC,IAAI,CAAC;IACT,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mDAAmD;QAC5D,WAAW,EACT,8SAA8S;KACjT,CAAC;;;;wCAgBD;AAQK;IANL,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wDAAwD;QACjE,WAAW,EACT,iIAAiI;KACpI,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,oBAAQ;;2CAStB;AAMK;IAJL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yDAAyD;KACnE,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,iCAAc;;iDAO5B;AAMK;IAJL,IAAA,aAAI,EAAC,UAAU,CAAC;IAChB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qDAAqD;KAC/D,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,0BAAW;;8CAKzB;AAIK;IAFL,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;IAE3E,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,mCAAe;;6CAI7B;AASK;IAPL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EACL,uEAAuE;KAC1E,CAAC;IACY,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,mCAAe;;4CAGxC;AAUK;IARL,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,6GAA6G;KAChH,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,uCAAiB;;oDAK/B;yBA/GU,cAAc;IAF1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,UAAU,CAAC;qCAGW,0BAAW;QACL,uCAAiB;QACX,mDAAuB;QACvB,mDAAuB;GALxD,cAAc,CAiI1B"}
+{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAuE;AAEvE,sFAAiF;AACjF,2DAAuD;AACvD,yEAAoE;AACpE,qFAAgF;AAChF,qFAAgF;AAChF,+EAA0E;AAC1E,uFAAkF;AAGlF,iDAA6C;AAC7C,+DAA0D;AAC1D,uDAAmD;AACnD,iEAA4D;AAC5D,qEAAgE;AAChE,+DAA0D;AAC1D,6FAAuF;AACvF,yFAAmF;AACnF,iGAA2F;AAC3F,qEAAwD;AACxD,mHAAmG;AACnG,0CAAuC;AACvC,0EAAsE;AAK/D,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YACmB,WAAwB,EACxB,iBAAoC,EACpC,uBAAgD,EAChD,uBAAgD,EAChD,QAA8B,EAC9B,wBAAkD;QALlD,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,aAAQ,GAAR,QAAQ,CAAsB;QAC9B,6BAAwB,GAAxB,wBAAwB,CAA0B;IAClE,CAAC;IAUE,AAAN,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAClE,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9D,IAAI,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,IAAI,CAAC;YACtD,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC;SAC9C,CAAC,CAAC;QAEH,OAAO;YACL,IAAI;YACJ,KAAK;YACL,YAAY,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;YACnC,aAAa;YACb,WAAW;SACZ,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,KAAK,CACD,GAAa,EACd,OAAgB;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACtC,OAAO,EACP,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,EACtC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CACpE,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IASK,AAAN,KAAK,CAAC,WAAW,CACP,GAAmB,EACpB,OAAgB;QAEvB,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,oDAAuB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IASK,AAAN,KAAK,CAAC,QAAQ,CACJ,GAAgB,EACjB,OAAgB;QAEvB,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,IAAI,wDAAyB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CACjC,IAAI,EACJ,wCAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,CACzC,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,OAAO,CACH,GAAoB,EACrB,OAAgB;QAEvB,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAC7B,GAAG,CAAC,aAAa,EACjB,wCAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,CACzC,CAAC;IACJ,CAAC;IAUK,AAAN,KAAK,CAAC,MAAM,CAAS,GAAoB;QACvC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAWK,AAAN,KAAK,CAAC,cAAc,CACV,GAAsB;QAE9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,IAAI,4DAA2B,CAAC,IAAI,CAAC,EAAE,EAAE,WAAI,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAWK,AAAN,KAAK,CAAC,wBAAwB,CACrB,OAAgB;QAEvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,oBAAoB,EAAE;YACtD,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IASK,AAAN,KAAK,CAAC,WAAW,CACP,GAAmB,EACpB,OAAgB;QAEvB,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,oBAAoB,EAAE;YACtD,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,IAAgB,EAChB,OAAgB;QAEhB,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YACxC,GAAG,wCAAkB,CAAC,YAAY,CAAC,OAAO,CAAC;YAC3C,SAAS,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,IAAI,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA5LY,wCAAc;AAkBnB;IARL,IAAA,YAAG,EAAC,IAAI,CAAC;IACT,IAAA,oEAA0B,GAAE;IAC5B,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mDAAmD;QAC5D,WAAW,EACT,8SAA8S;KACjT,CAAC;;;;wCAgBD;AASK;IAPL,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,yBAAM,GAAE;IACR,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wDAAwD;QACjE,WAAW,EACT,sIAAsI;KACzI,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,oBAAQ;;2CAUtB;AASK;IAPL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,yBAAM,GAAE;IACR,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,2KAA2K;KAC9K,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,iCAAc;;iDAQ5B;AASK;IAPL,IAAA,aAAI,EAAC,UAAU,CAAC;IAChB,IAAA,yBAAM,GAAE;IACR,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EACT,sGAAsG;KACzG,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,0BAAW;;8CAUzB;AASK;IAPL,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,yBAAM,GAAE;IACR,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kDAAkD;QAC3D,WAAW,EACT,wHAAwH;KAC3H,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,mCAAe;;6CAQ7B;AAUK;IARL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,oEAA0B,GAAE;IAC5B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EACL,uEAAuE;KAC1E,CAAC;IACY,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,mCAAe;;4CAGxC;AAWK;IATL,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,oEAA0B,GAAE;IAC5B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,oMAAoM;KACvM,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,uCAAiB;;oDAK/B;AAWK;IATL,IAAA,aAAI,EAAC,4BAA4B,CAAC;IAClC,IAAA,oEAA0B,GAAE;IAC5B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,mEAAmE;KACtE,CAAC;IAEC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAQP;AASK;IAPL,IAAA,aAAI,EAAC,2BAA2B,CAAC;IACjC,IAAA,yBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EAAE,uCAAuC;KACrD,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,iCAAc;;iDAQ5B;yBAjLU,cAAc;IAH1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,UAAU,CAAC;IACtB,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;qCAGG,0BAAW;QACL,uCAAiB;QACX,mDAAuB;QACvB,mDAAuB;QACtC,6CAAoB;QACJ,qDAAwB;GAP1D,cAAc,CA4L1B"}

package/dist/auth/controllers/impersonation.controller.d.ts

@@ -2,12 +2,13 @@ import type { Request } from 'express';
 import { TenantEntity } from '../../tenant/entities/tenant.entity';
 import { ImpersonationLoginDto } from '../dtos/impersonation.login.dto';
 import { ImpersonationService } from '../services/impersonation.service';
-import { OrganizationSession } from '../types/auth.types';
+import { LoginThrottleService } from '../services/login.throttle.service';
+import { ImpersonationSession } from '../types/auth.types';
 export declare class ImpersonationController {
     private readonly impersonationService;
-    constructor(impersonationService: ImpersonationService);
-    login(dto: ImpersonationLoginDto, request: Request): Promise<OrganizationSession>;
+    private readonly throttle;
+    constructor(impersonationService: ImpersonationService, throttle: LoginThrottleService);
+    login(dto: ImpersonationLoginDto, request: Request): Promise<ImpersonationSession>;
     tenants(): Promise<TenantEntity[]>;
-    private contextOf;
 }
 //# sourceMappingURL=impersonation.controller.d.ts.map

package/dist/auth/controllers/impersonation.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"impersonation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/impersonation.controller.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAqB,MAAM,qBAAqB,CAAC;AAE7E,qBAEa,uBAAuB;IACtB,OAAO,CAAC,QAAQ,CAAC,oBAAoB;gBAApB,oBAAoB,EAAE,oBAAoB;IAQjE,KAAK,CACD,GAAG,EAAE,qBAAqB,EAC3B,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,mBAAmB,CAAC;IAWzB,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;IAIxC,OAAO,CAAC,SAAS;CAMlB"}
+{"version":3,"file":"impersonation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/impersonation.controller.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAI3D,qBAGa,uBAAuB;IAEhC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBADR,oBAAoB,EAAE,oBAAoB,EAC1C,QAAQ,EAAE,oBAAoB;IAU3C,KAAK,CACD,GAAG,EAAE,qBAAqB,EAC3B,OAAO,EAAE,OAAO,GACtB,OAAO,CAAC,oBAAoB,CAAC;IAmB1B,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;CAGzC"}

package/dist/auth/controllers/impersonation.controller.js

@@ -15,31 +15,31 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ImpersonationController = void 0;
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
+const strict_validation_pipe_1 = require("../../common/pipes/strict.validation.pipe");
 const impersonation_login_dto_1 = require("../dtos/impersonation.login.dto");
 const impersonation_service_1 = require("../services/impersonation.service");
+const login_throttle_service_1 = require("../services/login.throttle.service");
+const public_decorator_1 = require("../decorators/public.decorator");
+const request_credentials_1 = require("../utilities/request.credentials");
 let ImpersonationController = class ImpersonationController {
-    constructor(impersonationService) {
+    constructor(impersonationService, throttle) {
         this.impersonationService = impersonationService;
+        this.throttle = throttle;
     }
     async login(dto, request) {
-        return this.impersonationService.login(dto, this.contextOf(request));
+        return this.throttle.protect('impersonation.login', { ip: request.ip, account: dto.email }, () => this.impersonationService.login(dto, request_credentials_1.RequestCredentials.issueContext(request)));
     }
     async tenants() {
         return this.impersonationService.accessibleTenants();
     }
-    contextOf(request) {
-        return {
-            ip_address: request.ip,
-            user_agent: request.headers['user-agent'],
-        };
-    }
 };
 exports.ImpersonationController = ImpersonationController;
 __decorate([
     (0, common_1.Post)('login'),
+    (0, public_decorator_1.Public)(),
     (0, swagger_1.ApiOperation)({
         summary: 'Sign a global-access user into one organization.',
-        description: 'Takes the same credentials as `POST /auth/login` plus the `tenant_id` to enter. The account must be a tenantless system user with `has_global_access`; anything else is refused. The returned pair behaves like an ordinary tenant-user session scoped to that organization, and a refresh keeps it there.',
+        description: 'Takes the same credentials as `POST /auth/login` plus the `tenant_id` to enter. The account must be a tenantless system user with `has_global_access`. Returns an access token only (no refresh token) that expires after IMPERSONATION_TOKEN_EXPIRY. Audited and rate-limited (429).',
     }),
     __param(0, (0, common_1.Body)()),
     __param(1, (0, common_1.Req)()),
@@ -61,6 +61,8 @@ __decorate([
 exports.ImpersonationController = ImpersonationController = __decorate([
     (0, swagger_1.ApiTags)('Impersonation'),
     (0, common_1.Controller)('api/auth/impersonation'),
-    __metadata("design:paramtypes", [impersonation_service_1.ImpersonationService])
+    (0, common_1.UsePipes)(strict_validation_pipe_1.StrictValidationPipe),
+    __metadata("design:paramtypes", [impersonation_service_1.ImpersonationService,
+        login_throttle_service_1.LoginThrottleService])
 ], ImpersonationController);
 //# sourceMappingURL=impersonation.controller.js.map

package/dist/auth/controllers/impersonation.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"impersonation.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/impersonation.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAkE;AAClE,6CAAuE;AAGvE,6EAAwE;AACxE,6EAAyE;AAKlE,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAClC,YAA6B,oBAA0C;QAA1C,yBAAoB,GAApB,oBAAoB,CAAsB;IAAG,CAAC;IAQrE,AAAN,KAAK,CAAC,KAAK,CACD,GAA0B,EAC3B,OAAgB;QAEvB,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IASK,AAAN,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,EAAE,CAAC;IACvD,CAAC;IAEO,SAAS,CAAC,OAAgB;QAChC,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,EAAE;YACtB,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC;SAC1C,CAAC;IACJ,CAAC;CACF,CAAA;AAjCY,0DAAuB;AAS5B;IANL,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kDAAkD;QAC3D,WAAW,EACT,4SAA4S;KAC/S,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,+CAAqB;;oDAInC;AASK;IAPL,IAAA,YAAG,EAAC,SAAS,CAAC;IACd,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iDAAiD;QAC1D,WAAW,EACT,oIAAoI;KACvI,CAAC;;;;sDAGD;kCAzBU,uBAAuB;IAFnC,IAAA,iBAAO,EAAC,eAAe,CAAC;IACxB,IAAA,mBAAU,EAAC,wBAAwB,CAAC;qCAEgB,4CAAoB;GAD5D,uBAAuB,CAiCnC"}
+{"version":3,"file":"impersonation.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/impersonation.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4E;AAC5E,6CAAuE;AAEvE,sFAAiF;AAEjF,6EAAwE;AACxE,6EAAyE;AACzE,+EAA0E;AAE1E,qEAAwD;AACxD,0EAAsE;AAK/D,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAClC,YACmB,oBAA0C,EAC1C,QAA8B;QAD9B,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,aAAQ,GAAR,QAAQ,CAAsB;IAC9C,CAAC;IASE,AAAN,KAAK,CAAC,KAAK,CACD,GAA0B,EAC3B,OAAgB;QAEvB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAC1B,qBAAqB,EACrB,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,EACtC,GAAG,EAAE,CACH,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAC7B,GAAG,EACH,wCAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,CACzC,CACJ,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,EAAE,CAAC;IACvD,CAAC;CACF,CAAA;AAtCY,0DAAuB;AAa5B;IAPL,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,yBAAM,GAAE;IACR,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kDAAkD;QAC3D,WAAW,EACT,uRAAuR;KAC1R,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,+CAAqB;;oDAYnC;AASK;IAPL,IAAA,YAAG,EAAC,SAAS,CAAC;IACd,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iDAAiD;QAC1D,WAAW,EACT,oIAAoI;KACvI,CAAC;;;;sDAGD;kCArCU,uBAAuB;IAHnC,IAAA,iBAAO,EAAC,eAAe,CAAC;IACxB,IAAA,mBAAU,EAAC,wBAAwB,CAAC;IACpC,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;qCAGY,4CAAoB;QAChC,6CAAoB;GAHtC,uBAAuB,CAsCnC"}

package/dist/auth/controllers/tenant.invitation.controller.d.ts

@@ -1,4 +1,4 @@
-import { CommonParamsDto } from '../../common/dtos/common.params.dto';
+import { CacheService } from '../../common/services/cache.service';
 import { ListFilterService } from '../../common/services/list.filter.service';
 import { InviteTenantUserDto } from '../dtos/invite.tenant.user.dto';
 import { TenantInvitationListDto } from '../dtos/tenant.invitation.list.dto';
@@ -8,11 +8,13 @@ export declare class TenantInvitationController {
     private readonly authService;
     private readonly tenantInvitationService;
     private readonly listFilterService;
-    constructor(authService: AuthService, tenantInvitationService: TenantInvitationService, listFilterService: ListFilterService);
+    private readonly cacheService;
+    constructor(authService: AuthService, tenantInvitationService: TenantInvitationService, listFilterService: ListFilterService, cacheService: CacheService);
     invite(dto: InviteTenantUserDto): Promise<import("../..").TenantInvitationEntity>;
     roles(): Promise<import("../..").SystemRoleEntity[]>;
     list(dto: TenantInvitationListDto): Promise<import("../..").CommonListResult>;
-    resend({ id }: CommonParamsDto): Promise<import("../..").TenantInvitationEntity>;
-    revoke({ id }: CommonParamsDto): Promise<import("../..").TenantInvitationEntity>;
+    resend(id: string): Promise<import("../..").TenantInvitationEntity>;
+    revoke(id: string): Promise<import("../..").TenantInvitationEntity>;
+    private throttle;
 }
 //# sourceMappingURL=tenant.invitation.controller.d.ts.map

package/dist/auth/controllers/tenant.invitation.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.invitation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.invitation.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAI7E,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,qBAGa,0BAA0B;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB,EAChD,iBAAiB,EAAE,iBAAiB;IASjD,MAAM,CAAS,GAAG,EAAE,mBAAmB;IAgBvC,KAAK;IAUL,IAAI,CAAS,GAAG,EAAE,uBAAuB;IAgBzC,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAgBvC,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;CAU9C"}
+{"version":3,"file":"tenant.invitation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.invitation.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAK7E,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,qBAIa,0BAA0B;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAHZ,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB,EAChD,iBAAiB,EAAE,iBAAiB,EACpC,YAAY,EAAE,YAAY;IASvC,MAAM,CAAS,GAAG,EAAE,mBAAmB;IAsBvC,KAAK;IAUL,IAAI,CAAS,GAAG,EAAE,uBAAuB;IAgBzC,MAAM,CAA6B,EAAE,EAAE,MAAM;IAsB7C,MAAM,CAA6B,EAAE,EAAE,MAAM;YAYrC,QAAQ;CAevB"}

package/dist/auth/controllers/tenant.invitation.controller.js

@@ -15,23 +15,27 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.TenantInvitationController = void 0;
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
-const common_params_dto_1 = require("../../common/dtos/common.params.dto");
+const strict_validation_pipe_1 = require("../../common/pipes/strict.validation.pipe");
+const cache_service_1 = require("../../common/services/cache.service");
 const list_filter_service_1 = require("../../common/services/list.filter.service");
 const invite_tenant_user_dto_1 = require("../dtos/invite.tenant.user.dto");
 const tenant_invitation_list_dto_1 = require("../dtos/tenant.invitation.list.dto");
+const tenant_invitation_default_enum_1 = require("../enums/tenant.invitation.default.enum");
 const tenant_role_enum_1 = require("../enums/tenant.role.enum");
 const tenant_invitation_data_processor_1 = require("../processors/tenant.invitation.data.processor");
 const tenant_invitation_list_processor_1 = require("../processors/tenant.invitation.list.processor");
 const auth_service_1 = require("../services/auth.service");
 const tenant_invitation_service_1 = require("../services/tenant.invitation.service");
 let TenantInvitationController = class TenantInvitationController {
-    constructor(authService, tenantInvitationService, listFilterService) {
+    constructor(authService, tenantInvitationService, listFilterService, cacheService) {
         this.authService = authService;
         this.tenantInvitationService = tenantInvitationService;
         this.listFilterService = listFilterService;
+        this.cacheService = cacheService;
     }
     async invite(dto) {
         const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        await this.throttle(`tenant-invitations:daily:${user.organization_id}`, 'TENANT_INVITATION_DAILY_LIMIT', tenant_invitation_default_enum_1.TenantInvitationDefault.DAILY_LIMIT, tenant_invitation_default_enum_1.TenantInvitationDefault.DAILY_WINDOW_SECONDS);
         return new tenant_invitation_data_processor_1.TenantInvitationDataProcessor(user, this.tenantInvitationService).process(dto);
     }
     async roles() {
@@ -40,26 +44,30 @@ let TenantInvitationController = class TenantInvitationController {
     }
     async list(dto) {
         const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
-        return new tenant_invitation_list_processor_1.TenantInvitationListProcessor(this.listFilterService).process({
-            ...dto,
-            tenant_id: user.organization_id,
-        });
+        return new tenant_invitation_list_processor_1.TenantInvitationListProcessor(this.listFilterService).process(dto, user.organization_id);
     }
-    async resend({ id }) {
+    async resend(id) {
         const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        await this.throttle(`tenant-invitations:resend:${id}`, 'TENANT_INVITATION_RESEND_LIMIT', tenant_invitation_default_enum_1.TenantInvitationDefault.RESEND_LIMIT, tenant_invitation_default_enum_1.TenantInvitationDefault.RESEND_WINDOW_SECONDS);
         return this.tenantInvitationService.resend(id, user.organization_id, user.id);
     }
-    async revoke({ id }) {
+    async revoke(id) {
         const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
         return this.tenantInvitationService.revoke(id, user.organization_id, user.id);
     }
+    async throttle(key, envName, fallback, windowSeconds) {
+        const configured = Number(process.env[envName]);
+        const limit = Number.isInteger(configured) && configured > 0 ? configured : fallback;
+        if ((await this.cacheService.increment(key, windowSeconds)) > limit)
+            throw new common_1.HttpException('Too many invitation requests; try again later.', common_1.HttpStatus.TOO_MANY_REQUESTS);
+    }
 };
 exports.TenantInvitationController = TenantInvitationController;
 __decorate([
     (0, common_1.Post)(),
     (0, swagger_1.ApiOperation)({
         summary: 'Invite an email into the session organization.',
-        description: 'The roles in `role_ids` are granted in this organization when the invitee accepts. An email with no account gets one — named `full_name`, with a random one-time password mailed to it that must be changed at first sign-in. Refused for an existing member, a system account, or an email with a pending invitation here. Requires the `global.admin` tenant role.',
+        description: 'The roles in `role_ids` are granted in this organization when the invitee accepts. An email with no account gets one — named `full_name`, with an expiring one-time password mailed to it that must be changed at first sign-in. Only an account with a verified email can see or accept an invitation. Refused for an existing member or an email with a pending invitation here; rate-limited per organization per day. Requires the `global.admin` tenant role.',
     }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
@@ -91,11 +99,11 @@ __decorate([
     (0, common_1.Post)(':id/resend'),
     (0, swagger_1.ApiOperation)({
         summary: 'Give a pending invitation a fresh expiry.',
-        description: 'Also revives one that expired unanswered. When the invitation created the account and nobody has signed in to it yet, a fresh one-time password is mailed. Requires the `global.admin` tenant role.',
+        description: 'Also revives one that expired unanswered. When this invitation created the account and nobody has signed in to it yet, a fresh one-time password is mailed. Rate-limited per invitation. Requires the `global.admin` tenant role.',
     }),
-    __param(0, (0, common_1.Param)()),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)
 ], TenantInvitationController.prototype, "resend", null);
 __decorate([
@@ -104,17 +112,19 @@ __decorate([
         summary: 'Revoke a pending invitation.',
         description: 'Requires the `global.admin` tenant role.',
     }),
-    __param(0, (0, common_1.Param)()),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [common_params_dto_1.CommonParamsDto]),
+    __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)
 ], TenantInvitationController.prototype, "revoke", null);
 exports.TenantInvitationController = TenantInvitationController = __decorate([
     (0, swagger_1.ApiTags)('Organization Invitations'),
     (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.UsePipes)(strict_validation_pipe_1.StrictValidationPipe),
     (0, common_1.Controller)('api/organization/invitations'),
     __metadata("design:paramtypes", [auth_service_1.AuthService,
         tenant_invitation_service_1.TenantInvitationService,
-        list_filter_service_1.ListFilterService])
+        list_filter_service_1.ListFilterService,
+        cache_service_1.CacheService])
 ], TenantInvitationController);
 //# sourceMappingURL=tenant.invitation.controller.js.map

package/dist/auth/controllers/tenant.invitation.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.invitation.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.invitation.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4E;AAC5E,6CAAuE;AACvE,2EAAsE;AACtE,mFAA8E;AAC9E,2EAAqE;AACrE,mFAA6E;AAC7E,gEAAuD;AACvD,qGAA+F;AAC/F,qGAA+F;AAC/F,2DAAuD;AACvD,qFAAgF;AAMzE,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YACmB,WAAwB,EACxB,uBAAgD,EAChD,iBAAoC;QAFpC,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,MAAM,CAAS,GAAwB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,gEAA6B,CACtC,IAAI,EACJ,IAAI,CAAC,uBAAuB,CAC7B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAQK,AAAN,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,6BAAU,CAAC,YAAY,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,CAAC;IACvD,CAAC;IAOK,AAAN,KAAK,CAAC,IAAI,CAAS,GAA4B;QAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,gEAA6B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;YACvE,GAAG,GAAG;YACN,SAAS,EAAE,IAAI,CAAC,eAAe;SAChC,CAAC,CAAC;IACL,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACxC,EAAE,EACF,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAOK,AAAN,KAAK,CAAC,MAAM,CAAU,EAAE,EAAE,EAAmB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACxC,EAAE,EACF,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;CACF,CAAA;AAjFY,gEAA0B;AAa/B;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EACT,sWAAsW;KACzW,CAAC;IACY,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,4CAAmB;;wDAQ5C;AAQK;IANL,IAAA,YAAG,EAAC,OAAO,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,iGAAiG;KACpG,CAAC;;;;uDAID;AAOK;IALL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,0CAA0C;KACxD,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,oDAAuB;;sDAQ9C;AAQK;IANL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,qMAAqM;KACxM,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;wDAS5C;AAOK;IALL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,0CAA0C;KACxD,CAAC;IACY,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAS,mCAAe;;wDAS5C;qCAhFU,0BAA0B;IAHtC,IAAA,iBAAO,EAAC,0BAA0B,CAAC;IACnC,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,8BAA8B,CAAC;qCAGT,0BAAW;QACC,mDAAuB;QAC7B,uCAAiB;GAJ5C,0BAA0B,CAiFtC"}
+{"version":3,"file":"tenant.invitation.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.invitation.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,6CAAuE;AACvE,sFAAiF;AACjF,uEAAmE;AACnE,mFAA8E;AAC9E,2EAAqE;AACrE,mFAA6E;AAC7E,4FAAkF;AAClF,gEAAuD;AACvD,qGAA+F;AAC/F,qGAA+F;AAC/F,2DAAuD;AACvD,qFAAgF;AAOzE,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YACmB,WAAwB,EACxB,uBAAgD,EAChD,iBAAoC,EACpC,YAA0B;QAH1B,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAQE,AAAN,KAAK,CAAC,MAAM,CAAS,GAAwB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,MAAM,IAAI,CAAC,QAAQ,CACjB,4BAA4B,IAAI,CAAC,eAAe,EAAE,EAClD,+BAA+B,EAC/B,wDAAuB,CAAC,WAAW,EACnC,wDAAuB,CAAC,oBAAoB,CAC7C,CAAC;QACF,OAAO,IAAI,gEAA6B,CACtC,IAAI,EACJ,IAAI,CAAC,uBAAuB,CAC7B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAQK,AAAN,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,6BAAU,CAAC,YAAY,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,CAAC;IACvD,CAAC;IAOK,AAAN,KAAK,CAAC,IAAI,CAAS,GAA4B;QAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,gEAA6B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CACtE,GAAG,EACH,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,MAAM,IAAI,CAAC,QAAQ,CACjB,6BAA6B,EAAE,EAAE,EACjC,gCAAgC,EAChC,wDAAuB,CAAC,YAAY,EACpC,wDAAuB,CAAC,qBAAqB,CAC9C,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACxC,EAAE,EACF,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAOK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACxC,EAAE,EACF,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAGO,KAAK,CAAC,QAAQ,CACpB,GAAW,EACX,OAAe,EACf,QAAgB,EAChB,aAAqB;QAErB,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,MAAM,KAAK,GACT,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,GAAG,KAAK;YACjE,MAAM,IAAI,sBAAa,CACrB,gDAAgD,EAChD,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;IACN,CAAC;CACF,CAAA;AA/GY,gEAA0B;AAc/B;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EACT,ocAAoc;KACvc,CAAC;IACY,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,4CAAmB;;wDAc5C;AAQK;IANL,IAAA,YAAG,EAAC,OAAO,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,iGAAiG;KACpG,CAAC;;;;uDAID;AAOK;IALL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,0CAA0C;KACxD,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,oDAAuB;;sDAQ9C;AAQK;IANL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,mOAAmO;KACtO,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;wDAevC;AAOK;IALL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,0CAA0C;KACxD,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;wDASvC;qCA7FU,0BAA0B;IAJtC,IAAA,iBAAO,EAAC,0BAA0B,CAAC;IACnC,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAC9B,IAAA,mBAAU,EAAC,8BAA8B,CAAC;qCAGT,0BAAW;QACC,mDAAuB;QAC7B,uCAAiB;QACtB,4BAAY;GALlC,0BAA0B,CA+GtC"}

package/dist/auth/controllers/tenant.member.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.member.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.member.controller.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAGrE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,qBAGa,sBAAsB;IAE/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB,EAChD,iBAAiB,EAAE,iBAAiB;IASjD,IAAI,CAAS,GAAG,EAAE,mBAAmB;IAgBrC,QAAQ,CACoB,MAAM,EAAE,MAAM,EACtC,GAAG,EAAE,cAAc;IAoBvB,UAAU,CAAiC,MAAM,EAAE,MAAM;IAoBzD,UAAU,CAAiC,MAAM,EAAE,MAAM;IAkBzD,MAAM,CAAiC,MAAM,EAAE,MAAM;IAa3D,OAAO,CAAC,UAAU;CAMnB"}
+{"version":3,"file":"tenant.member.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.member.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAGrE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,qBAIa,sBAAsB;IAE/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB,EAChD,iBAAiB,EAAE,iBAAiB;IASjD,IAAI,CAAS,GAAG,EAAE,mBAAmB;IAgBrC,QAAQ,CACoB,MAAM,EAAE,MAAM,EACtC,GAAG,EAAE,cAAc;IAoBvB,UAAU,CAAiC,MAAM,EAAE,MAAM;IAoBzD,UAAU,CAAiC,MAAM,EAAE,MAAM;IAkBzD,MAAM,CAAiC,MAAM,EAAE,MAAM;IAa3D,OAAO,CAAC,UAAU;CAMnB"}

package/dist/auth/controllers/tenant.member.controller.js

@@ -15,6 +15,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.TenantMemberController = void 0;
 const common_1 = require("@nestjs/common");
 const swagger_1 = require("@nestjs/swagger");
+const strict_validation_pipe_1 = require("../../common/pipes/strict.validation.pipe");
 const list_filter_service_1 = require("../../common/services/list.filter.service");
 const operation_exception_1 = require("../../global/exceptions/operation.exception");
 const member_roles_dto_1 = require("../dtos/member.roles.dto");
@@ -31,10 +32,7 @@ let TenantMemberController = class TenantMemberController {
     }
     async list(dto) {
         const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
-        return new tenant_member_list_processor_1.TenantMemberListProcessor(this.listFilterService).process({
-            ...dto,
-            tenant_id: user.organization_id,
-        });
+        return new tenant_member_list_processor_1.TenantMemberListProcessor(this.listFilterService).process(dto, user.organization_id);
     }
     async setRoles(userId, dto) {
         const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
@@ -121,6 +119,7 @@ __decorate([
 exports.TenantMemberController = TenantMemberController = __decorate([
     (0, swagger_1.ApiTags)('Organization Members'),
     (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.UsePipes)(strict_validation_pipe_1.StrictValidationPipe),
     (0, common_1.Controller)('api/organization/members'),
     __metadata("design:paramtypes", [auth_service_1.AuthService,
         tenant_membership_service_1.TenantMembershipService,

package/dist/auth/controllers/tenant.member.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.member.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.member.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAuE;AACvE,mFAA8E;AAC9E,qFAAiF;AACjF,+DAA0D;AAC1D,2EAAqE;AACrE,gEAAuD;AACvD,6FAAuF;AACvF,2DAAuD;AACvD,qFAAgF;AAMzE,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YACmB,WAAwB,EACxB,uBAAgD,EAChD,iBAAoC;QAFpC,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CAAS,GAAwB;QACzC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,wDAAyB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;YACnE,GAAG,GAAG;YACN,SAAS,EAAE,IAAI,CAAC,eAAe;SAChC,CAAC,CAAC;IACL,CAAC;IAQK,AAAN,KAAK,CAAC,QAAQ,CACoB,MAAc,EACtC,GAAmB;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAChD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,GAAG,CAAC,QAAQ,EACZ,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,UAAU,CAAiC,MAAc;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CACjD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,KAAK,EACL,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,UAAU,CAAiC,MAAc;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CACjD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,IAAI,EACJ,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAiC,MAAc;QACzD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAC9C,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAGO,UAAU,CAAC,MAAc,EAAE,QAAgB;QACjD,IAAI,MAAM,KAAK,QAAQ;YACrB,MAAM,IAAI,wCAAkB,CAC1B,yDAAyD,CAC1D,CAAC;IACN,CAAC;CACF,CAAA;AA5GY,wDAAsB;AAa3B;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0CAA0C;QACnD,WAAW,EACT,gGAAgG;KACnG,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,4CAAmB;;kDAQ1C;AAQK;IANL,IAAA,aAAI,EAAC,eAAe,CAAC;IACrB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uDAAuD;QAChE,WAAW,EACT,4KAA4K;KAC/K,CAAC;IAEC,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;IAC9B,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAM,iCAAc;;sDAW5B;AASK;IAPL,IAAA,aAAI,EAAC,oBAAoB,CAAC;IAC1B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+DAA+D;QACxE,WAAW,EACT,0RAA0R;KAC7R,CAAC;IACgB,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;wDAW/C;AASK;IAPL,IAAA,aAAI,EAAC,oBAAoB,CAAC;IAC1B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+DAA+D;QACxE,WAAW,EACT,8EAA8E;KACjF,CAAC;IACgB,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;wDAU/C;AAQK;IANL,IAAA,eAAM,EAAC,SAAS,CAAC;IACjB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EACT,iPAAiP;KACpP,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;oDAU3C;iCAnGU,sBAAsB;IAHlC,IAAA,iBAAO,EAAC,sBAAsB,CAAC;IAC/B,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,0BAA0B,CAAC;qCAGL,0BAAW;QACC,mDAAuB;QAC7B,uCAAiB;GAJ5C,sBAAsB,CA4GlC"}
+{"version":3,"file":"tenant.member.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.member.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAUwB;AACxB,6CAAuE;AACvE,sFAAiF;AACjF,mFAA8E;AAC9E,qFAAiF;AACjF,+DAA0D;AAC1D,2EAAqE;AACrE,gEAAuD;AACvD,6FAAuF;AACvF,2DAAuD;AACvD,qFAAgF;AAOzE,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YACmB,WAAwB,EACxB,uBAAgD,EAChD,iBAAoC;QAFpC,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CAAS,GAAwB;QACzC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,wDAAyB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAClE,GAAG,EACH,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,QAAQ,CACoB,MAAc,EACtC,GAAmB;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAChD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,GAAG,CAAC,QAAQ,EACZ,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,UAAU,CAAiC,MAAc;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CACjD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,KAAK,EACL,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,UAAU,CAAiC,MAAc;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CACjD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,IAAI,EACJ,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAiC,MAAc;QACzD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAC9C,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAGO,UAAU,CAAC,MAAc,EAAE,QAAgB;QACjD,IAAI,MAAM,KAAK,QAAQ;YACrB,MAAM,IAAI,wCAAkB,CAC1B,yDAAyD,CAC1D,CAAC;IACN,CAAC;CACF,CAAA;AA5GY,wDAAsB;AAa3B;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0CAA0C;QACnD,WAAW,EACT,gGAAgG;KACnG,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,4CAAmB;;kDAQ1C;AAQK;IANL,IAAA,aAAI,EAAC,eAAe,CAAC;IACrB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uDAAuD;QAChE,WAAW,EACT,4KAA4K;KAC/K,CAAC;IAEC,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;IAC9B,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAM,iCAAc;;sDAW5B;AASK;IAPL,IAAA,aAAI,EAAC,oBAAoB,CAAC;IAC1B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+DAA+D;QACxE,WAAW,EACT,0RAA0R;KAC7R,CAAC;IACgB,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;wDAW/C;AASK;IAPL,IAAA,aAAI,EAAC,oBAAoB,CAAC;IAC1B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+DAA+D;QACxE,WAAW,EACT,8EAA8E;KACjF,CAAC;IACgB,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;wDAU/C;AAQK;IANL,IAAA,eAAM,EAAC,SAAS,CAAC;IACjB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EACT,iPAAiP;KACpP,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;oDAU3C;iCAnGU,sBAAsB;IAJlC,IAAA,iBAAO,EAAC,sBAAsB,CAAC;IAC/B,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAC9B,IAAA,mBAAU,EAAC,0BAA0B,CAAC;qCAGL,0BAAW;QACC,mDAAuB;QAC7B,uCAAiB;GAJ5C,sBAAsB,CA4GlC"}

package/dist/auth/controllers/user.invitation.controller.d.ts

@@ -1,4 +1,3 @@
-import { CommonParamsDto } from '../../common/dtos/common.params.dto';
 import { AuthService } from '../services/auth.service';
 import { TenantInvitationService } from '../services/tenant.invitation.service';
 export declare class UserInvitationController {
@@ -6,7 +5,7 @@ export declare class UserInvitationController {
     private readonly tenantInvitationService;
     constructor(authService: AuthService, tenantInvitationService: TenantInvitationService);
     pending(): Promise<import("../..").PendingInvitation[]>;
-    accept({ id }: CommonParamsDto): Promise<import("../..").OrganizationSummary>;
-    decline({ id }: CommonParamsDto): Promise<import("../..").TenantInvitationEntity>;
+    accept(id: string): Promise<import("../..").OrganizationSummary>;
+    decline(id: string): Promise<import("../..").TenantInvitationEntity>;
 }
 //# sourceMappingURL=user.invitation.controller.d.ts.map

package/dist/auth/controllers/user.invitation.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.invitation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/user.invitation.controller.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,qBAGa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;gBADvB,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB;IAS7D,OAAO;IAYP,MAAM,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;IAOvC,OAAO,CAAU,EAAE,EAAE,EAAE,EAAE,eAAe;CAG/C"}
+{"version":3,"file":"user.invitation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/user.invitation.controller.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,qBAIa,wBAAwB;IAEjC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;gBADvB,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB;IAS7D,OAAO;IAYP,MAAM,CAA6B,EAAE,EAAE,MAAM;IAO7C,OAAO,CAA6B,EAAE,EAAE,MAAM;CAGrD"}