@neohm/nestend 4.1.1 → 5.0.0

package/dist/admin/libraries/api.key.data.processor.js

@@ -3,8 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiKeyDataProcessor = void 0;
 const typeorm_1 = require("typeorm");
 const common_data_processor_1 = require("../../common/libraries/common.data.processor");
+const api_key_entity_1 = require("../../auth/entities/api.key.entity");
 const scope_entity_1 = require("../../auth/entities/scope.entity");
+const audit_action_enum_1 = require("../../common/enums/audit.action.enum");
+const entity_constants_1 = require("../../constants/entity.constants");
 const tenant_entity_1 = require("../../tenant/entities/tenant.entity");
+const admin_audit_1 = require("../utilities/admin.audit");
+const admin_policy_1 = require("../utilities/admin.policy");
 class ApiKeyDataProcessor extends common_data_processor_1.CommonDataProcessor {
     constructor(actor, apiKeyService, scopeService) {
         super();
@@ -19,8 +24,13 @@ class ApiKeyDataProcessor extends common_data_processor_1.CommonDataProcessor {
     }
     async validate() {
         const body = this.payload;
-        if (!(await tenant_entity_1.TenantEntity.existsBy({ id: body.tenant_id })))
-            this.setColumnError('tenant_id', 'No tenant exists for this id');
+        const expiry = admin_policy_1.AdminPolicy.apiKeyExpiry(body.expires_at);
+        if (expiry.error)
+            this.setColumnError('expires_at', expiry.error);
+        else
+            this.expiresAt = expiry.expiresAt;
+        if (!(await tenant_entity_1.TenantEntity.existsBy({ id: body.tenant_id, is_active: true })))
+            this.setColumnError('tenant_id', 'Tenant not found or inactive');
         else
             await this.validateScopes();
         this.raiseExceptionOnValidationFailure();
@@ -47,7 +57,20 @@ class ApiKeyDataProcessor extends common_data_processor_1.CommonDataProcessor {
             tenantId: body.tenant_id,
             scopeIds: body.scope_ids,
             createdBy: this.actor.id,
-            ...(body.expires_at ? { expiresAt: new Date(body.expires_at) } : {}),
+            expiresAt: this.expiresAt,
+        });
+        await admin_audit_1.AdminAudit.record(api_key_entity_1.ApiKeyEntity.getRepository().manager, {
+            actor: this.actor,
+            sourceType: entity_constants_1.baseEntityConstants.apiKey,
+            sourceId: apiKey.id,
+            action: audit_action_enum_1.AuditAction.CREATE,
+            newValue: {
+                name: apiKey.name,
+                key_prefix: apiKey.key_prefix,
+                tenant_id: body.tenant_id,
+                scope_ids: body.scope_ids ?? [],
+                expires_at: this.expiresAt.toISOString(),
+            },
         });
         return { raw_key: rawKey, api_key: apiKey };
     }

package/dist/admin/libraries/api.key.data.processor.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.key.data.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/api.key.data.processor.ts"],"names":[],"mappings":";;;AAAA,qCAA6B;AAC7B,wFAAmF;AAEnF,mEAA+D;AAG/D,uEAAmE;AAcnE,MAAa,mBAAoB,SAAQ,2CAAmB;IAG1D,YACmB,KAAsB,EACtB,aAA4B,EAC5B,YAA0B;QAE3C,KAAK,EAAE,CAAC;QAJS,UAAK,GAAL,KAAK,CAAiB;QACtB,kBAAa,GAAb,aAAa,CAAe;QAC5B,iBAAY,GAAZ,YAAY,CAAc;IAG7C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1B,IAAI,CAAC,CAAC,MAAM,4BAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;;YAC9D,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAEjC,IAAI,CAAC,iCAAiC,EAAE,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO;QAE7B,MAAM,MAAM,GAAG,MAAM,0BAAW,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CACpD,IAAI,CAAC,OAAO,CAAC,SAAS,CACvB,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,UAAU,OAAO,aAAa,CAAC,CAAC;gBACjE,SAAS;YACX,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBACvB,IAAI,CAAC,cAAc,CACjB,WAAW,EACX,UAAU,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,UAAU,IAAI,OAAO,kCAAkC,CAChH,CAAC;QACN,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAG;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAChE,IAAI,CAAC,IAAI,EACT;YACE,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrE,CACF,CAAC;QAEF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;CACF;AAlED,kDAkEC"}
+{"version":3,"file":"api.key.data.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/api.key.data.processor.ts"],"names":[],"mappings":";;;AAAA,qCAA6B;AAC7B,wFAAmF;AAEnF,uEAAkE;AAClE,mEAA+D;AAG/D,4EAAmE;AACnE,uEAAuE;AACvE,uEAAmE;AAGnE,0DAAsD;AACtD,4DAAwD;AAMxD,MAAa,mBAAoB,SAAQ,2CAAmB;IAI1D,YACmB,KAAsB,EACtB,aAA4B,EAC5B,YAA0B;QAE3C,KAAK,EAAE,CAAC;QAJS,UAAK,GAAL,KAAK,CAAiB;QACtB,kBAAa,GAAb,aAAa,CAAe;QAC5B,iBAAY,GAAZ,YAAY,CAAc;IAG7C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAqB;QACjC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1B,MAAM,MAAM,GAAG,0BAAW,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,KAAK;YAAE,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;YAC7D,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAiB,CAAC;QAE/C,IAAI,CAAC,CAAC,MAAM,4BAAY,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzE,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;;YAC9D,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAEjC,IAAI,CAAC,iCAAiC,EAAE,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO;QAE7B,MAAM,MAAM,GAAG,MAAM,0BAAW,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAEvD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CACpD,IAAI,CAAC,OAAO,CAAC,SAAS,CACvB,CAAC;QAEF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,UAAU,OAAO,aAAa,CAAC,CAAC;gBACjE,SAAS;YACX,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBACvB,IAAI,CAAC,cAAc,CACjB,WAAW,EACX,UAAU,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,UAAU,IAAI,OAAO,kCAAkC,CAChH,CAAC;QACN,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAG;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,cAAc,CAChE,IAAI,CAAC,IAAI,EACT;YACE,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;YACxB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CACF,CAAC;QAEF,MAAM,wBAAU,CAAC,MAAM,CAAC,6BAAY,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE;YAC5D,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,UAAU,EAAE,sCAAmB,CAAC,MAAM;YACtC,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,MAAM,EAAE,+BAAW,CAAC,MAAM;YAC1B,QAAQ,EAAE;gBACR,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;gBAC/B,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;aACzC;SACF,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC9C,CAAC;CACF;AArFD,kDAqFC"}

package/dist/admin/libraries/bulk.user.data.processor.d.ts

@@ -1,17 +1,20 @@
 import { UserDataProcessor } from './user.data.processor';
+import { AdminUserEntity } from '../../auth/entities/admin.user.entity';
 import { TenantService } from '../../tenant/services/tenant.service';
 import { AddBulkUsersDto } from '../dtos/add.bulk.users.dto';
 import type { BulkUserResult } from '../types/admin.types';
 export type { BulkUserResult } from '../types/admin.types';
 export declare class BulkUserDataProcessor extends UserDataProcessor {
+    private readonly actor;
     private readonly tenantService;
     protected payload: AddBulkUsersDto;
-    constructor(tenantService: TenantService);
+    constructor(actor: AdminUserEntity, tenantService: TenantService);
     process(payload: AddBulkUsersDto): Promise<BulkUserResult>;
     private validate;
     private create;
     private flagDuplicateEmails;
     private flagMissingPasswords;
     private flagTakenEmails;
+    private flagTakenContacts;
 }
 //# sourceMappingURL=bulk.user.data.processor.d.ts.map

package/dist/admin/libraries/bulk.user.data.processor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bulk.user.data.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/bulk.user.data.processor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAI1D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAQ3D,qBAAa,qBAAsB,SAAQ,iBAAiB;IAG9C,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEN,aAAa,EAAE,aAAa;IAInD,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;YAMlD,QAAQ;YAYR,MAAM;IAsCpB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,oBAAoB;YAQd,eAAe;CAe9B"}
+{"version":3,"file":"bulk.user.data.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/bulk.user.data.processor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAGxE,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAO7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAQ3D,qBAAa,qBAAsB,SAAQ,iBAAiB;IAIxD,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAJhC,SAAS,CAAC,OAAO,EAAE,eAAe,CAAC;gBAGhB,KAAK,EAAE,eAAe,EACtB,aAAa,EAAE,aAAa;IAKzC,OAAO,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC;YAMlD,QAAQ;YAaR,MAAM;IA8CpB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,oBAAoB;YAQd,eAAe;YAiBf,iBAAiB;CA4BhC"}

package/dist/admin/libraries/bulk.user.data.processor.js

@@ -1,14 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BulkUserDataProcessor = void 0;
+const typeorm_1 = require("typeorm");
 const user_data_processor_1 = require("./user.data.processor");
 const user_entity_1 = require("../../auth/entities/user.entity");
 const user_type_enum_1 = require("../../auth/enums/user.type.enum");
 const tenant_user_entity_1 = require("../../auth/entities/tenant.user.entity");
 const auth_utilities_1 = require("../../auth/utilities/auth.utilities");
+const audit_action_enum_1 = require("../../common/enums/audit.action.enum");
+const entity_constants_1 = require("../../constants/entity.constants");
+const admin_audit_1 = require("../utilities/admin.audit");
+const admin_default_enum_1 = require("../enums/admin.default.enum");
+const bounded_concurrency_1 = require("../utilities/bounded.concurrency");
 class BulkUserDataProcessor extends user_data_processor_1.UserDataProcessor {
-    constructor(tenantService) {
+    constructor(actor, tenantService) {
         super();
+        this.actor = actor;
         this.tenantService = tenantService;
     }
     async process(payload) {
@@ -22,12 +29,13 @@ class BulkUserDataProcessor extends user_data_processor_1.UserDataProcessor {
             this.setColumnError('tenant_id', 'Tenant not found or inactive');
         this.flagDuplicateEmails();
         await this.flagTakenEmails();
+        await this.flagTakenContacts();
         this.flagMissingPasswords();
         this.raiseExceptionOnValidationFailure();
     }
     async create() {
         const body = this.payload;
-        const entities = await Promise.all(body.users.map(async (user) => user_entity_1.UserEntity.create({
+        const entities = await bounded_concurrency_1.BoundedConcurrency.map(body.users, admin_default_enum_1.AdminLimit.BULK_HASH_CONCURRENCY, async (user) => user_entity_1.UserEntity.create({
             user_type: user_type_enum_1.UserType.TENANT_USER,
             organization_id: body.tenant_id,
             full_name: user.full_name,
@@ -37,13 +45,20 @@ class BulkUserDataProcessor extends user_data_processor_1.UserDataProcessor {
             contact_code: user.contact_code,
             contact: user.contact,
             active: user.active ?? true,
-        })));
+        }));
         await user_entity_1.UserEntity.getRepository().manager.transaction(async (trx) => {
             await trx.save(entities);
             await trx.save(entities.map((user) => trx.create(tenant_user_entity_1.TenantUserEntity, {
                 user_id: user.id,
                 tenant_id: body.tenant_id,
             })));
+            await admin_audit_1.AdminAudit.record(trx, {
+                actor: this.actor,
+                sourceType: entity_constants_1.baseEntityConstants.tenant,
+                sourceId: body.tenant_id,
+                action: audit_action_enum_1.AuditAction.IMPORT,
+                context: { user_ids: entities.map((user) => user.id) },
+            });
         });
         return {
             created: entities.length,
@@ -81,6 +96,27 @@ class BulkUserDataProcessor extends user_data_processor_1.UserDataProcessor {
             }
         });
     }
+    async flagTakenContacts() {
+        const key = (contact, code) => `${code ?? ''}|${contact}`;
+        const rows = this.payload.users
+            .map((user, index) => ({ user, index }))
+            .filter(({ user }) => !!user.contact);
+        if (!rows.length)
+            return;
+        const existing = await user_entity_1.UserEntity.find({
+            where: { contact: (0, typeorm_1.In)(rows.map(({ user }) => user.contact)) },
+            select: { id: true, contact: true, contact_code: true },
+        });
+        const seen = new Set();
+        for (const { user, index } of rows) {
+            const taken = existing.some((row) => row.contact === user.contact &&
+                (!user.contact_code || row.contact_code === user.contact_code));
+            const k = key(user.contact, user.contact_code);
+            if (taken || seen.has(k))
+                this.setColumnError(`users[${index}].contact`, 'Contact number is already registered');
+            seen.add(k);
+        }
+    }
 }
 exports.BulkUserDataProcessor = BulkUserDataProcessor;
 //# sourceMappingURL=bulk.user.data.processor.js.map

package/dist/admin/libraries/bulk.user.data.processor.js.map

@@ -1 +1 @@
-{"version":3,"file":"bulk.user.data.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/bulk.user.data.processor.ts"],"names":[],"mappings":";;;AAAA,+DAA0D;AAC1D,iEAA6D;AAC7D,oEAA2D;AAC3D,+EAA0E;AAG1E,wEAAkE;AAUlE,MAAa,qBAAsB,SAAQ,uCAAiB;IAG1D,YAA6B,aAA4B;QACvD,KAAK,EAAE,CAAC;QADmB,kBAAa,GAAb,aAAa,CAAe;IAEzD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAwB;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM;YACT,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;QAEnE,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7B,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE5B,IAAI,CAAC,iCAAiC,EAAE,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAC5B,wBAAU,CAAC,MAAM,CAAC;YAChB,SAAS,EAAE,yBAAQ,CAAC,WAAW;YAC/B,eAAe,EAAE,IAAI,CAAC,SAAS;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,MAAM,4BAAW,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YACvD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;SAC5B,CAAC,CACH,CACF,CAAC;QAEF,MAAM,wBAAU,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,MAAM,GAAG,CAAC,IAAI,CACZ,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACpB,GAAG,CAAC,MAAM,CAAC,qCAAgB,EAAE;gBAC3B,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CACH,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,MAAM;YACxB,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;SACvD,CAAC;IACJ,CAAC;IAGO,mBAAmB;QACzB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,CAAC,cAAc,CACjB,SAAS,KAAK,SAAS,EACvB,mDAAmD,IAAI,GAAG,CAC3D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAMO,oBAAoB;QAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACzC,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAChB,IAAI,CAAC,cAAc,CAAC,SAAS,KAAK,YAAY,EAAE,sBAAsB,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAGO,KAAK,CAAC,eAAe;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,wBAAU,CAAC,IAAI,CAAC;YACrC,KAAK,EAAE,EAAE,KAAK,EAAE,wBAAU,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE;SACnD,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACzC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,cAAc,CACjB,SAAS,KAAK,SAAS,EACvB,6BAA6B,CAC9B,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AA1GD,sDA0GC"}
+{"version":3,"file":"bulk.user.data.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/bulk.user.data.processor.ts"],"names":[],"mappings":";;;AAAA,qCAA6B;AAC7B,+DAA0D;AAC1D,iEAA6D;AAE7D,oEAA2D;AAC3D,+EAA0E;AAG1E,wEAAkE;AAClE,4EAAmE;AACnE,uEAAuE;AACvE,0DAAsD;AACtD,oEAAyD;AACzD,0EAAsE;AAUtE,MAAa,qBAAsB,SAAQ,uCAAiB;IAG1D,YACmB,KAAsB,EACtB,aAA4B;QAE7C,KAAK,EAAE,CAAC;QAHS,UAAK,GAAL,KAAK,CAAiB;QACtB,kBAAa,GAAb,aAAa,CAAe;IAG/C,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAwB;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM;YACT,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;QAEnE,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAE5B,IAAI,CAAC,iCAAiC,EAAE,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAE1B,MAAM,QAAQ,GAAG,MAAM,wCAAkB,CAAC,GAAG,CAC3C,IAAI,CAAC,KAAK,EACV,+BAAU,CAAC,qBAAqB,EAChC,KAAK,EAAE,IAAI,EAAE,EAAE,CACb,wBAAU,CAAC,MAAM,CAAC;YAChB,SAAS,EAAE,yBAAQ,CAAC,WAAW;YAC/B,eAAe,EAAE,IAAI,CAAC,SAAS;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,MAAM,4BAAW,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC;YACvD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;SAC5B,CAAC,CACL,CAAC;QAEF,MAAM,wBAAU,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACjE,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACzB,MAAM,GAAG,CAAC,IAAI,CACZ,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACpB,GAAG,CAAC,MAAM,CAAC,qCAAgB,EAAE;gBAC3B,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CACH,CACF,CAAC;YACF,MAAM,wBAAU,CAAC,MAAM,CAAC,GAAG,EAAE;gBAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,UAAU,EAAE,sCAAmB,CAAC,MAAM;gBACtC,QAAQ,EAAE,IAAI,CAAC,SAAS;gBACxB,MAAM,EAAE,+BAAW,CAAC,MAAM;gBAC1B,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;aACvD,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,QAAQ,CAAC,MAAM;YACxB,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;SACvD,CAAC;IACJ,CAAC;IAGO,mBAAmB;QACzB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC9C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,CAAC,cAAc,CACjB,SAAS,KAAK,SAAS,EACvB,mDAAmD,IAAI,GAAG,CAC3D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAMO,oBAAoB;QAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACzC,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAChB,IAAI,CAAC,cAAc,CAAC,SAAS,KAAK,YAAY,EAAE,sBAAsB,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAGO,KAAK,CAAC,eAAe;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,MAAM,wBAAU,CAAC,IAAI,CAAC;YACrC,KAAK,EAAE,EAAE,KAAK,EAAE,wBAAU,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE;SACnD,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACzC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,cAAc,CACjB,SAAS,KAAK,SAAS,EACvB,6BAA6B,CAC9B,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAGO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,IAAa,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK;aAC5B,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;aACvC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QAEzB,MAAM,QAAQ,GAAG,MAAM,wBAAU,CAAC,IAAI,CAAC;YACrC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAA,YAAE,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE;YAC5D,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;SACxD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;YAEnC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CACzB,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;gBAC5B,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI,CAAC,YAAY,CAAC,CACjE,CAAC;YACF,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC/C,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtB,IAAI,CAAC,cAAc,CACjB,SAAS,KAAK,WAAW,EACzB,sCAAsC,CACvC,CAAC;YACJ,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACd,CAAC;IACH,CAAC;CACF;AApJD,sDAoJC"}

package/dist/admin/libraries/catalogue.data.processor.d.ts

@@ -0,0 +1,15 @@
+import { EntityManager, Repository } from 'typeorm';
+import { CommonDataProcessor } from '../../common/libraries/common.data.processor';
+export declare abstract class CatalogueDataProcessor<E extends {
+    id: string;
+}> extends CommonDataProcessor {
+    protected existing: E | null;
+    protected abstract readonly label: string;
+    protected abstract repository(): Repository<E>;
+    protected get isNew(): boolean;
+    protected loadExisting(id: string | undefined): Promise<void>;
+    protected assertUnique(field: keyof E & string, value: unknown, selfId: string | undefined): Promise<void>;
+    protected assertImmutable(field: keyof E & string, next: unknown): void;
+    protected transaction<T>(work: (manager: EntityManager) => Promise<T>): Promise<T>;
+}
+//# sourceMappingURL=catalogue.data.processor.d.ts.map

package/dist/admin/libraries/catalogue.data.processor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogue.data.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/catalogue.data.processor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAoB,UAAU,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAOnF,8BAAsB,sBAAsB,CAC1C,CAAC,SAAS;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,CACxB,SAAQ,mBAAmB;IAE3B,SAAS,CAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAQ;IAGpC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAE1C,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC,CAAC;IAE9C,SAAS,KAAK,KAAK,IAAI,OAAO,CAE7B;cAGe,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;cAUnD,YAAY,CAC1B,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,EACvB,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,OAAO,CAAC,IAAI,CAAC;IAahB,SAAS,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI;IASvE,SAAS,CAAC,WAAW,CAAC,CAAC,EACrB,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3C,OAAO,CAAC,CAAC,CAAC;CAGd"}

package/dist/admin/libraries/catalogue.data.processor.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CatalogueDataProcessor = void 0;
+const common_data_processor_1 = require("../../common/libraries/common.data.processor");
+class CatalogueDataProcessor extends common_data_processor_1.CommonDataProcessor {
+    constructor() {
+        super(...arguments);
+        this.existing = null;
+    }
+    get isNew() {
+        return !this.existing;
+    }
+    async loadExisting(id) {
+        if (!id)
+            return;
+        this.existing = await this.repository().findOne({
+            where: { id },
+        });
+        if (!this.existing)
+            this.setColumnError('id', `No ${this.label} exists for this id`);
+    }
+    async assertUnique(field, value, selfId) {
+        if (value === undefined || value === null)
+            return;
+        const owner = await this.repository().findOne({
+            where: { [field]: value },
+        });
+        if (owner && owner.id !== selfId)
+            this.setColumnError(field, `Another ${this.label} already uses this ${field}`);
+    }
+    assertImmutable(field, next) {
+        if (!this.existing || next === undefined)
+            return;
+        if ((this.existing[field] ?? null) !== (next ?? null))
+            this.setColumnError(field, `${field} cannot be changed once the ${this.label} exists; create a new one instead`);
+    }
+    transaction(work) {
+        return this.repository().manager.transaction(work);
+    }
+}
+exports.CatalogueDataProcessor = CatalogueDataProcessor;
+//# sourceMappingURL=catalogue.data.processor.js.map

package/dist/admin/libraries/catalogue.data.processor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalogue.data.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/catalogue.data.processor.ts"],"names":[],"mappings":";;;AACA,wFAAmF;AAOnF,MAAsB,sBAEpB,SAAQ,2CAAmB;IAF7B;;QAIY,aAAQ,GAAa,IAAI,CAAC;IAqDtC,CAAC;IA9CC,IAAc,KAAK;QACjB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;IACxB,CAAC;IAGS,KAAK,CAAC,YAAY,CAAC,EAAsB;QACjD,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,IAAI,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC;YAC9C,KAAK,EAAE,EAAE,EAAE,EAAyB;SACrC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,QAAQ;YAChB,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,KAAK,qBAAqB,CAAC,CAAC;IACrE,CAAC;IAGS,KAAK,CAAC,YAAY,CAC1B,KAAuB,EACvB,KAAc,EACd,MAA0B;QAE1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO;QAClD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAyB;SACjD,CAAC,CAAC;QACH,IAAI,KAAK,IAAI,KAAK,CAAC,EAAE,KAAK,MAAM;YAC9B,IAAI,CAAC,cAAc,CACjB,KAAK,EACL,WAAW,IAAI,CAAC,KAAK,sBAAsB,KAAK,EAAE,CACnD,CAAC;IACN,CAAC;IAGS,eAAe,CAAC,KAAuB,EAAE,IAAa;QAC9D,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO;QACjD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;YACnD,IAAI,CAAC,cAAc,CACjB,KAAK,EACL,GAAG,KAAK,+BAA+B,IAAI,CAAC,KAAK,mCAAmC,CACrF,CAAC;IACN,CAAC;IAES,WAAW,CACnB,IAA4C;QAE5C,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;CACF;AAzDD,wDAyDC"}

package/dist/admin/libraries/client.membership.data.processor.d.ts

@@ -1,11 +1,14 @@
 import { CommonDataProcessor } from '../../common/libraries/common.data.processor';
 import { TenantUserEntity } from '../../auth/entities/tenant.user.entity';
+import { AdminAuthenticatedAccess } from '../../auth/types/auth.types';
 import { TenantService } from '../../tenant/services/tenant.service';
 import { AddClientMembershipDto } from '../dtos/add.client.membership.dto';
 export declare class ClientMembershipDataProcessor extends CommonDataProcessor {
+    private readonly access;
     private readonly tenantService;
     protected payload: AddClientMembershipDto;
-    constructor(tenantService: TenantService);
+    private roles;
+    constructor(access: AdminAuthenticatedAccess, tenantService: TenantService);
     process(payload: AddClientMembershipDto): Promise<TenantUserEntity>;
     private validate;
     private validateRoles;

package/dist/admin/libraries/client.membership.data.processor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.membership.data.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/client.membership.data.processor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAI1E,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAM3E,qBAAa,6BAA8B,SAAQ,mBAAmB;IAGxD,OAAO,CAAC,QAAQ,CAAC,aAAa;IAF1C,SAAS,CAAC,OAAO,EAAE,sBAAsB,CAAC;gBAEb,aAAa,EAAE,aAAa;IAInD,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAM3D,QAAQ;YAgBR,aAAa;YAiBb,MAAM;CAWrB"}
+{"version":3,"file":"client.membership.data.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/client.membership.data.processor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAC;AAEnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAI1E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAGvE,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mCAAmC,CAAC;AAU3E,qBAAa,6BAA8B,SAAQ,mBAAmB;IAKlE,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IALhC,SAAS,CAAC,OAAO,EAAE,sBAAsB,CAAC;IAC1C,OAAO,CAAC,KAAK,CAA0B;gBAGpB,MAAM,EAAE,wBAAwB,EAChC,aAAa,EAAE,aAAa;IAKzC,OAAO,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC;YAM3D,QAAQ;YA6BR,aAAa;YAiBb,MAAM;CAsBrB"}

package/dist/admin/libraries/client.membership.data.processor.js

@@ -8,10 +8,17 @@ const tenant_user_entity_1 = require("../../auth/entities/tenant.user.entity");
 const user_entity_1 = require("../../auth/entities/user.entity");
 const user_type_enum_1 = require("../../auth/enums/user.type.enum");
 const tenant_access_1 = require("../../auth/utilities/tenant.access");
+const audit_action_enum_1 = require("../../common/enums/audit.action.enum");
+const entity_constants_1 = require("../../constants/entity.constants");
+const admin_access_service_1 = require("../services/admin.access.service");
+const admin_audit_1 = require("../utilities/admin.audit");
+const tenant_role_policy_1 = require("../utilities/tenant.role.policy");
 class ClientMembershipDataProcessor extends common_data_processor_1.CommonDataProcessor {
-    constructor(tenantService) {
+    constructor(access, tenantService) {
         super();
+        this.access = access;
         this.tenantService = tenantService;
+        this.roles = [];
     }
     async process(payload) {
         this.payload = payload;
@@ -20,8 +27,10 @@ class ClientMembershipDataProcessor extends common_data_processor_1.CommonDataPr
     }
     async validate() {
         const { user_id, tenant_id } = this.payload;
-        const user = await user_entity_1.UserEntity.findOne({ where: { id: user_id } });
-        if (!user || user.user_type !== user_type_enum_1.UserType.TENANT_USER)
+        const user = await user_entity_1.UserEntity.findOne({
+            where: { id: user_id, user_type: user_type_enum_1.UserType.TENANT_USER },
+        });
+        if (!user)
             this.setColumnError('user_id', 'No client user exists for this id');
         if (!(await this.tenantService.findByUuid(tenant_id)))
             this.setColumnError('tenant_id', 'Tenant not found or inactive');
@@ -29,23 +38,41 @@ class ClientMembershipDataProcessor extends common_data_processor_1.CommonDataPr
             this.setColumnError('tenant_id', 'Already a member of this tenant');
         await this.validateRoles();
         this.raiseExceptionOnValidationFailure();
+        admin_access_service_1.AdminAccessService.assertHolds(this.access, tenant_role_policy_1.TenantRolePolicy.tenantUserSaveRole({
+            grantsPrivileged: tenant_role_policy_1.TenantRolePolicy.newPrivilegedGrants(this.roles).length > 0,
+            emailChanged: false,
+            holdsPrivileged: false,
+        }), 'Granting a privileged tenant role');
     }
     async validateRoles() {
         const roleIds = [...new Set(this.payload.role_ids ?? [])];
         if (!roleIds.length)
             return;
-        const roles = await system_role_entity_1.SystemRoleEntity.findBy({
+        this.roles = await system_role_entity_1.SystemRoleEntity.findBy({
             id: (0, typeorm_1.In)(roleIds),
             is_active: true,
         });
-        const found = new Set(roles.map((role) => role.id));
+        const found = new Set(this.roles.map((role) => role.id));
         for (const roleId of roleIds)
             if (!found.has(roleId))
                 this.setColumnError('role_ids', `Role '${roleId}' not found or inactive`);
     }
     async create() {
         const { user_id, tenant_id, role_ids } = this.payload;
-        await tenant_user_entity_1.TenantUserEntity.getRepository().manager.transaction((trx) => tenant_access_1.TenantAccess.join(trx, user_id, tenant_id, role_ids ?? []));
+        await tenant_user_entity_1.TenantUserEntity.getRepository().manager.transaction(async (trx) => {
+            await tenant_access_1.TenantAccess.join(trx, user_id, tenant_id, role_ids ?? []);
+            const membership = await trx.findOneByOrFail(tenant_user_entity_1.TenantUserEntity, {
+                user_id,
+                tenant_id,
+            });
+            await admin_audit_1.AdminAudit.record(trx, {
+                actor: this.access.user,
+                sourceType: entity_constants_1.baseEntityConstants.tenantUser,
+                sourceId: membership.id,
+                action: audit_action_enum_1.AuditAction.CREATE,
+                newValue: { user_id, tenant_id, role_ids: role_ids ?? [] },
+            });
+        });
         return tenant_user_entity_1.TenantUserEntity.findOneOrFail({
             where: { user_id, tenant_id },
             relations: { tenant: true },

package/dist/admin/libraries/client.membership.data.processor.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.membership.data.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/client.membership.data.processor.ts"],"names":[],"mappings":";;;AAAA,qCAA6B;AAC7B,wFAAmF;AACnF,+EAA0E;AAC1E,+EAA0E;AAC1E,iEAA6D;AAC7D,oEAA2D;AAC3D,sEAAkE;AAQlE,MAAa,6BAA8B,SAAQ,2CAAmB;IAGpE,YAA6B,aAA4B;QACvD,KAAK,EAAE,CAAC;QADmB,kBAAa,GAAb,aAAa,CAAe;IAEzD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAA+B;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAE5C,MAAM,IAAI,GAAG,MAAM,wBAAU,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,yBAAQ,CAAC,WAAW;YAClD,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;QAEtE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;aAC9D,IAAI,MAAM,qCAAgB,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC9D,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC;QAEtE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,iCAAiC,EAAE,CAAC;IAC3C,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO;QAE5B,MAAM,KAAK,GAAG,MAAM,qCAAgB,CAAC,MAAM,CAAC;YAC1C,EAAE,EAAE,IAAA,YAAE,EAAC,OAAO,CAAC;YACf,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACpD,KAAK,MAAM,MAAM,IAAI,OAAO;YAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBACpB,IAAI,CAAC,cAAc,CACjB,UAAU,EACV,SAAS,MAAM,yBAAyB,CACzC,CAAC;IACR,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEtD,MAAM,qCAAgB,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,EAAE,EAAE,CACjE,4BAAY,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC,CAC3D,CAAC;QACF,OAAO,qCAAgB,CAAC,aAAa,CAAC;YACpC,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE;YAC7B,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;CACF;AAzDD,sEAyDC"}
+{"version":3,"file":"client.membership.data.processor.js","sourceRoot":"","sources":["../../../src/admin/libraries/client.membership.data.processor.ts"],"names":[],"mappings":";;;AAAA,qCAA6B;AAC7B,wFAAmF;AACnF,+EAA0E;AAC1E,+EAA0E;AAC1E,iEAA6D;AAC7D,oEAA2D;AAC3D,sEAAkE;AAElE,4EAAmE;AACnE,uEAAuE;AAGvE,2EAAsE;AACtE,0DAAsD;AACtD,wEAAmE;AAOnE,MAAa,6BAA8B,SAAQ,2CAAmB;IAIpE,YACmB,MAAgC,EAChC,aAA4B;QAE7C,KAAK,EAAE,CAAC;QAHS,WAAM,GAAN,MAAM,CAA0B;QAChC,kBAAa,GAAb,aAAa,CAAe;QAJvC,UAAK,GAAuB,EAAE,CAAC;IAOvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAA+B;QAC3C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAE5C,MAAM,IAAI,GAAG,MAAM,wBAAU,CAAC,OAAO,CAAC;YACpC,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,yBAAQ,CAAC,WAAW,EAAE;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI;YACP,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,mCAAmC,CAAC,CAAC;QAEtE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,8BAA8B,CAAC,CAAC;aAC9D,IAAI,MAAM,qCAAgB,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YAC9D,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,iCAAiC,CAAC,CAAC;QAEtE,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,iCAAiC,EAAE,CAAC;QAEzC,yCAAkB,CAAC,WAAW,CAC5B,IAAI,CAAC,MAAM,EACX,qCAAgB,CAAC,kBAAkB,CAAC;YAClC,gBAAgB,EACd,qCAAgB,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;YAC7D,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;SACvB,CAAC,EACF,mCAAmC,CACpC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO;QAE5B,IAAI,CAAC,KAAK,GAAG,MAAM,qCAAgB,CAAC,MAAM,CAAC;YACzC,EAAE,EAAE,IAAA,YAAE,EAAC,OAAO,CAAC;YACf,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,KAAK,MAAM,MAAM,IAAI,OAAO;YAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBACpB,IAAI,CAAC,cAAc,CACjB,UAAU,EACV,SAAS,MAAM,yBAAyB,CACzC,CAAC;IACR,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QAEtD,MAAM,qCAAgB,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACvE,MAAM,4BAAY,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,qCAAgB,EAAE;gBAC7D,OAAO;gBACP,SAAS;aACV,CAAC,CAAC;YACH,MAAM,wBAAU,CAAC,MAAM,CAAC,GAAG,EAAE;gBAC3B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;gBACvB,UAAU,EAAE,sCAAmB,CAAC,UAAU;gBAC1C,QAAQ,EAAE,UAAU,CAAC,EAAE;gBACvB,MAAM,EAAE,+BAAW,CAAC,MAAM;gBAC1B,QAAQ,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE;aAC3D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,qCAAgB,CAAC,aAAa,CAAC;YACpC,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE;YAC7B,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SAC5B,CAAC,CAAC;IACL,CAAC;CACF;AArFD,sEAqFC"}

package/dist/admin/libraries/client.user.data.processor.d.ts

@@ -3,21 +3,27 @@ import { UserEntity } from '../../auth/entities/user.entity';
 import { TenantService } from '../../tenant/services/tenant.service';
 import { AddClientUserDto } from '../dtos/add.client.user.dto';
 import { TenantUserOnboardedMailJob } from '../../notification/jobs/tenant.user.onboarded.mail.job';
+import { AdminAuthenticatedAccess } from '../../auth/types/auth.types';
 export declare class ClientUserDataProcessor extends UserDataProcessor {
+    private readonly access;
     private readonly tenantService;
     private readonly tenantUserOnboardedMailJob;
     protected payload: AddClientUserDto;
     private readonly logger;
     private tenant;
-    constructor(tenantService: TenantService, tenantUserOnboardedMailJob: TenantUserOnboardedMailJob);
+    private existing;
+    constructor(access: AdminAuthenticatedAccess, tenantService: TenantService, tenantUserOnboardedMailJob: TenantUserOnboardedMailJob);
     process(payload: AddClientUserDto): Promise<UserEntity>;
     private validate;
     private validateTenant;
     private validateMembership;
     private resolveRoles;
+    private authorize;
     private save;
     private create;
     private update;
+    private heldRoleIds;
+    private audit;
     private notifyUser;
 }
 //# sourceMappingURL=client.user.data.processor.d.ts.map

package/dist/admin/libraries/client.user.data.processor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.user.data.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/client.user.data.processor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAG7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAE/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AAoBpG,qBAAa,uBAAwB,SAAQ,iBAAiB;IAO1D,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAP7C,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;IAEnE,OAAO,CAAC,MAAM,CAA6B;gBAGxB,aAAa,EAAE,aAAa,EAC5B,0BAA0B,EAAE,0BAA0B;IAKnE,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;YAM/C,QAAQ;YAuBR,cAAc;YAQd,kBAAkB;YAYlB,YAAY;YAwBZ,IAAI;YAKJ,MAAM;YA+BN,MAAM;YAgCN,UAAU;CAiBzB"}
+{"version":3,"file":"client.user.data.processor.d.ts","sourceRoot":"","sources":["../../../src/admin/libraries/client.user.data.processor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAG7D,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAG/D,OAAO,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AAMpG,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAwBvE,qBAAa,uBAAwB,SAAQ,iBAAiB;IAQ1D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,0BAA0B;IAT7C,SAAS,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;IAEnE,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,QAAQ,CAA2B;gBAGxB,MAAM,EAAE,wBAAwB,EAChC,aAAa,EAAE,aAAa,EAC5B,0BAA0B,EAAE,0BAA0B;IAKnE,OAAO,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC;YAM/C,QAAQ;YA6BR,cAAc;YAQd,kBAAkB;YAYlB,YAAY;YAmBZ,SAAS;YA6BT,IAAI;YAKJ,MAAM;YAmCN,MAAM;YAuCN,WAAW;IAQzB,OAAO,CAAC,KAAK;YAuBC,UAAU;CAiBzB"}

package/dist/admin/libraries/client.user.data.processor.js

@@ -2,22 +2,30 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ClientUserDataProcessor = void 0;
 const common_1 = require("@nestjs/common");
+const typeorm_1 = require("typeorm");
 const user_data_processor_1 = require("./user.data.processor");
 const user_entity_1 = require("../../auth/entities/user.entity");
 const user_type_enum_1 = require("../../auth/enums/user.type.enum");
 const auth_utilities_1 = require("../../auth/utilities/auth.utilities");
+const access_revocation_1 = require("../../auth/utilities/access.revocation");
 const tenant_user_entity_1 = require("../../auth/entities/tenant.user.entity");
+const user_role_entity_1 = require("../../auth/entities/user.role.entity");
 const tenant_access_1 = require("../../auth/utilities/tenant.access");
-const access_exception_1 = require("../../global/exceptions/access.exception");
-const typeorm_1 = require("typeorm");
 const system_role_entity_1 = require("../../auth/entities/system.role.entity");
+const audit_action_enum_1 = require("../../common/enums/audit.action.enum");
+const entity_constants_1 = require("../../constants/entity.constants");
+const admin_access_service_1 = require("../services/admin.access.service");
+const admin_audit_1 = require("../utilities/admin.audit");
+const tenant_role_policy_1 = require("../utilities/tenant.role.policy");
 class ClientUserDataProcessor extends user_data_processor_1.UserDataProcessor {
-    constructor(tenantService, tenantUserOnboardedMailJob) {
+    constructor(access, tenantService, tenantUserOnboardedMailJob) {
         super();
+        this.access = access;
         this.tenantService = tenantService;
         this.tenantUserOnboardedMailJob = tenantUserOnboardedMailJob;
         this.logger = new common_1.Logger(ClientUserDataProcessor.name);
         this.tenant = null;
+        this.existing = null;
     }
     async process(payload) {
         this.payload = payload;
@@ -26,16 +34,22 @@ class ClientUserDataProcessor extends user_data_processor_1.UserDataProcessor {
     }
     async validate() {
         const editId = this.payload.id;
-        if (editId && !(await user_entity_1.UserEntity.existsBy({ id: editId })))
-            this.setColumnError('id', 'No client user exists for this id');
+        if (editId) {
+            this.existing = await user_entity_1.UserEntity.findOne({
+                where: { id: editId, user_type: user_type_enum_1.UserType.TENANT_USER },
+            });
+            if (!this.existing)
+                this.setColumnError('id', 'No client user exists for this id');
+        }
         await this.validateTenant();
-        if (editId)
-            await this.validateMembership(editId);
+        if (this.existing)
+            await this.validateMembership(this.existing.id);
         await this.validateEmail(this.payload.email, 'email', editId);
         await this.validateContact(this.payload.contact, this.payload.contact_code, 'contact', editId);
         this.validatePassword(this.payload.password, !!editId);
-        await this.resolveRoles(this.payload.role_ids, 'role_ids');
+        const roles = await this.resolveRoles(this.payload.role_ids, 'role_ids');
         this.raiseExceptionOnValidationFailure();
+        await this.authorize(roles);
     }
     async validateTenant() {
         const tenant = await this.tenantService.findByUuid(this.payload.tenant_id);
@@ -52,27 +66,38 @@ class ClientUserDataProcessor extends user_data_processor_1.UserDataProcessor {
             this.setColumnError('tenant_id', 'This user is not a member of this tenant');
     }
     async resolveRoles(roleIds, field) {
-        if (!roleIds?.length) {
+        const uniqueRoleIds = [...new Set(roleIds ?? [])];
+        if (!uniqueRoleIds.length)
             return [];
-        }
-        const uniqueRoleIds = [...new Set(roleIds.map((role_id) => role_id))];
         const roles = await system_role_entity_1.SystemRoleEntity.find({
-            where: {
-                id: (0, typeorm_1.In)(uniqueRoleIds),
-                is_active: true,
-            },
+            where: { id: (0, typeorm_1.In)(uniqueRoleIds), is_active: true },
         });
         const foundRoleIds = new Set(roles.map((role) => role.id));
-        for (const roleId of uniqueRoleIds) {
-            if (!foundRoleIds.has(roleId)) {
+        for (const roleId of uniqueRoleIds)
+            if (!foundRoleIds.has(roleId))
                 this.setColumnError(field, `Role '${roleId}' not found or inactive`);
-            }
-        }
         return roles;
     }
+    async authorize(roles) {
+        const held = this.existing
+            ? await user_role_entity_1.UserRoleEntity.find({
+                where: { user_id: this.existing.id },
+                relations: { role: true },
+            })
+            : [];
+        const heldInTenant = held
+            .filter((grant) => grant.tenant_id === this.payload.tenant_id)
+            .map((grant) => grant.role_id);
+        const required = tenant_role_policy_1.TenantRolePolicy.tenantUserSaveRole({
+            grantsPrivileged: tenant_role_policy_1.TenantRolePolicy.newPrivilegedGrants(roles, heldInTenant).length > 0,
+            emailChanged: tenant_role_policy_1.TenantRolePolicy.emailChanged(this.existing?.email, this.existing ? this.payload.email : undefined),
+            holdsPrivileged: held.some((grant) => tenant_role_policy_1.TenantRolePolicy.isPrivileged(grant.role?.identifier)),
+        });
+        admin_access_service_1.AdminAccessService.assertHolds(this.access, required, 'Granting a privileged tenant role, or changing the email of an account holding one,');
+    }
     async save() {
-        if (this.payload?.id)
-            return this.update();
+        if (this.existing)
+            return this.update(this.existing);
         return this.create();
     }
     async create() {
@@ -92,27 +117,61 @@ class ClientUserDataProcessor extends user_data_processor_1.UserDataProcessor {
         await user_entity_1.UserEntity.getRepository().manager.transaction(async (trx) => {
             await trx.save(user);
             await tenant_access_1.TenantAccess.join(trx, user.id, body.tenant_id, body.role_ids ?? []);
+            await this.audit(trx, user, null, {
+                tenant_id: body.tenant_id,
+                role_ids: body.role_ids ?? [],
+            });
         });
         await this.notifyUser(user);
         return this.stripSecrets(user);
     }
-    async update() {
+    async update(user) {
         const body = this.payload;
-        const user = await user_entity_1.UserEntity.findOne({ where: { id: body.id } });
-        if (!user)
-            throw new access_exception_1.AccessException('Invalid user id provided');
+        const before = admin_audit_1.AdminAudit.pick(user, user_data_processor_1.UserDataProcessor.AUDITED);
+        const wasActive = user.active;
+        const emailChanged = tenant_role_policy_1.TenantRolePolicy.emailChanged(user.email, body.email);
         user.full_name = body.full_name;
         user.email = body.email;
-        user.country = body.country;
-        user.contact_code = body.contact_code;
-        user.contact = body.contact;
-        user.active = body.active ?? true;
+        user.country = body.country ?? user.country;
+        user.contact_code = body.contact_code ?? user.contact_code;
+        user.contact = body.contact ?? user.contact;
+        user.active = body.active ?? user.active;
+        if (emailChanged)
+            user.email_verified_at = null;
         await user_entity_1.UserEntity.getRepository().manager.transaction(async (trx) => {
+            const heldBefore = await this.heldRoleIds(trx, user.id);
             await trx.save(user);
-            await tenant_access_1.TenantAccess.reconcileRoles(trx, user.id, body.tenant_id, body.role_ids ?? []);
+            if (body.role_ids)
+                await tenant_access_1.TenantAccess.reconcileRoles(trx, user.id, body.tenant_id, body.role_ids);
+            if (emailChanged || (wasActive && !user.active))
+                await access_revocation_1.AccessRevocation.revokeAll(trx, user.id, false);
+            await this.audit(trx, user, before, {
+                tenant_id: body.tenant_id,
+                role_ids_before: heldBefore,
+                role_ids: await this.heldRoleIds(trx, user.id),
+                ...(emailChanged ? { email_changed: true } : {}),
+            });
         });
         return this.stripSecrets(user);
     }
+    async heldRoleIds(trx, userId) {
+        const grants = await trx.findBy(user_role_entity_1.UserRoleEntity, {
+            user_id: userId,
+            tenant_id: this.payload.tenant_id,
+        });
+        return grants.map((grant) => grant.role_id).sort();
+    }
+    audit(trx, user, before, context) {
+        return admin_audit_1.AdminAudit.record(trx, {
+            actor: this.access.user,
+            sourceType: entity_constants_1.baseEntityConstants.user,
+            sourceId: user.id,
+            action: before ? audit_action_enum_1.AuditAction.UPDATE : audit_action_enum_1.AuditAction.CREATE,
+            oldValue: before,
+            newValue: admin_audit_1.AdminAudit.pick(user, user_data_processor_1.UserDataProcessor.AUDITED),
+            context,
+        });
+    }
     async notifyUser(user) {
         const data = {
             user_name: user.full_name,