@neohm/nestend 5.0.2 → 6.1.0

package/README.md

@@ -104,9 +104,9 @@ these are free to change without a breaking release.
 | Migrations        | `MigrationUtility`, `SeederUtility` (the 31 table migrations ship in `dist/migrations` — glob them, they are not barrel exports)     | fluent `this.string()`, `this.numeric()`, `addRecord()` seeding                                                                                                                                                                                                                                                                                                                                                                                                                                         |
 | Queue             | `QueueModule`, `QueueModule.withConnection()`, `QueueService`, `CommonJob`                                                           | BullMQ `@Processor`/`WorkerHost` consumer; auto-discovered jobs, duplicate prevention, recurring schedulers, completed jobs cleared from Redis on success (1-day TTL on failures), `clearQueue()`, retries, failures persisted to `sys_failed_jobs`; connection from `BULL_REDIS_*` or supplied by the app — never register `BullModule.forRoot()` yourself, two roots race over the worker's connection                                                                                                |
 | Scheduled events  | `SystemScheduledTaskEntity`, `ScheduledEventEntity`, `ScheduleKind`, `ScheduleSpec`, `IsCronExpression`                              | schedule definitions in `sys_scheduled_tasks` → events in `sys_scheduled_events`; interval / cron / once specs with timezones, drift-free slots, horizon materialisation, catch-up + overlap policies, fire-once dispatch with backoff, cadence via `SCHEDULED_EVENT_MIN`                                                                                                                                                                                                                               |
-| Auth              | `AuthModule`, `AuthService.validateRole()`, `RoleTier`, `TenantRole`, `Auth`, `JwtMiddleware`                                        | imperative auth (open by default); `<module>.<tier>` role hierarchy (manager > writer > viewer), with `global.admin` overriding every role check; JwtMiddleware resolves the user into `Auth`'s AsyncLocalStorage context per request; access + rotating refresh tokens; session-based logout invalidation (`sys_auth_sessions`); Google SSO via ID token at `POST /auth/google`; impersonation — a tenantless `has_global_access` user signs into one organization at `POST /auth/impersonation/login`; multi-organization membership with per-organization roles, organization switching and `global.admin` invitations (`TenantMembershipService`, `TenantInvitationService`) |
+| Auth              | `AuthModule`, `AuthService.validateRole()`/`validatePermission()`, `RoleHierarchy`, `TenantRole`, `Auth`, `JwtMiddleware`                                        | imperative auth (open by default); scoped RBAC — roles ranked by priority within a scope (parent scopes cover children), permissions per role, scope admins granting their scope's roles, with `global.admin` overriding every check; JwtMiddleware resolves the user into `Auth`'s AsyncLocalStorage context per request; access + rotating refresh tokens; session-based logout invalidation (`sys_auth_sessions`); Google SSO via ID token at `POST /auth/google`; impersonation — a tenantless `has_global_access` user signs into one organization at `POST /auth/impersonation/login`; multi-organization membership with per-organization roles, organization switching and invitations by `global.admin` or scope admins (`TenantMembershipService`, `TenantInvitationService`) |
 | Admin auth        | `AdminAuthService.validateRole()`, `AdminAuth`, `AdminJwtMiddleware` (endpoints at `/admin/auth`)                                    | fully separate stack for back-office admins — own users table (`sys_admin_users`), own roles (`sys_admin_roles`/`sys_auser_roles`), own sessions/refresh tokens (shared tables, `is_admin` flag)                                                                                                                                                                                                                                                                                                        |
-| API keys          | `ApiKeyService`, `ApiKeyGuard` / `ApiKeyMiddleware`, `@ApiKeyScopes()`, `ApiKeyContext`                                              | hashed keys in `sys_api_keys` (admin-owned), one tenant per key, expiry/revocation, `x-api-key` header; `validateAccess(scope)` returns the tenant the key acts for                                                                                                                                                                                                                                                                                                                                     |
+| API keys          | `ApiKeyService`, `ApiKeyGuard` / `ApiKeyMiddleware`, `@ApiKeyScopes()`/`@ApiKeyRoles()`/`@ApiKeyPermissions()`, `ApiKeyContext`                                              | hashed keys in `sys_api_keys` (admin-owned), one tenant per key, roles inside its scopes, expiry/revocation, `x-api-key` header; `validateAccess(scope, role?)`/`validatePermission()` return the tenant the key acts for                                                                                                                                                                                                                                                                                                                                     |
 | Scopes            | `ScopeService`, `AuthService.validateAccess()`, `ScopeEntity`, `TenantScopeEntity`, `ApiScopeEntity`                                 | one feature named once in `sys_scopes`, optionally with child scopes under it, then granted per organization (`sys_tenant_scopes`) or per API key (`sys_api_scopes`) — never an array on the principal                                                                                                                                                                                                                                                                                                                                         |
 | Multi-tenancy     | `TenantModule`, `TenantEntity`, `CommonTenantEntity`, `TenantContextService`, `TenantContextMiddleware`                              | AsyncLocalStorage tenant context bound from the authenticated session (or API key), never a client-supplied header; tenants are onboarded by admins (`TenantEntity.creator` → `AdminUserEntity`)                                                                                                                                                                                                                                                                                                                                                      |
 | Admin             | `AdminModule` (its controllers, DTOs and processors are internal — import the module and hit the endpoints), `GlobalAdminRoles`      | back-office APIs: tenant onboarding, client/admin/system user registration (single + bulk), the `has_global_access` grant that enables impersonation, tenant + scheduled-task listing, the email/PDF template catalogues (read at content-reader, written at content-manager, deleted at global admin); 4-tier `GlobalAdminRoles` gate over `sys_admin_roles`; Swagger at `/docs` (hidden in production)                                                                                                                                                                                                                 |
@@ -183,20 +183,27 @@ active session. Pass a role identifier to gate on a specific role:
 `validateRole('invoice.viewer')`. This keeps authorization next to your business
 logic, so layering tenant/plan/role checks is just more code.
 
-Role checks understand seniority. Identifiers named `<module>.<tier>` — where the
-tier is one of `RoleTier`: **manager** > **writer** > **viewer** — are satisfied by
-any equal or more senior tier of the same module, so gating a read endpoint at
-`invoice.viewer` also admits `invoice.writer` and `invoice.manager` without
-listing them. The module half must match exactly (`payroll.manager` never clears
-`invoice.viewer`), and an identifier that isn't tiered — `tenant.editor`, or a
-bare `manager` — still matches by exact string, so roles outside the convention
-behave as before. Rank comes from the declaration order of `RoleTier`, the same
-derivation `AdminAccessService` uses for `GlobalAdminRoles`; adding a tier is an
-enum edit. Nothing changes in the schema — a `sys_roles` row named to the
-convention gets the hierarchy for free. Above all of it sits `global.admin`
-(`TenantRole.GLOBAL_ADMIN`): a user granted that role clears every
-`validateRole()` check, whatever module or tier it asks for — a scope check on
-`validateAccess()` still applies.
+Tenant authorization is scoped RBAC (full design: `docs/architecture/13-rbac.md`).
+A role in `sys_roles` belongs to a scope (`scope_id` → `sys_scopes`) and ranks
+within it by `priority` — 1 is the most senior. A role covers every role of its
+scope with an equal or larger priority, and the roles of its child scopes the
+same way: `inventory.admin (1)` clears `validateRole('inventory.reader')`, and
+`billing.reader (3)` clears `billing.invoicing.reader (3)`. Seniority never
+crosses unrelated scopes, and ranks are data the back office edits, not
+identifier conventions. Roles bundle permissions (`sys_permissions`, each in one
+scope); `validatePermission('inventory.item.read')` passes when a held role, or a
+role it outranks, carries it. Roles and permissions of a scope the tenant no
+longer holds grant nothing. A role or permission carries its scope, so
+`validateRole('inventory.reader')` alone also requires the tenant to hold
+`inventory` — for everybody, `global.admin` and impersonators included; an unknown
+role passes nobody. Above all of it sits `global.admin` (`TenantRole.GLOBAL_ADMIN`):
+it clears every role and permission check whose scope the tenant holds.
+
+Granting is delegated by scope. The top role of a scope (its smallest priority)
+makes its holder a scope admin, who may invite with, grant and revoke that
+scope's roles (and its child scopes') — nothing else. `global.admin` grants
+anything, and alone deactivates or removes members. `GET /auth/me` returns the
+caller's effective `permissions` and `grantable_scopes`.
 
 For a feature that a whole organization is either enabled for or not, use
 `validateAccess(scopeIdentifier, roleIdentifier?)`: it first checks that the
@@ -701,8 +708,19 @@ const { tenant } = this.apiKeyService.validateAccess('orders:read');
 // tenant is the sys_tenants row the key acts for — never taken from the payload
 ```
 
-`ApiKeyGuard`/`@ApiKeyScopes()` remain available for guard-based enforcement;
-`hasScope()` is `async` now that grants are rows.
+A key can also hold roles inside its scopes (`sys_api_key_roles`, set at issue
+with `role_ids` or through `POST /api/admin/api-keys/:id/roles`). The same
+hierarchy applies, so a key's roles cover the roles they outrank and reach their
+permissions:
+
+```ts
+this.apiKeyService.validateRole('inventory.reader');
+this.apiKeyService.validatePermission('inventory.item.read');
+```
+
+`ApiKeyGuard` with `@ApiKeyScopes()`, `@ApiKeyRoles()` and `@ApiKeyPermissions()`
+remains available for guard-based enforcement; `hasScope()` is `async` now that
+grants are rows.
 
 ### Email Notifications (AWS SES)
 

package/dist/admin/controllers/admin.api.key.controller.d.ts

@@ -5,6 +5,7 @@ import { AdminAccessService } from '../services/admin.access.service';
 import { CacheService } from '../../common/services/cache.service';
 import { AddApiKeyDto } from '../dtos/add.api.key.dto';
 import { ApiKeyListDto } from '../dtos/api.key.list.dto';
+import { ApiKeyRolesDto } from '../dtos/api.key.roles.dto';
 export declare class AdminApiKeyController {
     private readonly adminAccessService;
     private readonly apiKeyService;
@@ -17,6 +18,10 @@ export declare class AdminApiKeyController {
     issue(dto: AddApiKeyDto): Promise<import("../types/admin.types").IssuedApiKey>;
     list(dto: ApiKeyListDto): Promise<import("../..").CommonListResult>;
     detail(id: string): Promise<import("../..").ApiKeyDetail>;
+    setRoles(id: string, dto: ApiKeyRolesDto): Promise<{
+        id: string;
+        role_ids: string[];
+    }>;
     reveal(id: string): Promise<{
         id: string;
         key: string;

package/dist/admin/controllers/admin.api.key.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.api.key.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.api.key.controller.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAQnE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAOzD,qBAIa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAJZ,kBAAkB,EAAE,kBAAkB,EACtC,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,YAAY,EAC1B,iBAAiB,EAAE,iBAAiB,EACpC,YAAY,EAAE,YAAY;IAI7C,MAAM,CAAC,QAAQ,CAAC,YAAY,MAAM;IAClC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,QAAQ;IAQnC,KAAK,CAAS,GAAG,EAAE,YAAY;IAe/B,IAAI,CAAS,GAAG,EAAE,aAAa;IAW/B,MAAM,CAA6B,EAAE,EAAE,MAAM;IAY7C,MAAM,CAA6B,EAAE,EAAE,MAAM;;;;IA0B7C,OAAO,CAA6B,EAAE,EAAE,MAAM;IAa9C,MAAM,CAA6B,EAAE,EAAE,MAAM;IAOnD,OAAO,CAAC,KAAK;CAQd"}
+{"version":3,"file":"admin.api.key.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.api.key.controller.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAQnE,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAS3D,qBAIa,qBAAqB;IAE9B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAJZ,kBAAkB,EAAE,kBAAkB,EACtC,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,YAAY,EAC1B,iBAAiB,EAAE,iBAAiB,EACpC,YAAY,EAAE,YAAY;IAI7C,MAAM,CAAC,QAAQ,CAAC,YAAY,MAAM;IAClC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,QAAQ;IAQnC,KAAK,CAAS,GAAG,EAAE,YAAY;IAe/B,IAAI,CAAS,GAAG,EAAE,aAAa;IAW/B,MAAM,CAA6B,EAAE,EAAE,MAAM;IAY7C,QAAQ,CACgB,EAAE,EAAE,MAAM,EAC9B,GAAG,EAAE,cAAc;;;;IAiBvB,MAAM,CAA6B,EAAE,EAAE,MAAM;;;;IA0B7C,OAAO,CAA6B,EAAE,EAAE,MAAM;IAa9C,MAAM,CAA6B,EAAE,EAAE,MAAM;IAOnD,OAAO,CAAC,KAAK;CAQd"}

package/dist/admin/controllers/admin.api.key.controller.js

@@ -31,6 +31,8 @@ const api_key_data_processor_1 = require("../libraries/api.key.data.processor");
 const api_key_list_processor_1 = require("../libraries/api.key.list.processor");
 const add_api_key_dto_1 = require("../dtos/add.api.key.dto");
 const api_key_list_dto_1 = require("../dtos/api.key.list.dto");
+const api_key_roles_dto_1 = require("../dtos/api.key.roles.dto");
+const api_key_roles_data_processor_1 = require("../libraries/api.key.roles.data.processor");
 let AdminApiKeyController = AdminApiKeyController_1 = class AdminApiKeyController {
     constructor(adminAccessService, apiKeyService, scopeService, listFilterService, cacheService) {
         this.adminAccessService = adminAccessService;
@@ -51,6 +53,11 @@ let AdminApiKeyController = AdminApiKeyController_1 = class AdminApiKeyControlle
         await this.adminAccessService.validateContentReader();
         return this.apiKeyService.apiKeyDetail(id);
     }
+    async setRoles(id, dto) {
+        const { user } = await this.adminAccessService.validateAdmin();
+        const roleIds = await new api_key_roles_data_processor_1.ApiKeyRolesDataProcessor(user, this.apiKeyService).process(id, dto);
+        return { id, role_ids: roleIds };
+    }
     async reveal(id) {
         const { user } = await this.adminAccessService.validateSuperAdmin();
         const count = await this.cacheService.increment(`admin:api-key-reveal:${user.id}`, AdminApiKeyController_1.REVEAL_WINDOW_SEC);
@@ -93,7 +100,7 @@ __decorate([
     (0, common_1.Post)(),
     (0, swagger_1.ApiOperation)({
         summary: 'Issue an API key for a tenant.',
-        description: 'Create-only — `raw_key` is the full key and is returned exactly once. Keys are stored hash-only unless API_KEY_REVEAL_ENABLED is on. `expires_at` defaults to 365 days and may be at most 730 days ahead. The tenant (or user) must be active. A key can only be granted scopes its tenant already holds, which includes the children of any parent scope the tenant is enabled for. Requires at least the global admin role.',
+        description: 'Create-only — `raw_key` is the full key and is returned exactly once. Keys are stored hash-only unless API_KEY_REVEAL_ENABLED is on. `expires_at` defaults to 365 days and may be at most 730 days ahead. The tenant (or user) must be active. A key can only be granted scopes its tenant already holds, which includes the children of any parent scope the tenant is enabled for, and `role_ids` inside those scopes. Requires at least the global admin role.',
     }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
@@ -115,13 +122,26 @@ __decorate([
     (0, common_1.Get)(':id'),
     (0, swagger_1.ApiOperation)({
         summary: 'One API key, without its secret.',
-        description: 'Carries the owner and the `scopes` granted to the key. The raw key is never part of this response; see `POST :id/reveal`. Requires at least the global content reader role.',
+        description: 'Carries the owner and the `scopes` and `roles` granted to the key. The raw key is never part of this response; see `POST :id/reveal`. Requires at least the global content reader role.',
     }),
     __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [String]),
     __metadata("design:returntype", Promise)
 ], AdminApiKeyController.prototype, "detail", null);
+__decorate([
+    (0, common_1.Post)(':id/roles'),
+    (0, common_1.HttpCode)(200),
+    (0, swagger_1.ApiOperation)({
+        summary: "Replace an API key's roles.",
+        description: "`role_ids` is the complete set. Each must be an active scoped role inside a scope the key effectively holds (its grants, children included, ∩ its tenant's scopes). The key then satisfies those roles, the roles they outrank, and their permissions — see `@ApiKeyRoles`/`@ApiKeyPermissions`. Requires at least the global admin role.",
+    }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, api_key_roles_dto_1.ApiKeyRolesDto]),
+    __metadata("design:returntype", Promise)
+], AdminApiKeyController.prototype, "setRoles", null);
 __decorate([
     (0, common_1.Post)(':id/reveal'),
     (0, common_1.HttpCode)(200),

package/dist/admin/controllers/admin.api.key.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.api.key.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.api.key.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAUwB;AACxB,6CAAuE;AACvE,mFAA8E;AAC9E,yEAAoE;AACpE,qEAAiE;AACjE,2EAAsE;AACtE,sFAAiF;AACjF,uEAAmE;AACnE,4EAAmE;AACnE,uEAAuE;AACvE,uEAAkE;AAClE,+EAA2E;AAC3E,0DAAsD;AACtD,gFAA0E;AAC1E,gFAA0E;AAC1E,6DAAuD;AACvD,+DAAyD;AAWlD,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAChC,YACmB,kBAAsC,EACtC,aAA4B,EAC5B,YAA0B,EAC1B,iBAAoC,EACpC,YAA0B;QAJ1B,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,kBAAa,GAAb,aAAa,CAAe;QAC5B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAYE,AAAN,KAAK,CAAC,KAAK,CAAS,GAAiB;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,4CAAmB,CAC5B,IAAI,EACJ,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,YAAY,CAClB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAQK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAkB;QACnC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,4CAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IASK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QAEpE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAC7C,wBAAwB,IAAI,CAAC,EAAE,EAAE,EACjC,uBAAqB,CAAC,iBAAiB,CACxC,CAAC;QACF,IAAI,KAAK,GAAG,uBAAqB,CAAC,YAAY;YAC5C,MAAM,IAAI,kCAAe,CAAC,4CAA4C,CAAC,CAAC;QAE1E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACtD,MAAM,wBAAU,CAAC,MAAM,CAAC,6BAAY,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE;YAC5D,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,sCAAmB,CAAC,MAAM;YACtC,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC;IAQK,AAAN,KAAK,CAAC,OAAO,CAA6B,EAAU;QAClD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC;IAChB,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,+BAAW,CAAC,WAAW,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,KAAqB,EAAE,EAAU,EAAE,MAAc;QAC7D,OAAO,wBAAU,CAAC,MAAM,CAAC,6BAAY,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE;YAC7D,KAAK;YACL,UAAU,EAAE,sCAAmB,CAAC,MAAM;YACtC,QAAQ,EAAE,EAAE;YACZ,MAAM;SACP,CAAC,CAAC;IACL,CAAC;;AA9GU,sDAAqB;AAUhB,kCAAY,GAAG,EAAE,AAAL,CAAM;AAClB,uCAAiB,GAAG,IAAI,AAAP,CAAQ;AAQnC;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,+ZAA+Z;KACla,CAAC;IACW,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,8BAAY;;kDAOpC;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EACT,uKAAuK;KAC1K,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,gCAAa;;iDAGpC;AAQK;IANL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EACT,6KAA6K;KAChL,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;mDAGvC;AASK;IAPL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,iBAAQ,EAAC,GAAG,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yBAAyB;QAClC,WAAW,EACT,8NAA8N;KACjO,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;mDAkBvC;AAQK;IANL,IAAA,aAAI,EAAC,aAAa,CAAC;IACnB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EACT,sLAAsL;KACzL,CAAC;IACa,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;oDAKxC;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,sUAAsU;KACzU,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;mDAKvC;gCArGU,qBAAqB;IAJjC,IAAA,iBAAO,EAAC,kBAAkB,CAAC;IAC3B,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAC9B,IAAA,mBAAU,EAAC,oBAAoB,CAAC;qCAGQ,yCAAkB;QACvB,+BAAa;QACd,4BAAY;QACP,uCAAiB;QACtB,4BAAY;GANlC,qBAAqB,CA+GjC"}
+{"version":3,"file":"admin.api.key.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.api.key.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAUwB;AACxB,6CAAuE;AACvE,mFAA8E;AAC9E,yEAAoE;AACpE,qEAAiE;AACjE,2EAAsE;AACtE,sFAAiF;AACjF,uEAAmE;AACnE,4EAAmE;AACnE,uEAAuE;AACvE,uEAAkE;AAClE,+EAA2E;AAC3E,0DAAsD;AACtD,gFAA0E;AAC1E,gFAA0E;AAC1E,6DAAuD;AACvD,+DAAyD;AACzD,iEAA2D;AAC3D,4FAAqF;AAY9E,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAChC,YACmB,kBAAsC,EACtC,aAA4B,EAC5B,YAA0B,EAC1B,iBAAoC,EACpC,YAA0B;QAJ1B,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,kBAAa,GAAb,aAAa,CAAe;QAC5B,iBAAY,GAAZ,YAAY,CAAc;QAC1B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAYE,AAAN,KAAK,CAAC,KAAK,CAAS,GAAiB;QACnC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,OAAO,IAAI,4CAAmB,CAC5B,IAAI,EACJ,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,YAAY,CAClB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAQK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAkB;QACnC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,4CAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IASK,AAAN,KAAK,CAAC,QAAQ,CACgB,EAAU,EAC9B,GAAmB;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,uDAAwB,CAChD,IAAI,EACJ,IAAI,CAAC,aAAa,CACnB,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACnC,CAAC;IASK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QAEpE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAC7C,wBAAwB,IAAI,CAAC,EAAE,EAAE,EACjC,uBAAqB,CAAC,iBAAiB,CACxC,CAAC;QACF,IAAI,KAAK,GAAG,uBAAqB,CAAC,YAAY;YAC5C,MAAM,IAAI,kCAAe,CAAC,4CAA4C,CAAC,CAAC;QAE1E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACtD,MAAM,wBAAU,CAAC,MAAM,CAAC,6BAAY,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE;YAC5D,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,sCAAmB,CAAC,MAAM;YACtC,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC;IACrB,CAAC;IAQK,AAAN,KAAK,CAAC,OAAO,CAA6B,EAAU;QAClD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACnE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC,CAAC;QACtC,OAAO,MAAM,CAAC;IAChB,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,+BAAW,CAAC,WAAW,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,KAAqB,EAAE,EAAU,EAAE,MAAc;QAC7D,OAAO,wBAAU,CAAC,MAAM,CAAC,6BAAY,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE;YAC7D,KAAK;YACL,UAAU,EAAE,sCAAmB,CAAC,MAAM;YACtC,QAAQ,EAAE,EAAE;YACZ,MAAM;SACP,CAAC,CAAC;IACL,CAAC;;AAjIU,sDAAqB;AAUhB,kCAAY,GAAG,EAAE,AAAL,CAAM;AAClB,uCAAiB,GAAG,IAAI,AAAP,CAAQ;AAQnC;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,mcAAmc;KACtc,CAAC;IACW,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,8BAAY;;kDAOpC;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EACT,uKAAuK;KAC1K,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,gCAAa;;iDAGpC;AAQK;IANL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kCAAkC;QAC3C,WAAW,EACT,yLAAyL;KAC5L,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;mDAGvC;AASK;IAPL,IAAA,aAAI,EAAC,WAAW,CAAC;IACjB,IAAA,iBAAQ,EAAC,GAAG,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,6BAA6B;QACtC,WAAW,EACT,2UAA2U;KAC9U,CAAC;IAEC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAC1B,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAM,kCAAc;;qDAQ5B;AASK;IAPL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,iBAAQ,EAAC,GAAG,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yBAAyB;QAClC,WAAW,EACT,8NAA8N;KACjO,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;mDAkBvC;AAQK;IANL,IAAA,aAAI,EAAC,aAAa,CAAC;IACnB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EACT,sLAAsL;KACzL,CAAC;IACa,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;oDAKxC;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,sUAAsU;KACzU,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;mDAKvC;gCAxHU,qBAAqB;IAJjC,IAAA,iBAAO,EAAC,kBAAkB,CAAC;IAC3B,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAC9B,IAAA,mBAAU,EAAC,oBAAoB,CAAC;qCAGQ,yCAAkB;QACvB,+BAAa;QACd,4BAAY;QACP,uCAAiB;QACtB,4BAAY;GANlC,qBAAqB,CAkIjC"}

package/dist/admin/controllers/admin.permission.controller.d.ts

@@ -0,0 +1,17 @@
+import { ListFilterService } from '../../common/services/list.filter.service';
+import { PermissionEntity } from '../../auth/entities/permission.entity';
+import { RoleService } from '../../auth/services/role.service';
+import { AdminAccessService } from '../services/admin.access.service';
+import { AddPermissionDto } from '../dtos/add.permission.dto';
+import { PermissionListDto } from '../dtos/permission.list.dto';
+export declare class AdminPermissionController {
+    private readonly adminAccessService;
+    private readonly roleService;
+    private readonly listFilterService;
+    constructor(adminAccessService: AdminAccessService, roleService: RoleService, listFilterService: ListFilterService);
+    save(dto: AddPermissionDto): Promise<PermissionEntity>;
+    list(dto: PermissionListDto): Promise<import("../..").CommonListResult>;
+    detail(id: string): Promise<PermissionEntity>;
+    remove(id: string): Promise<import("../..").DeleteResult>;
+}
+//# sourceMappingURL=admin.permission.controller.d.ts.map

package/dist/admin/controllers/admin.permission.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.permission.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.permission.controller.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAK9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAItE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAQhE,qBAIa,yBAAyB;IAElC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,kBAAkB,EAAE,kBAAkB,EACtC,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,iBAAiB;IASjD,IAAI,CAAS,GAAG,EAAE,gBAAgB;IAWlC,IAAI,CAAS,GAAG,EAAE,iBAAiB;IAUnC,MAAM,CAA6B,EAAE,EAAE,MAAM;IAiB7C,MAAM,CAA6B,EAAE,EAAE,MAAM;CAgBpD"}

package/dist/admin/controllers/admin.permission.controller.js

@@ -0,0 +1,125 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminPermissionController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const list_filter_service_1 = require("../../common/services/list.filter.service");
+const strict_validation_pipe_1 = require("../../common/pipes/strict.validation.pipe");
+const not_found_exception_1 = require("../../global/exceptions/not.found.exception");
+const audit_action_enum_1 = require("../../common/enums/audit.action.enum");
+const entity_constants_1 = require("../../constants/entity.constants");
+const permission_entity_1 = require("../../auth/entities/permission.entity");
+const role_service_1 = require("../../auth/services/role.service");
+const admin_access_service_1 = require("../services/admin.access.service");
+const admin_audit_1 = require("../utilities/admin.audit");
+const permission_data_processor_1 = require("../libraries/permission.data.processor");
+const permission_list_processor_1 = require("../libraries/permission.list.processor");
+const add_permission_dto_1 = require("../dtos/add.permission.dto");
+const permission_list_dto_1 = require("../dtos/permission.list.dto");
+let AdminPermissionController = class AdminPermissionController {
+    constructor(adminAccessService, roleService, listFilterService) {
+        this.adminAccessService = adminAccessService;
+        this.roleService = roleService;
+        this.listFilterService = listFilterService;
+    }
+    async save(dto) {
+        const access = await this.adminAccessService.validateAdmin();
+        return new permission_data_processor_1.PermissionDataProcessor(access).process(dto);
+    }
+    async list(dto) {
+        await this.adminAccessService.validateContentReader();
+        return new permission_list_processor_1.PermissionListProcessor(this.listFilterService).process(dto);
+    }
+    async detail(id) {
+        await this.adminAccessService.validateContentReader();
+        const permission = await permission_entity_1.PermissionEntity.findOne({
+            where: { id },
+            relations: { scope: true },
+        });
+        if (!permission)
+            throw new not_found_exception_1.NotFoundException('No permission exists for this id');
+        return permission;
+    }
+    async remove(id) {
+        const { user } = await this.adminAccessService.validateSuperAdmin();
+        const permission = await permission_entity_1.PermissionEntity.findOne({ where: { id } });
+        if (!permission)
+            throw new not_found_exception_1.NotFoundException('No permission exists for this id');
+        const result = await this.roleService.deletePermission(id, user.id);
+        await admin_audit_1.AdminAudit.record(permission_entity_1.PermissionEntity.getRepository().manager, {
+            actor: user,
+            sourceType: entity_constants_1.baseEntityConstants.permission,
+            sourceId: id,
+            action: audit_action_enum_1.AuditAction.SOFT_DELETE,
+            oldValue: admin_audit_1.AdminAudit.pick(permission, ['identifier', 'name', 'scope_id']),
+        });
+        return result;
+    }
+};
+exports.AdminPermissionController = AdminPermissionController;
+__decorate([
+    (0, common_1.Post)(),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Define a permission, or update an existing one.',
+        description: 'Send an `id` to edit; omit it to define one. `identifier` (unique) and `scope_id` are fixed once created. Requires at least the global admin role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [add_permission_dto_1.AddPermissionDto]),
+    __metadata("design:returntype", Promise)
+], AdminPermissionController.prototype, "save", null);
+__decorate([
+    (0, common_1.Post)('list'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'List, search and filter permissions.',
+        description: 'Rows carry `scope_identifier` and `scope_name`. Requires at least the global content reader role.',
+    }),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [permission_list_dto_1.PermissionListDto]),
+    __metadata("design:returntype", Promise)
+], AdminPermissionController.prototype, "list", null);
+__decorate([
+    (0, common_1.Get)(':id'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'One permission, in full.',
+        description: 'Requires at least the global content reader role.',
+    }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], AdminPermissionController.prototype, "detail", null);
+__decorate([
+    (0, common_1.Delete)(':id'),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Delete a permission.',
+        description: 'Soft delete; every role loses it. Requires the global super admin role.',
+    }),
+    __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], AdminPermissionController.prototype, "remove", null);
+exports.AdminPermissionController = AdminPermissionController = __decorate([
+    (0, swagger_1.ApiTags)('Admin - Permissions'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.UsePipes)(strict_validation_pipe_1.StrictValidationPipe),
+    (0, common_1.Controller)('api/admin/permissions'),
+    __metadata("design:paramtypes", [admin_access_service_1.AdminAccessService,
+        role_service_1.RoleService,
+        list_filter_service_1.ListFilterService])
+], AdminPermissionController);
+//# sourceMappingURL=admin.permission.controller.js.map

package/dist/admin/controllers/admin.permission.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.permission.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.permission.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAuE;AACvE,mFAA8E;AAC9E,sFAAiF;AACjF,qFAAgF;AAChF,4EAAmE;AACnE,uEAAuE;AACvE,6EAAyE;AACzE,mEAA+D;AAC/D,2EAAsE;AACtE,0DAAsD;AACtD,sFAAiF;AACjF,sFAAiF;AACjF,mEAA8D;AAC9D,qEAAgE;AAYzD,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACpC,YACmB,kBAAsC,EACtC,WAAwB,EACxB,iBAAoC;QAFpC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CAAS,GAAqB;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC7D,OAAO,IAAI,mDAAuB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;IAQK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAsB;QACvC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,mDAAuB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1E,CAAC;IAOK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,oCAAgB,CAAC,OAAO,CAAC;YAChD,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,UAAU;YACb,MAAM,IAAI,uCAAiB,CAAC,kCAAkC,CAAC,CAAC;QAClE,OAAO,UAAU,CAAC;IACpB,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QACpE,MAAM,UAAU,GAAG,MAAM,oCAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU;YACb,MAAM,IAAI,uCAAiB,CAAC,kCAAkC,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,wBAAU,CAAC,MAAM,CAAC,oCAAgB,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE;YAChE,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,sCAAmB,CAAC,UAAU;YAC1C,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,+BAAW,CAAC,WAAW;YAC/B,QAAQ,EAAE,wBAAU,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;SAC1E,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AAnEY,8DAAyB;AAa9B;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iDAAiD;QAC1D,WAAW,EACT,oJAAoJ;KACvJ,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,qCAAgB;;qDAGvC;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,sCAAsC;QAC/C,WAAW,EACT,mGAAmG;KACtG,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,uCAAiB;;qDAGxC;AAOK;IALL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;uDASvC;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,sBAAsB;QAC/B,WAAW,EACT,yEAAyE;KAC5E,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;uDAevC;oCAlEU,yBAAyB;IAJrC,IAAA,iBAAO,EAAC,qBAAqB,CAAC;IAC9B,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAC9B,IAAA,mBAAU,EAAC,uBAAuB,CAAC;qCAGK,yCAAkB;QACzB,0BAAW;QACL,uCAAiB;GAJ5C,yBAAyB,CAmErC"}

package/dist/admin/controllers/admin.scope.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.scope.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.scope.controller.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAQtE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAGjE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAQ/D,qBAIa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,kBAAkB,EAAE,kBAAkB,EACtC,YAAY,EAAE,YAAY,EAC1B,iBAAiB,EAAE,iBAAiB;IASjD,IAAI,CAAS,GAAG,EAAE,WAAW;IAW7B,IAAI,CAAS,GAAG,EAAE,YAAY;IAW9B,SAAS,CAA6B,EAAE,EAAE,MAAM,EAAU,GAAG,EAAE,WAAW;IAW1E,QAAQ,CAA6B,EAAE,EAAE,MAAM,EAAU,GAAG,EAAE,YAAY;IAa1E,MAAM,CAA6B,EAAE,EAAE,MAAM;IAe7C,MAAM,CAA6B,EAAE,EAAE,MAAM;CA6BpD"}
+{"version":3,"file":"admin.scope.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/admin.scope.controller.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAQtE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAGjE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAQ/D,qBAIa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,kBAAkB,EAAE,kBAAkB,EACtC,YAAY,EAAE,YAAY,EAC1B,iBAAiB,EAAE,iBAAiB;IASjD,IAAI,CAAS,GAAG,EAAE,WAAW;IAW7B,IAAI,CAAS,GAAG,EAAE,YAAY;IAW9B,SAAS,CACe,EAAE,EAAE,MAAM,EAC9B,GAAG,EAAE,WAAW;IAYpB,QAAQ,CACgB,EAAE,EAAE,MAAM,EAC9B,GAAG,EAAE,YAAY;IAcrB,MAAM,CAA6B,EAAE,EAAE,MAAM;IAe7C,MAAM,CAA6B,EAAE,EAAE,MAAM;CA6BpD"}

package/dist/admin/controllers/admin.scope.controller.js

@@ -145,7 +145,7 @@ __decorate([
     (0, common_1.Delete)(':id'),
     (0, swagger_1.ApiOperation)({
         summary: 'Delete a scope.',
-        description: 'Soft delete. Its children go with it, and so does every grant of any of them (principal grants and API-key grants), so no principal keeps a feature the catalogue no longer defines. Requires at least the global admin role, and the global super admin role when the scope has children or live grants.',
+        description: 'Soft delete. Its children go with it, and so does every grant of any of them (principal grants and API-key grants), along with the roles and permissions defined in them and every grant of those roles, so no principal keeps a feature the catalogue no longer defines. Requires at least the global admin role, and the global super admin role when the scope has children or live grants.',
     }),
     __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
     __metadata("design:type", Function),

package/dist/admin/controllers/admin.scope.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin.scope.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.scope.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAuE;AACvE,mFAA8E;AAC9E,2EAAsE;AACtE,sFAAiF;AACjF,qFAAgF;AAChF,4EAAmE;AACnE,uEAAuE;AACvE,0DAAsD;AACtD,4DAAwD;AACxD,4DAAwD;AACxD,qEAAiE;AACjE,4EAAuE;AACvE,4EAAuE;AACvE,yDAAoD;AACpD,2DAAsD;AACtD,mEAA+D;AAYxD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YACmB,kBAAsC,EACtC,YAA0B,EAC1B,iBAAoC;QAFpC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,iBAAY,GAAZ,YAAY,CAAc;QAC1B,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CAAS,GAAgB;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC;QACtE,OAAO,IAAI,yCAAkB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IAQK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAiB;QAClC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,yCAAkB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IAQK,AAAN,KAAK,CAAC,SAAS,CAA6B,EAAU,EAAU,GAAgB;QAC9E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC;QACtE,OAAO,IAAI,yCAAkB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IAQK,AAAN,KAAK,CAAC,QAAQ,CAA6B,EAAU,EAAU,GAAiB;QAC9E,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,yCAAkB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;YAC5D,GAAG,GAAG;YACN,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IAOK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QAEtD,MAAM,KAAK,GAAG,MAAM,0BAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,uCAAiB,CAAC,6BAA6B,CAAC,CAAC;QAEvE,OAAO,KAAK,CAAC;IACf,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAE7D,MAAM,KAAK,GAAG,MAAM,0BAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,uCAAiB,CAAC,6BAA6B,CAAC,CAAC;QAEvE,MAAM,OAAO,GAAG,0BAAW,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC;QACpD,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,0BAAW,CAAC,YAAY,CAC7D,OAAO,EACP,EAAE,CACH,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,0BAAW,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9D,yCAAkB,CAAC,WAAW,CAC5B,MAAM,EACN,0BAAW,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,EACnD,mDAAmD,CACpD,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,wBAAU,CAAC,MAAM,CAAC,OAAO,EAAE;YAC/B,KAAK,EAAE,MAAM,CAAC,IAAI;YAClB,UAAU,EAAE,sCAAmB,CAAC,KAAK;YACrC,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,+BAAW,CAAC,WAAW;YAC/B,QAAQ,EAAE,wBAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;YACrE,OAAO,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE;SACnE,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AAvGY,oDAAoB;AAazB;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,4CAA4C;QACrD,WAAW,EACT,8SAA8S;KACjT,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,2BAAW;;gDAGlC;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,sNAAsN;KACzN,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,6BAAY;;gDAGnC;AAQK;IANL,IAAA,aAAI,EAAC,cAAc,CAAC;IACpB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gEAAgE;QACzE,WAAW,EACT,6VAA6V;KAChW,CAAC;IACe,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAAc,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAM,2BAAW;;qDAG/E;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oDAAoD;QAC7D,WAAW,EACT,qLAAqL;KACxL,CAAC;IACc,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAAc,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAM,6BAAY;;oDAM/E;AAOK;IALL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;kDAOvC;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EACT,2SAA2S;KAC9S,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;kDA4BvC;+BAtGU,oBAAoB;IAJhC,IAAA,iBAAO,EAAC,gBAAgB,CAAC;IACzB,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAC9B,IAAA,mBAAU,EAAC,kBAAkB,CAAC;qCAGU,yCAAkB;QACxB,4BAAY;QACP,uCAAiB;GAJ5C,oBAAoB,CAuGhC"}
+{"version":3,"file":"admin.scope.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/admin.scope.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAuE;AACvE,mFAA8E;AAC9E,2EAAsE;AACtE,sFAAiF;AACjF,qFAAgF;AAChF,4EAAmE;AACnE,uEAAuE;AACvE,0DAAsD;AACtD,4DAAwD;AACxD,4DAAwD;AACxD,qEAAiE;AACjE,4EAAuE;AACvE,4EAAuE;AACvE,yDAAoD;AACpD,2DAAsD;AACtD,mEAA+D;AAYxD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YACmB,kBAAsC,EACtC,YAA0B,EAC1B,iBAAoC;QAFpC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,iBAAY,GAAZ,YAAY,CAAc;QAC1B,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CAAS,GAAgB;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC;QACtE,OAAO,IAAI,yCAAkB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrD,CAAC;IAQK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAiB;QAClC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,yCAAkB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrE,CAAC;IAQK,AAAN,KAAK,CAAC,SAAS,CACe,EAAU,EAC9B,GAAgB;QAExB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,sBAAsB,EAAE,CAAC;QACtE,OAAO,IAAI,yCAAkB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;IAC3E,CAAC;IAQK,AAAN,KAAK,CAAC,QAAQ,CACgB,EAAU,EAC9B,GAAiB;QAEzB,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,yCAAkB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC;YAC5D,GAAG,GAAG;YACN,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IAOK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QAEtD,MAAM,KAAK,GAAG,MAAM,0BAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,uCAAiB,CAAC,6BAA6B,CAAC,CAAC;QAEvE,OAAO,KAAK,CAAC;IACf,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAE7D,MAAM,KAAK,GAAG,MAAM,0BAAW,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,uCAAiB,CAAC,6BAA6B,CAAC,CAAC;QAEvE,MAAM,OAAO,GAAG,0BAAW,CAAC,aAAa,EAAE,CAAC,OAAO,CAAC;QACpD,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,MAAM,0BAAW,CAAC,YAAY,CAC7D,OAAO,EACP,EAAE,CACH,CAAC;QACF,MAAM,UAAU,GAAG,MAAM,0BAAW,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC9D,yCAAkB,CAAC,WAAW,CAC5B,MAAM,EACN,0BAAW,CAAC,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,EACnD,mDAAmD,CACpD,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,wBAAU,CAAC,MAAM,CAAC,OAAO,EAAE;YAC/B,KAAK,EAAE,MAAM,CAAC,IAAI;YAClB,UAAU,EAAE,sCAAmB,CAAC,KAAK;YACrC,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,+BAAW,CAAC,WAAW;YAC/B,QAAQ,EAAE,wBAAU,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;YACrE,OAAO,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE;SACnE,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AA7GY,oDAAoB;AAazB;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,4CAA4C;QACrD,WAAW,EACT,8SAA8S;KACjT,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,2BAAW;;gDAGlC;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iCAAiC;QAC1C,WAAW,EACT,sNAAsN;KACzN,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,6BAAY;;gDAGnC;AAQK;IANL,IAAA,aAAI,EAAC,cAAc,CAAC;IACpB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gEAAgE;QACzE,WAAW,EACT,6VAA6V;KAChW,CAAC;IAEC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAC1B,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAM,2BAAW;;qDAIzB;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oDAAoD;QAC7D,WAAW,EACT,qLAAqL;KACxL,CAAC;IAEC,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;IAC1B,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAM,6BAAY;;oDAO1B;AAOK;IALL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qBAAqB;QAC9B,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;kDAOvC;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,iBAAiB;QAC1B,WAAW,EACT,gYAAgY;KACnY,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;kDA4BvC;+BA5GU,oBAAoB;IAJhC,IAAA,iBAAO,EAAC,gBAAgB,CAAC;IACzB,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAC9B,IAAA,mBAAU,EAAC,kBAAkB,CAAC;qCAGU,yCAAkB;QACxB,4BAAY;QACP,uCAAiB;GAJ5C,oBAAoB,CA6GhC"}

package/dist/admin/controllers/system.role.controller.d.ts

@@ -11,7 +11,23 @@ export declare class SystemRoleController {
     constructor(adminAccessService: AdminAccessService, roleService: RoleService, listFilterService: ListFilterService);
     save(dto: AddSystemRoleDto): Promise<SystemRoleEntity>;
     list(dto: RoleListDto): Promise<import("../..").CommonListResult>;
-    detail(id: string): Promise<SystemRoleEntity>;
+    detail(id: string): Promise<{
+        permissions: import("../..").PermissionEntity[];
+        is_active: boolean;
+        identifier: string;
+        name: string;
+        description: string;
+        attributes: Record<string, any>;
+        scope_id: string;
+        priority: number;
+        userRoles: import("../..").UserRoleEntity[];
+        scope: import("../..").ScopeEntity;
+        sn: number;
+        id: string;
+        created_at: Date;
+        updated_at: Date;
+        deleted_at: Date;
+    }>;
     remove(id: string): Promise<import("../..").DeleteResult>;
 }
 //# sourceMappingURL=system.role.controller.d.ts.map

package/dist/admin/controllers/system.role.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system.role.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/system.role.controller.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAQtE,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAG/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAc1E,qBAIa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,kBAAkB,EAAE,kBAAkB,EACtC,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,iBAAiB;IASjD,IAAI,CAAS,GAAG,EAAE,gBAAgB;IAUlC,IAAI,CAAS,GAAG,EAAE,WAAW;IAU7B,MAAM,CAA6B,EAAE,EAAE,MAAM;IAe7C,MAAM,CAA6B,EAAE,EAAE,MAAM;CAkBpD"}
+{"version":3,"file":"system.role.controller.d.ts","sourceRoot":"","sources":["../../../src/admin/controllers/system.role.controller.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAQtE,OAAO,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAG/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAc1E,qBAIa,oBAAoB;IAE7B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,kBAAkB,EAAE,kBAAkB,EACtC,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,iBAAiB;IASjD,IAAI,CAAS,GAAG,EAAE,gBAAgB;IAUlC,IAAI,CAAS,GAAG,EAAE,WAAW;IAW7B,MAAM,CAA6B,EAAE,EAAE,MAAM;;;;;;;;;;;;;;;;;IAwB7C,MAAM,CAA6B,EAAE,EAAE,MAAM;CAkBpD"}

package/dist/admin/controllers/system.role.controller.js

@@ -46,10 +46,19 @@ let SystemRoleController = class SystemRoleController {
     }
     async detail(id) {
         await this.adminAccessService.validateContentReader();
-        const role = await system_role_entity_1.SystemRoleEntity.findOne({ where: { id } });
+        const role = await system_role_entity_1.SystemRoleEntity.findOne({
+            where: { id },
+            relations: { scope: true, rolePermissions: { permission: true } },
+        });
         if (!role)
             throw new not_found_exception_1.NotFoundException('No role exists for this id');
-        return role;
+        const { rolePermissions, ...rest } = role;
+        return {
+            ...rest,
+            permissions: (rolePermissions ?? [])
+                .map((grant) => grant.permission)
+                .filter((permission) => !!permission),
+        };
     }
     async remove(id) {
         const { user } = await this.adminAccessService.validateSuperAdmin();
@@ -74,7 +83,7 @@ __decorate([
     (0, common_1.Post)(),
     (0, swagger_1.ApiOperation)({
         summary: 'Define a role, or update an existing one.',
-        description: 'Send an `id` to edit that role; omit it to define a new one. `identifier` is unique, fixed once created, and may not be a reserved identifier. Omitted optional fields keep their stored value. Requires at least the global admin role, and the global super admin role to change `is_active` of an existing role.',
+        description: "Send an `id` to edit that role; omit it to define a new one. `identifier` is unique and fixed once created (`global.admin` is seeded by a migration); `scope_id` is fixed once created. `priority` ranks the role within its scope (1 = most senior) and `permission_ids` replaces the permissions it carries itself. Omitted optional fields keep their stored value. Requires at least the global admin role, and the global super admin role to change `is_active` or `priority` of an existing role or to create one above its scope's top role.",
     }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
@@ -96,7 +105,7 @@ __decorate([
     (0, common_1.Get)(':id'),
     (0, swagger_1.ApiOperation)({
         summary: 'One role, in full.',
-        description: 'Requires at least the global content reader role.',
+        description: 'Carries its `scope` and the `permissions` it holds itself (seniority adds those of the roles it outranks). Requires at least the global content reader role.',
     }),
     __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
     __metadata("design:type", Function),

package/dist/admin/controllers/system.role.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"system.role.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/system.role.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAuE;AACvE,mFAA8E;AAC9E,2EAAsE;AACtE,sFAAiF;AACjF,qFAAgF;AAChF,qFAAiF;AACjF,4EAAmE;AACnE,uEAAuE;AACvE,0DAAsD;AACtD,wEAAmE;AACnE,mEAA+D;AAC/D,wFAAkF;AAClF,0EAAqE;AACrE,qEAA+D;AAC/D,yDAAoD;AACpD,+EAA0E;AAkBnE,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YACmB,kBAAsC,EACtC,WAAwB,EACxB,iBAAoC;QAFpC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CAAS,GAAqB;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC7D,OAAO,IAAI,oDAAuB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;IAOK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAgB;QACjC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,uCAAiB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAOK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,qCAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,uCAAiB,CAAC,4BAA4B,CAAC,CAAC;QAErE,OAAO,IAAI,CAAC;IACd,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QAEpE,MAAM,IAAI,GAAG,MAAM,qCAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,uCAAiB,CAAC,4BAA4B,CAAC,CAAC;QACrE,IAAI,qCAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAC9C,MAAM,IAAI,wCAAkB,CAAC,mCAAmC,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9D,MAAM,wBAAU,CAAC,MAAM,CAAC,qCAAgB,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE;YAChE,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,sCAAmB,CAAC,UAAU;YAC1C,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,+BAAW,CAAC,WAAW;YAC/B,QAAQ,EAAE,wBAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;SACrE,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AAlEY,oDAAoB;AAazB;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,qTAAqT;KACxT,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,sCAAgB;;gDAGvC;AAOK;IALL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,2BAAW;;gDAGlC;AAOK;IALL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;kDAOvC;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gBAAgB;QACzB,WAAW,EACT,2JAA2J;KAC9J,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;kDAiBvC;+BAjEU,oBAAoB;IAJhC,IAAA,iBAAO,EAAC,sBAAsB,CAAC;IAC/B,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAC9B,IAAA,mBAAU,EAAC,wBAAwB,CAAC;qCAGI,yCAAkB;QACzB,0BAAW;QACL,uCAAiB;GAJ5C,oBAAoB,CAkEhC"}
+{"version":3,"file":"system.role.controller.js","sourceRoot":"","sources":["../../../src/admin/controllers/system.role.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAuE;AACvE,mFAA8E;AAC9E,2EAAsE;AACtE,sFAAiF;AACjF,qFAAgF;AAChF,qFAAiF;AACjF,4EAAmE;AACnE,uEAAuE;AACvE,0DAAsD;AACtD,wEAAmE;AACnE,mEAA+D;AAC/D,wFAAkF;AAClF,0EAAqE;AACrE,qEAA+D;AAC/D,yDAAoD;AACpD,+EAA0E;AAkBnE,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YACmB,kBAAsC,EACtC,WAAwB,EACxB,iBAAoC;QAFpC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CAAS,GAAqB;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;QAC7D,OAAO,IAAI,oDAAuB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1D,CAAC;IAOK,AAAN,KAAK,CAAC,IAAI,CAAS,GAAgB;QACjC,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QACtD,OAAO,IAAI,uCAAiB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpE,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,IAAI,CAAC,kBAAkB,CAAC,qBAAqB,EAAE,CAAC;QAEtD,MAAM,IAAI,GAAG,MAAM,qCAAgB,CAAC,OAAO,CAAC;YAC1C,KAAK,EAAE,EAAE,EAAE,EAAE;YACb,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;SAClE,CAAC,CAAC;QACH,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,uCAAiB,CAAC,4BAA4B,CAAC,CAAC;QAErE,MAAM,EAAE,eAAe,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QAC1C,OAAO;YACL,GAAG,IAAI;YACP,WAAW,EAAE,CAAC,eAAe,IAAI,EAAE,CAAC;iBACjC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC;iBAChC,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;SACxC,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,CAAC;QAEpE,MAAM,IAAI,GAAG,MAAM,qCAAgB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,uCAAiB,CAAC,4BAA4B,CAAC,CAAC;QACrE,IAAI,qCAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAC9C,MAAM,IAAI,wCAAkB,CAAC,mCAAmC,CAAC,CAAC;QAEpE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9D,MAAM,wBAAU,CAAC,MAAM,CAAC,qCAAgB,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE;YAChE,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,sCAAmB,CAAC,UAAU;YAC1C,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,+BAAW,CAAC,WAAW;YAC/B,QAAQ,EAAE,wBAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;SACrE,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AA5EY,oDAAoB;AAazB;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,shBAAshB;KACzhB,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,sCAAgB;;gDAGvC;AAOK;IALL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EAAE,mDAAmD;KACjE,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,2BAAW;;gDAGlC;AAQK;IANL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,oBAAoB;QAC7B,WAAW,EACT,8JAA8J;KACjK,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;kDAgBvC;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gBAAgB;QACzB,WAAW,EACT,2JAA2J;KAC9J,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;kDAiBvC;+BA3EU,oBAAoB;IAJhC,IAAA,iBAAO,EAAC,sBAAsB,CAAC;IAC/B,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAC9B,IAAA,mBAAU,EAAC,wBAAwB,CAAC;qCAGI,yCAAkB;QACzB,0BAAW;QACL,uCAAiB;GAJ5C,oBAAoB,CA4EhC"}

package/dist/admin/dtos/add.api.key.dto.d.ts

@@ -2,6 +2,7 @@ export declare class AddApiKeyDto {
     name: string;
     tenant_id: string;
     scope_ids?: string[];
+    role_ids?: string[];
     expires_at?: string;
 }
 //# sourceMappingURL=add.api.key.dto.d.ts.map

package/dist/admin/dtos/add.api.key.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"add.api.key.dto.d.ts","sourceRoot":"","sources":["../../../src/admin/dtos/add.api.key.dto.ts"],"names":[],"mappings":"AAgBA,qBAAa,YAAY;IAKvB,IAAI,EAAE,MAAM,CAAC;IAQb,SAAS,EAAE,MAAM,CAAC;IAalB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IASrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"add.api.key.dto.d.ts","sourceRoot":"","sources":["../../../src/admin/dtos/add.api.key.dto.ts"],"names":[],"mappings":"AAgBA,qBAAa,YAAY;IAKvB,IAAI,EAAE,MAAM,CAAC;IAQb,SAAS,EAAE,MAAM,CAAC;IAalB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAYrB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IASpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/dist/admin/dtos/add.api.key.dto.js

@@ -46,6 +46,18 @@ __decorate([
     (0, class_validator_1.IsUUID)('all', { each: true }),
     __metadata("design:type", Array)
 ], AddApiKeyDto.prototype, "scope_ids", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({
+        type: [String],
+        format: 'uuid',
+        description: 'sys_roles uuids the key acts with. Each must be an active scoped role inside one of `scope_ids` (or a child of one).',
+    }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayMaxSize)(admin_default_enum_1.AdminLimit.MAX_ID_ARRAY),
+    (0, class_validator_1.IsUUID)('all', { each: true }),
+    __metadata("design:type", Array)
+], AddApiKeyDto.prototype, "role_ids", void 0);
 __decorate([
     (0, swagger_1.ApiPropertyOptional)({
         description: `When the key stops working (ISO 8601). Must be in the future and at most ${admin_default_enum_1.AdminLimit.API_KEY_MAX_TTL_DAYS} days ahead; defaults to ${admin_default_enum_1.AdminLimit.API_KEY_DEFAULT_TTL_DAYS} days.`,

package/dist/admin/dtos/add.api.key.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"add.api.key.dto.js","sourceRoot":"","sources":["../../../src/admin/dtos/add.api.key.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAUyB;AACzB,6CAAmE;AACnE,oEAAyD;AACzD,qEAA8D;AAG9D,MAAa,YAAY;CAoCxB;AApCD,oCAoCC;AA/BC;IAJC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACvC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,GAAG,CAAC;;0CACF;AAQb;IANC,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,wCAAwC;KACtD,CAAC;IACD,IAAA,wBAAM,GAAE;IACR,IAAA,4BAAU,GAAE;;+CACK;AAalB;IAXC,IAAA,6BAAmB,EAAC;QACnB,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,MAAM;QACd,WAAW,EACT,yEAAyE;KAC5E,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,yBAAO,GAAE;IACT,IAAA,8BAAY,EAAC,CAAC,CAAC;IACf,IAAA,8BAAY,EAAC,+BAAU,CAAC,YAAY,CAAC;IACrC,IAAA,wBAAM,EAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;+CACT;AASrB;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,4EAA4E,+BAAU,CAAC,oBAAoB,4BAA4B,+BAAU,CAAC,wBAAwB,QAAQ;QAC/L,OAAO,EAAE,0BAA0B;KACpC,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,GAAE;IACX,IAAA,+BAAY,GAAE;;gDACK"}
+{"version":3,"file":"add.api.key.dto.js","sourceRoot":"","sources":["../../../src/admin/dtos/add.api.key.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAUyB;AACzB,6CAAmE;AACnE,oEAAyD;AACzD,qEAA8D;AAG9D,MAAa,YAAY;CAgDxB;AAhDD,oCAgDC;AA3CC;IAJC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;IACvC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,GAAG,CAAC;;0CACF;AAQb;IANC,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,MAAM;QACd,WAAW,EAAE,wCAAwC;KACtD,CAAC;IACD,IAAA,wBAAM,GAAE;IACR,IAAA,4BAAU,GAAE;;+CACK;AAalB;IAXC,IAAA,6BAAmB,EAAC;QACnB,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,MAAM;QACd,WAAW,EACT,yEAAyE;KAC5E,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,yBAAO,GAAE;IACT,IAAA,8BAAY,EAAC,CAAC,CAAC;IACf,IAAA,8BAAY,EAAC,+BAAU,CAAC,YAAY,CAAC;IACrC,IAAA,wBAAM,EAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;+CACT;AAYrB;IAVC,IAAA,6BAAmB,EAAC;QACnB,IAAI,EAAE,CAAC,MAAM,CAAC;QACd,MAAM,EAAE,MAAM;QACd,WAAW,EACT,sHAAsH;KACzH,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,yBAAO,GAAE;IACT,IAAA,8BAAY,EAAC,+BAAU,CAAC,YAAY,CAAC;IACrC,IAAA,wBAAM,EAAC,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;8CACV;AASpB;IAPC,IAAA,6BAAmB,EAAC;QACnB,WAAW,EAAE,4EAA4E,+BAAU,CAAC,oBAAoB,4BAA4B,+BAAU,CAAC,wBAAwB,QAAQ;QAC/L,OAAO,EAAE,0BAA0B;KACpC,CAAC;IACD,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,GAAE;IACX,IAAA,+BAAY,GAAE;;gDACK"}

package/dist/admin/dtos/add.permission.dto.d.ts

@@ -0,0 +1,8 @@
+import { CommonDataDto } from '../../common/dtos/common.data.dto';
+export declare class AddPermissionDto extends CommonDataDto {
+    scope_id: string;
+    identifier: string;
+    name: string;
+    description?: string;
+}
+//# sourceMappingURL=add.permission.dto.d.ts.map

package/dist/admin/dtos/add.permission.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add.permission.dto.d.ts","sourceRoot":"","sources":["../../../src/admin/dtos/add.permission.dto.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAQlE,qBAAa,gBAAiB,SAAQ,aAAa;IAOjD,QAAQ,EAAE,MAAM,CAAC;IAUjB,UAAU,EAAE,MAAM,CAAC;IAMnB,IAAI,EAAE,MAAM,CAAC;IAMb,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/admin/dtos/add.permission.dto.js

@@ -0,0 +1,53 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AddPermissionDto = void 0;
+const class_validator_1 = require("class-validator");
+const swagger_1 = require("@nestjs/swagger");
+const common_data_dto_1 = require("../../common/dtos/common.data.dto");
+const admin_patterns_1 = require("../validators/admin.patterns");
+class AddPermissionDto extends common_data_dto_1.CommonDataDto {
+}
+exports.AddPermissionDto = AddPermissionDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        format: 'uuid',
+        description: 'The scope this permission belongs to (sys_scopes).',
+    }),
+    (0, class_validator_1.IsUUID)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AddPermissionDto.prototype, "scope_id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'inventory.item.read' }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(150),
+    (0, class_validator_1.Matches)(admin_patterns_1.CATALOGUE_IDENTIFIER_PATTERN, {
+        message: 'identifier may only contain lowercase letters, digits, hyphens and underscores, joined by single dots or colons',
+    }),
+    __metadata("design:type", String)
+], AddPermissionDto.prototype, "identifier", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'Read inventory items' }),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(150),
+    __metadata("design:type", String)
+], AddPermissionDto.prototype, "name", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)(),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(1000),
+    __metadata("design:type", String)
+], AddPermissionDto.prototype, "description", void 0);
+//# sourceMappingURL=add.permission.dto.js.map