@neohm/nestend 5.0.2 → 6.1.0

package/dist/auth/controllers/auth.controller.js

@@ -46,14 +46,17 @@ let AuthController = class AuthController {
     }
     async me() {
         const { user, roles } = await this.authService.validateIdentity();
-        const [current, organizations, invitations] = await Promise.all([
+        const [current, organizations, invitations, access] = await Promise.all([
             this.tenantMembershipService.sessionOrganization(user),
             this.tenantMembershipService.organizationsOf(user.id),
             this.tenantInvitationService.pendingFor(user),
+            this.authService.effectiveAccess(user),
         ]);
         return {
             user,
             roles,
+            permissions: access.permissions,
+            grantable_scopes: access.grantable_scopes,
             organization: current?.name ?? null,
             organizations,
             invitations,
@@ -119,7 +122,7 @@ __decorate([
     (0, swagger_1.ApiBearerAuth)(),
     (0, swagger_1.ApiOperation)({
         summary: 'Resolve the current authenticated user and roles.',
-        description: "`roles` and `organization` belong to the session's organization. `organizations` lists every one the user may switch to, and `invitations` the pending ones addressed to them. Reachable while `user.password_change_required` is set — every other endpoint refuses until the one-time password is changed.",
+        description: "`roles`, `permissions`, `grantable_scopes` and `organization` belong to the session's organization: `permissions` is everything the held roles reach (seniority and parent scopes included), `grantable_scopes` the scopes whose roles the user may grant. `organizations` lists every one the user may switch to, and `invitations` the pending ones addressed to them. Reachable while `user.password_change_required` is set — every other endpoint refuses until the one-time password is changed.",
     }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),

package/dist/auth/controllers/auth.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAuE;AAEvE,sFAAiF;AACjF,2DAAuD;AACvD,yEAAoE;AACpE,qFAAgF;AAChF,qFAAgF;AAChF,+EAA0E;AAC1E,uFAAkF;AAGlF,iDAA6C;AAC7C,+DAA0D;AAC1D,uDAAmD;AACnD,iEAA4D;AAC5D,qEAAgE;AAChE,+DAA0D;AAC1D,6FAAuF;AACvF,yFAAmF;AACnF,iGAA2F;AAC3F,qEAAwD;AACxD,mHAAmG;AACnG,0CAAuC;AACvC,0EAAsE;AAK/D,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YACmB,WAAwB,EACxB,iBAAoC,EACpC,uBAAgD,EAChD,uBAAgD,EAChD,QAA8B,EAC9B,wBAAkD;QALlD,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,aAAQ,GAAR,QAAQ,CAAsB;QAC9B,6BAAwB,GAAxB,wBAAwB,CAA0B;IAClE,CAAC;IAUE,AAAN,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAClE,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9D,IAAI,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,IAAI,CAAC;YACtD,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC;SAC9C,CAAC,CAAC;QAEH,OAAO;YACL,IAAI;YACJ,KAAK;YACL,YAAY,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;YACnC,aAAa;YACb,WAAW;SACZ,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,KAAK,CACD,GAAa,EACd,OAAgB;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACtC,OAAO,EACP,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,EACtC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CACpE,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IASK,AAAN,KAAK,CAAC,WAAW,CACP,GAAmB,EACpB,OAAgB;QAEvB,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,oDAAuB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IASK,AAAN,KAAK,CAAC,QAAQ,CACJ,GAAgB,EACjB,OAAgB;QAEvB,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,IAAI,wDAAyB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CACjC,IAAI,EACJ,wCAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,CACzC,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,OAAO,CACH,GAAoB,EACrB,OAAgB;QAEvB,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAC7B,GAAG,CAAC,aAAa,EACjB,wCAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,CACzC,CAAC;IACJ,CAAC;IAUK,AAAN,KAAK,CAAC,MAAM,CAAS,GAAoB;QACvC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAWK,AAAN,KAAK,CAAC,cAAc,CACV,GAAsB;QAE9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,IAAI,4DAA2B,CAAC,IAAI,CAAC,EAAE,EAAE,WAAI,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAWK,AAAN,KAAK,CAAC,wBAAwB,CACrB,OAAgB;QAEvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,oBAAoB,EAAE;YACtD,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IASK,AAAN,KAAK,CAAC,WAAW,CACP,GAAmB,EACpB,OAAgB;QAEvB,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,oBAAoB,EAAE;YACtD,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,IAAgB,EAChB,OAAgB;QAEhB,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YACxC,GAAG,wCAAkB,CAAC,YAAY,CAAC,OAAO,CAAC;YAC3C,SAAS,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,IAAI,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA5LY,wCAAc;AAkBnB;IARL,IAAA,YAAG,EAAC,IAAI,CAAC;IACT,IAAA,oEAA0B,GAAE;IAC5B,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mDAAmD;QAC5D,WAAW,EACT,8SAA8S;KACjT,CAAC;;;;wCAgBD;AASK;IAPL,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,yBAAM,GAAE;IACR,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wDAAwD;QACjE,WAAW,EACT,sIAAsI;KACzI,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,oBAAQ;;2CAUtB;AASK;IAPL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,yBAAM,GAAE;IACR,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,2KAA2K;KAC9K,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,iCAAc;;iDAQ5B;AASK;IAPL,IAAA,aAAI,EAAC,UAAU,CAAC;IAChB,IAAA,yBAAM,GAAE;IACR,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EACT,sGAAsG;KACzG,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,0BAAW;;8CAUzB;AASK;IAPL,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,yBAAM,GAAE;IACR,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kDAAkD;QAC3D,WAAW,EACT,wHAAwH;KAC3H,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,mCAAe;;6CAQ7B;AAUK;IARL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,oEAA0B,GAAE;IAC5B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EACL,uEAAuE;KAC1E,CAAC;IACY,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,mCAAe;;4CAGxC;AAWK;IATL,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,oEAA0B,GAAE;IAC5B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,oMAAoM;KACvM,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,uCAAiB;;oDAK/B;AAWK;IATL,IAAA,aAAI,EAAC,4BAA4B,CAAC;IAClC,IAAA,oEAA0B,GAAE;IAC5B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,mEAAmE;KACtE,CAAC;IAEC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAQP;AASK;IAPL,IAAA,aAAI,EAAC,2BAA2B,CAAC;IACjC,IAAA,yBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EAAE,uCAAuC;KACrD,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,iCAAc;;iDAQ5B;yBAjLU,cAAc;IAH1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,UAAU,CAAC;IACtB,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;qCAGG,0BAAW;QACL,uCAAiB;QACX,mDAAuB;QACvB,mDAAuB;QACtC,6CAAoB;QACJ,qDAAwB;GAP1D,cAAc,CA4L1B"}
+{"version":3,"file":"auth.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/auth.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CASwB;AACxB,6CAAuE;AAEvE,sFAAiF;AACjF,2DAAuD;AACvD,yEAAoE;AACpE,qFAAgF;AAChF,qFAAgF;AAChF,+EAA0E;AAC1E,uFAAkF;AAGlF,iDAA6C;AAC7C,+DAA0D;AAC1D,uDAAmD;AACnD,iEAA4D;AAC5D,qEAAgE;AAChE,+DAA0D;AAC1D,6FAAuF;AACvF,yFAAmF;AACnF,iGAA2F;AAC3F,qEAAwD;AACxD,mHAAmG;AACnG,0CAAuC;AACvC,0EAAsE;AAK/D,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YACmB,WAAwB,EACxB,iBAAoC,EACpC,uBAAgD,EAChD,uBAAgD,EAChD,QAA8B,EAC9B,wBAAkD;QALlD,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,aAAQ,GAAR,QAAQ,CAAsB;QAC9B,6BAAwB,GAAxB,wBAAwB,CAA0B;IAClE,CAAC;IAUE,AAAN,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAClE,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACtE,IAAI,CAAC,uBAAuB,CAAC,mBAAmB,CAAC,IAAI,CAAC;YACtD,IAAI,CAAC,uBAAuB,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,IAAI,CAAC;YAC7C,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC;SACvC,CAAC,CAAC;QAEH,OAAO;YACL,IAAI;YACJ,KAAK;YACL,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,YAAY,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;YACnC,aAAa;YACb,WAAW;SACZ,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,KAAK,CACD,GAAa,EACd,OAAgB;QAEvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CACtC,OAAO,EACP,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,EACtC,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CACpE,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IASK,AAAN,KAAK,CAAC,WAAW,CACP,GAAmB,EACpB,OAAgB;QAEvB,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,oDAAuB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IASK,AAAN,KAAK,CAAC,QAAQ,CACJ,GAAgB,EACjB,OAAgB;QAEvB,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,IAAI,wDAAyB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,wBAAwB,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CACjC,IAAI,EACJ,wCAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,CACzC,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,OAAO,CACH,GAAoB,EACrB,OAAgB;QAEvB,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAC7B,GAAG,CAAC,aAAa,EACjB,wCAAkB,CAAC,YAAY,CAAC,OAAO,CAAC,CACzC,CAAC;IACJ,CAAC;IAUK,AAAN,KAAK,CAAC,MAAM,CAAS,GAAoB;QACvC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAWK,AAAN,KAAK,CAAC,cAAc,CACV,GAAsB;QAE9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,IAAI,4DAA2B,CAAC,IAAI,CAAC,EAAE,EAAE,WAAI,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAWK,AAAN,KAAK,CAAC,wBAAwB,CACrB,OAAgB;QAEvB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC;QAC3D,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,oBAAoB,EAAE;YACtD,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IASK,AAAN,KAAK,CAAC,WAAW,CACP,GAAmB,EACpB,OAAgB;QAEvB,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,oBAAoB,EAAE;YACtD,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QACH,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,MAAM,CAClB,IAAgB,EAChB,OAAgB;QAEhB,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,EAAE;YACxC,GAAG,wCAAkB,CAAC,YAAY,CAAC,OAAO,CAAC;YAC3C,SAAS,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,aAAa,CAAC,IAAI,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AA/LY,wCAAc;AAkBnB;IARL,IAAA,YAAG,EAAC,IAAI,CAAC;IACT,IAAA,oEAA0B,GAAE;IAC5B,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mDAAmD;QAC5D,WAAW,EACT,weAAwe;KAC3e,CAAC;;;;wCAmBD;AASK;IAPL,IAAA,aAAI,EAAC,OAAO,CAAC;IACb,IAAA,yBAAM,GAAE;IACR,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wDAAwD;QACjE,WAAW,EACT,sIAAsI;KACzI,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,oBAAQ;;2CAUtB;AASK;IAPL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,yBAAM,GAAE;IACR,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,2KAA2K;KAC9K,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,iCAAc;;iDAQ5B;AASK;IAPL,IAAA,aAAI,EAAC,UAAU,CAAC;IAChB,IAAA,yBAAM,GAAE;IACR,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qDAAqD;QAC9D,WAAW,EACT,sGAAsG;KACzG,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,0BAAW;;8CAUzB;AASK;IAPL,IAAA,aAAI,EAAC,SAAS,CAAC;IACf,IAAA,yBAAM,GAAE;IACR,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kDAAkD;QAC3D,WAAW,EACT,wHAAwH;KAC3H,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,mCAAe;;6CAQ7B;AAUK;IARL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,oEAA0B,GAAE;IAC5B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EACL,uEAAuE;KAC1E,CAAC;IACY,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,mCAAe;;4CAGxC;AAWK;IATL,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,oEAA0B,GAAE;IAC5B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,oMAAoM;KACvM,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,uCAAiB;;oDAK/B;AAWK;IATL,IAAA,aAAI,EAAC,4BAA4B,CAAC;IAClC,IAAA,oEAA0B,GAAE;IAC5B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,uBAAa,GAAE;IACf,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,yDAAyD;QAClE,WAAW,EACT,mEAAmE;KACtE,CAAC;IAEC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAQP;AASK;IAPL,IAAA,aAAI,EAAC,2BAA2B,CAAC;IACjC,IAAA,yBAAM,GAAE;IACR,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,qCAAqC;QAC9C,WAAW,EAAE,uCAAuC;KACrD,CAAC;IAEC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qCADO,iCAAc;;iDAQ5B;yBApLU,cAAc;IAH1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,UAAU,CAAC;IACtB,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;qCAGG,0BAAW;QACL,uCAAiB;QACX,mDAAuB;QACvB,mDAAuB;QACtC,6CAAoB;QACJ,qDAAwB;GAP1D,cAAc,CA+L1B"}

package/dist/auth/controllers/tenant.invitation.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.invitation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.invitation.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAK7E,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,qBAIa,0BAA0B;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAHZ,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB,EAChD,iBAAiB,EAAE,iBAAiB,EACpC,YAAY,EAAE,YAAY;IASvC,MAAM,CAAS,GAAG,EAAE,mBAAmB;IAsBvC,KAAK;IAUL,IAAI,CAAS,GAAG,EAAE,uBAAuB;IAgBzC,MAAM,CAA6B,EAAE,EAAE,MAAM;IAsB7C,MAAM,CAA6B,EAAE,EAAE,MAAM;YAYrC,QAAQ;CAevB"}
+{"version":3,"file":"tenant.invitation.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.invitation.controller.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAI7E,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAOhF,qBAIa,0BAA0B;IAEnC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAHZ,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB,EAChD,iBAAiB,EAAE,iBAAiB,EACpC,YAAY,EAAE,YAAY;IASvC,MAAM,CAAS,GAAG,EAAE,mBAAmB;IAqBvC,KAAK;IAWL,IAAI,CAAS,GAAG,EAAE,uBAAuB;IAezC,MAAM,CAA6B,EAAE,EAAE,MAAM;IAsB7C,MAAM,CAA6B,EAAE,EAAE,MAAM;YAWrC,QAAQ;CAevB"}

package/dist/auth/controllers/tenant.invitation.controller.js

@@ -21,7 +21,6 @@ const list_filter_service_1 = require("../../common/services/list.filter.service
 const invite_tenant_user_dto_1 = require("../dtos/invite.tenant.user.dto");
 const tenant_invitation_list_dto_1 = require("../dtos/tenant.invitation.list.dto");
 const tenant_invitation_default_enum_1 = require("../enums/tenant.invitation.default.enum");
-const tenant_role_enum_1 = require("../enums/tenant.role.enum");
 const tenant_invitation_data_processor_1 = require("../processors/tenant.invitation.data.processor");
 const tenant_invitation_list_processor_1 = require("../processors/tenant.invitation.list.processor");
 const auth_service_1 = require("../services/auth.service");
@@ -34,26 +33,26 @@ let TenantInvitationController = class TenantInvitationController {
         this.cacheService = cacheService;
     }
     async invite(dto) {
-        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        const { user, authority } = await this.authService.validateGrantAuthority();
         await this.throttle(`tenant-invitations:daily:${user.organization_id}`, 'TENANT_INVITATION_DAILY_LIMIT', tenant_invitation_default_enum_1.TenantInvitationDefault.DAILY_LIMIT, tenant_invitation_default_enum_1.TenantInvitationDefault.DAILY_WINDOW_SECONDS);
-        return new tenant_invitation_data_processor_1.TenantInvitationDataProcessor(user, this.tenantInvitationService).process(dto);
+        return new tenant_invitation_data_processor_1.TenantInvitationDataProcessor(user, this.tenantInvitationService, authority).process(dto);
     }
     async roles() {
-        await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
-        return this.tenantInvitationService.grantableRoles();
+        const { authority } = await this.authService.validateGrantAuthority();
+        return this.tenantInvitationService.grantableRoles(authority);
     }
     async list(dto) {
-        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
-        return new tenant_invitation_list_processor_1.TenantInvitationListProcessor(this.listFilterService).process(dto, user.organization_id);
+        const { user, authority } = await this.authService.validateGrantAuthority();
+        return new tenant_invitation_list_processor_1.TenantInvitationListProcessor(this.listFilterService).process(dto, user.organization_id, authority.actsAsGlobalAdmin ? undefined : user.id);
     }
     async resend(id) {
-        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        const { user, authority } = await this.authService.validateGrantAuthority();
         await this.throttle(`tenant-invitations:resend:${id}`, 'TENANT_INVITATION_RESEND_LIMIT', tenant_invitation_default_enum_1.TenantInvitationDefault.RESEND_LIMIT, tenant_invitation_default_enum_1.TenantInvitationDefault.RESEND_WINDOW_SECONDS);
-        return this.tenantInvitationService.resend(id, user.organization_id, user.id);
+        return this.tenantInvitationService.resend(id, user.organization_id, user.id, authority.actsAsGlobalAdmin ? undefined : user.id);
     }
     async revoke(id) {
-        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
-        return this.tenantInvitationService.revoke(id, user.organization_id, user.id);
+        const { user, authority } = await this.authService.validateGrantAuthority();
+        return this.tenantInvitationService.revoke(id, user.organization_id, user.id, authority.actsAsGlobalAdmin ? undefined : user.id);
     }
     async throttle(key, envName, fallback, windowSeconds) {
         const configured = Number(process.env[envName]);
@@ -67,7 +66,7 @@ __decorate([
     (0, common_1.Post)(),
     (0, swagger_1.ApiOperation)({
         summary: 'Invite an email into the session organization.',
-        description: 'The roles in `role_ids` are granted in this organization when the invitee accepts. An email with no account gets one — named `full_name`, with an expiring one-time password mailed to it that must be changed at first sign-in. Only an account with a verified email can see or accept an invitation. Refused for an existing member or an email with a pending invitation here; rate-limited per organization per day. Requires the `global.admin` tenant role.',
+        description: 'The roles in `role_ids` are granted in this organization when the invitee accepts. An email with no account gets one — named `full_name`, with an expiring one-time password mailed to it that must be changed at first sign-in. Only an account with a verified email can see or accept an invitation. Refused for an existing member or an email with a pending invitation here; rate-limited per organization per day. Requires grant authority, and every role must be one the caller may grant: `global.admin` grants any, a scope admin the roles of its scope (and its child scopes).',
     }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
@@ -78,7 +77,7 @@ __decorate([
     (0, common_1.Get)('roles'),
     (0, swagger_1.ApiOperation)({
         summary: 'Roles an invitation may grant.',
-        description: 'The active `sys_roles` catalogue, for the invite form. Requires the `global.admin` tenant role.',
+        description: "The roles the caller may grant here, for the invite and member-role forms: every active role for `global.admin`, a scope admin's scope roles otherwise. Roles of scopes the organization lacks are left out. Requires grant authority.",
     }),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", []),
@@ -88,7 +87,7 @@ __decorate([
     (0, common_1.Post)('list'),
     (0, swagger_1.ApiOperation)({
         summary: "List the session organization's invitations.",
-        description: 'Requires the `global.admin` tenant role.',
+        description: 'All of them for `global.admin`; a scope admin sees the ones they issued. Requires grant authority.',
     }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
@@ -99,7 +98,7 @@ __decorate([
     (0, common_1.Post)(':id/resend'),
     (0, swagger_1.ApiOperation)({
         summary: 'Give a pending invitation a fresh expiry.',
-        description: 'Also revives one that expired unanswered. When this invitation created the account and nobody has signed in to it yet, a fresh one-time password is mailed. Rate-limited per invitation. Requires the `global.admin` tenant role.',
+        description: 'Also revives one that expired unanswered. When this invitation created the account and nobody has signed in to it yet, a fresh one-time password is mailed. Rate-limited per invitation. Requires grant authority; a scope admin resends only their own invitations.',
     }),
     __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
     __metadata("design:type", Function),
@@ -110,7 +109,7 @@ __decorate([
     (0, common_1.Delete)(':id'),
     (0, swagger_1.ApiOperation)({
         summary: 'Revoke a pending invitation.',
-        description: 'Requires the `global.admin` tenant role.',
+        description: 'Requires grant authority; a scope admin revokes only their own invitations.',
     }),
     __param(0, (0, common_1.Param)('id', common_1.ParseUUIDPipe)),
     __metadata("design:type", Function),

package/dist/auth/controllers/tenant.invitation.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.invitation.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.invitation.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,6CAAuE;AACvE,sFAAiF;AACjF,uEAAmE;AACnE,mFAA8E;AAC9E,2EAAqE;AACrE,mFAA6E;AAC7E,4FAAkF;AAClF,gEAAuD;AACvD,qGAA+F;AAC/F,qGAA+F;AAC/F,2DAAuD;AACvD,qFAAgF;AAOzE,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YACmB,WAAwB,EACxB,uBAAgD,EAChD,iBAAoC,EACpC,YAA0B;QAH1B,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAQE,AAAN,KAAK,CAAC,MAAM,CAAS,GAAwB;QAC3C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,MAAM,IAAI,CAAC,QAAQ,CACjB,4BAA4B,IAAI,CAAC,eAAe,EAAE,EAClD,+BAA+B,EAC/B,wDAAuB,CAAC,WAAW,EACnC,wDAAuB,CAAC,oBAAoB,CAC7C,CAAC;QACF,OAAO,IAAI,gEAA6B,CACtC,IAAI,EACJ,IAAI,CAAC,uBAAuB,CAC7B,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAQK,AAAN,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,6BAAU,CAAC,YAAY,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,EAAE,CAAC;IACvD,CAAC;IAOK,AAAN,KAAK,CAAC,IAAI,CAAS,GAA4B;QAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,gEAA6B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CACtE,GAAG,EACH,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,MAAM,IAAI,CAAC,QAAQ,CACjB,6BAA6B,EAAE,EAAE,EACjC,gCAAgC,EAChC,wDAAuB,CAAC,YAAY,EACpC,wDAAuB,CAAC,qBAAqB,CAC9C,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACxC,EAAE,EACF,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAOK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACxC,EAAE,EACF,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAGO,KAAK,CAAC,QAAQ,CACpB,GAAW,EACX,OAAe,EACf,QAAgB,EAChB,aAAqB;QAErB,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,MAAM,KAAK,GACT,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,GAAG,KAAK;YACjE,MAAM,IAAI,sBAAa,CACrB,gDAAgD,EAChD,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;IACN,CAAC;CACF,CAAA;AA/GY,gEAA0B;AAc/B;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EACT,ocAAoc;KACvc,CAAC;IACY,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,4CAAmB;;wDAc5C;AAQK;IANL,IAAA,YAAG,EAAC,OAAO,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,iGAAiG;KACpG,CAAC;;;;uDAID;AAOK;IALL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,0CAA0C;KACxD,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,oDAAuB;;sDAQ9C;AAQK;IANL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,mOAAmO;KACtO,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;wDAevC;AAOK;IALL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,0CAA0C;KACxD,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;wDASvC;qCA7FU,0BAA0B;IAJtC,IAAA,iBAAO,EAAC,0BAA0B,CAAC;IACnC,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAC9B,IAAA,mBAAU,EAAC,8BAA8B,CAAC;qCAGT,0BAAW;QACC,mDAAuB;QAC7B,uCAAiB;QACtB,4BAAY;GALlC,0BAA0B,CA+GtC"}
+{"version":3,"file":"tenant.invitation.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.invitation.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAWwB;AACxB,6CAAuE;AACvE,sFAAiF;AACjF,uEAAmE;AACnE,mFAA8E;AAC9E,2EAAqE;AACrE,mFAA6E;AAC7E,4FAAkF;AAClF,qGAA+F;AAC/F,qGAA+F;AAC/F,2DAAuD;AACvD,qFAAgF;AAWzE,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,YACmB,WAAwB,EACxB,uBAAgD,EAChD,iBAAoC,EACpC,YAA0B;QAH1B,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAQE,AAAN,KAAK,CAAC,MAAM,CAAS,GAAwB;QAC3C,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC;QAC5E,MAAM,IAAI,CAAC,QAAQ,CACjB,4BAA4B,IAAI,CAAC,eAAe,EAAE,EAClD,+BAA+B,EAC/B,wDAAuB,CAAC,WAAW,EACnC,wDAAuB,CAAC,oBAAoB,CAC7C,CAAC;QACF,OAAO,IAAI,gEAA6B,CACtC,IAAI,EACJ,IAAI,CAAC,uBAAuB,EAC5B,SAAS,CACV,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IAQK,AAAN,KAAK,CAAC,KAAK;QACT,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC;QACtE,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAChE,CAAC;IAQK,AAAN,KAAK,CAAC,IAAI,CAAS,GAA4B;QAC7C,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC;QAC5E,OAAO,IAAI,gEAA6B,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CACtE,GAAG,EACH,IAAI,CAAC,eAAe,EACpB,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAClD,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC;QAC5E,MAAM,IAAI,CAAC,QAAQ,CACjB,6BAA6B,EAAE,EAAE,EACjC,gCAAgC,EAChC,wDAAuB,CAAC,YAAY,EACpC,wDAAuB,CAAC,qBAAqB,CAC9C,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACxC,EAAE,EACF,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,EACP,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAClD,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAA6B,EAAU;QACjD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,CACxC,EAAE,EACF,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,EACP,SAAS,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAClD,CAAC;IACJ,CAAC;IAGO,KAAK,CAAC,QAAQ,CACpB,GAAW,EACX,OAAe,EACf,QAAgB,EAChB,aAAqB;QAErB,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,MAAM,KAAK,GACT,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzE,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,GAAG,KAAK;YACjE,MAAM,IAAI,sBAAa,CACrB,gDAAgD,EAChD,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;IACN,CAAC;CACF,CAAA;AA7GY,gEAA0B;AAc/B;IANL,IAAA,aAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EACT,8jBAA8jB;KACjkB,CAAC;IACY,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,4CAAmB;;wDAa5C;AAQK;IANL,IAAA,YAAG,EAAC,OAAO,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EACT,wOAAwO;KAC3O,CAAC;;;;uDAID;AAQK;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8CAA8C;QACvD,WAAW,EACT,oGAAoG;KACvG,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,oDAAuB;;sDAO9C;AAQK;IANL,IAAA,aAAI,EAAC,YAAY,CAAC;IAClB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,2CAA2C;QACpD,WAAW,EACT,sQAAsQ;KACzQ,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;wDAcvC;AAQK;IANL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EACT,6EAA6E;KAChF,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,IAAI,EAAE,sBAAa,CAAC,CAAA;;;;wDAQvC;qCA3FU,0BAA0B;IAJtC,IAAA,iBAAO,EAAC,0BAA0B,CAAC;IACnC,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAC9B,IAAA,mBAAU,EAAC,8BAA8B,CAAC;qCAGT,0BAAW;QACC,mDAAuB;QAC7B,uCAAiB;QACtB,4BAAY;GALlC,0BAA0B,CA6GtC"}

package/dist/auth/controllers/tenant.member.controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.member.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.member.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAGrE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAGhF,qBAIa,sBAAsB;IAE/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB,EAChD,iBAAiB,EAAE,iBAAiB;IASjD,IAAI,CAAS,GAAG,EAAE,mBAAmB;IAgBrC,QAAQ,CACoB,MAAM,EAAE,MAAM,EACtC,GAAG,EAAE,cAAc;IAoBvB,UAAU,CAAiC,MAAM,EAAE,MAAM;IAoBzD,UAAU,CAAiC,MAAM,EAAE,MAAM;IAkBzD,MAAM,CAAiC,MAAM,EAAE,MAAM;IAa3D,OAAO,CAAC,UAAU;CAMnB"}
+{"version":3,"file":"tenant.member.controller.d.ts","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.member.controller.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAGrE,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAMhF,qBAIa,sBAAsB;IAE/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAFjB,WAAW,EAAE,WAAW,EACxB,uBAAuB,EAAE,uBAAuB,EAChD,iBAAiB,EAAE,iBAAiB;IASjD,IAAI,CAAS,GAAG,EAAE,mBAAmB;IAcrC,QAAQ,CACoB,MAAM,EAAE,MAAM,EACtC,GAAG,EAAE,cAAc;IAoBvB,UAAU,CAAiC,MAAM,EAAE,MAAM;IAoBzD,UAAU,CAAiC,MAAM,EAAE,MAAM;IAkBzD,MAAM,CAAiC,MAAM,EAAE,MAAM;IAa3D,OAAO,CAAC,UAAU;CAMnB"}

package/dist/auth/controllers/tenant.member.controller.js

@@ -31,12 +31,12 @@ let TenantMemberController = class TenantMemberController {
         this.listFilterService = listFilterService;
     }
     async list(dto) {
-        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
+        const { user } = await this.authService.validateGrantAuthority();
         return new tenant_member_list_processor_1.TenantMemberListProcessor(this.listFilterService).process(dto, user.organization_id);
     }
     async setRoles(userId, dto) {
-        const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
-        return this.tenantMembershipService.setMemberRoles(userId, user.organization_id, dto.role_ids, user.id);
+        const { user, authority } = await this.authService.validateGrantAuthority();
+        return this.tenantMembershipService.setMemberRoles(userId, user.organization_id, dto.role_ids, user.id, true, authority);
     }
     async deactivate(userId) {
         const { user } = await this.authService.validateRole(tenant_role_enum_1.TenantRole.GLOBAL_ADMIN);
@@ -62,7 +62,7 @@ __decorate([
     (0, common_1.Post)('list'),
     (0, swagger_1.ApiOperation)({
         summary: "List the session organization's members.",
-        description: 'Each row carries the roles held in this organization. Requires the `global.admin` tenant role.',
+        description: 'Each row carries the roles held in this organization. Requires grant authority (`global.admin` or a scope admin).',
     }),
     __param(0, (0, common_1.Body)()),
     __metadata("design:type", Function),
@@ -73,7 +73,7 @@ __decorate([
     (0, common_1.Post)(':userId/roles'),
     (0, swagger_1.ApiOperation)({
         summary: "Replace a member's roles in the session organization.",
-        description: '`role_ids` is the complete set; omitted roles are revoked. Refused when it would leave the organization without a `global.admin`. Requires the `global.admin` tenant role.',
+        description: "`role_ids` is the complete set; omitted roles are revoked. Every role added or removed must be one the caller may grant — a scope admin changes only its scopes' roles and must send the others unchanged. Refused when it would leave the organization without a `global.admin`. Requires grant authority.",
     }),
     __param(0, (0, common_1.Param)('userId', common_1.ParseUUIDPipe)),
     __param(1, (0, common_1.Body)()),

package/dist/auth/controllers/tenant.member.controller.js.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.member.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.member.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAUwB;AACxB,6CAAuE;AACvE,sFAAiF;AACjF,mFAA8E;AAC9E,qFAAiF;AACjF,+DAA0D;AAC1D,2EAAqE;AACrE,gEAAuD;AACvD,6FAAuF;AACvF,2DAAuD;AACvD,qFAAgF;AAOzE,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YACmB,WAAwB,EACxB,uBAAgD,EAChD,iBAAoC;QAFpC,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CAAS,GAAwB;QACzC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,wDAAyB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAClE,GAAG,EACH,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,QAAQ,CACoB,MAAc,EACtC,GAAmB;QAE3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAChD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,GAAG,CAAC,QAAQ,EACZ,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,UAAU,CAAiC,MAAc;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CACjD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,KAAK,EACL,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,UAAU,CAAiC,MAAc;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CACjD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,IAAI,EACJ,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAiC,MAAc;QACzD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAC9C,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAGO,UAAU,CAAC,MAAc,EAAE,QAAgB;QACjD,IAAI,MAAM,KAAK,QAAQ;YACrB,MAAM,IAAI,wCAAkB,CAC1B,yDAAyD,CAC1D,CAAC;IACN,CAAC;CACF,CAAA;AA5GY,wDAAsB;AAa3B;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0CAA0C;QACnD,WAAW,EACT,gGAAgG;KACnG,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,4CAAmB;;kDAQ1C;AAQK;IANL,IAAA,aAAI,EAAC,eAAe,CAAC;IACrB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uDAAuD;QAChE,WAAW,EACT,4KAA4K;KAC/K,CAAC;IAEC,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;IAC9B,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAM,iCAAc;;sDAW5B;AASK;IAPL,IAAA,aAAI,EAAC,oBAAoB,CAAC;IAC1B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+DAA+D;QACxE,WAAW,EACT,0RAA0R;KAC7R,CAAC;IACgB,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;wDAW/C;AASK;IAPL,IAAA,aAAI,EAAC,oBAAoB,CAAC;IAC1B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+DAA+D;QACxE,WAAW,EACT,8EAA8E;KACjF,CAAC;IACgB,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;wDAU/C;AAQK;IANL,IAAA,eAAM,EAAC,SAAS,CAAC;IACjB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EACT,iPAAiP;KACpP,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;oDAU3C;iCAnGU,sBAAsB;IAJlC,IAAA,iBAAO,EAAC,sBAAsB,CAAC;IAC/B,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAC9B,IAAA,mBAAU,EAAC,0BAA0B,CAAC;qCAGL,0BAAW;QACC,mDAAuB;QAC7B,uCAAiB;GAJ5C,sBAAsB,CA4GlC"}
+{"version":3,"file":"tenant.member.controller.js","sourceRoot":"","sources":["../../../src/auth/controllers/tenant.member.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAUwB;AACxB,6CAAuE;AACvE,sFAAiF;AACjF,mFAA8E;AAC9E,qFAAiF;AACjF,+DAA0D;AAC1D,2EAAqE;AACrE,gEAAuD;AACvD,6FAAuF;AACvF,2DAAuD;AACvD,qFAAgF;AAUzE,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YACmB,WAAwB,EACxB,uBAAgD,EAChD,iBAAoC;QAFpC,gBAAW,GAAX,WAAW,CAAa;QACxB,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,sBAAiB,GAAjB,iBAAiB,CAAmB;IACpD,CAAC;IAQE,AAAN,KAAK,CAAC,IAAI,CAAS,GAAwB;QACzC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC;QACjE,OAAO,IAAI,wDAAyB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAClE,GAAG,EACH,IAAI,CAAC,eAAe,CACrB,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,QAAQ,CACoB,MAAc,EACtC,GAAmB;QAE3B,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,sBAAsB,EAAE,CAAC;QAC5E,OAAO,IAAI,CAAC,uBAAuB,CAAC,cAAc,CAChD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,GAAG,CAAC,QAAQ,EACZ,IAAI,CAAC,EAAE,EACP,IAAI,EACJ,SAAS,CACV,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,UAAU,CAAiC,MAAc;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CACjD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,KAAK,EACL,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IASK,AAAN,KAAK,CAAC,UAAU,CAAiC,MAAc;QAC7D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,OAAO,IAAI,CAAC,uBAAuB,CAAC,eAAe,CACjD,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,IAAI,EACJ,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,MAAM,CAAiC,MAAc;QACzD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,CAClD,6BAAU,CAAC,YAAY,CACxB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC,uBAAuB,CAAC,YAAY,CAC9C,MAAM,EACN,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,EAAE,CACR,CAAC;IACJ,CAAC;IAGO,UAAU,CAAC,MAAc,EAAE,QAAgB;QACjD,IAAI,MAAM,KAAK,QAAQ;YACrB,MAAM,IAAI,wCAAkB,CAC1B,yDAAyD,CAC1D,CAAC;IACN,CAAC;CACF,CAAA;AA1GY,wDAAsB;AAa3B;IANL,IAAA,aAAI,EAAC,MAAM,CAAC;IACZ,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0CAA0C;QACnD,WAAW,EACT,mHAAmH;KACtH,CAAC;IACU,WAAA,IAAA,aAAI,GAAE,CAAA;;qCAAM,4CAAmB;;kDAM1C;AAQK;IANL,IAAA,aAAI,EAAC,eAAe,CAAC;IACrB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,uDAAuD;QAChE,WAAW,EACT,6SAA6S;KAChT,CAAC;IAEC,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;IAC9B,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAM,iCAAc;;sDAW5B;AASK;IAPL,IAAA,aAAI,EAAC,oBAAoB,CAAC;IAC1B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+DAA+D;QACxE,WAAW,EACT,0RAA0R;KAC7R,CAAC;IACgB,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;wDAW/C;AASK;IAPL,IAAA,aAAI,EAAC,oBAAoB,CAAC;IAC1B,IAAA,iBAAQ,EAAC,mBAAU,CAAC,EAAE,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+DAA+D;QACxE,WAAW,EACT,8EAA8E;KACjF,CAAC;IACgB,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;wDAU/C;AAQK;IANL,IAAA,eAAM,EAAC,SAAS,CAAC;IACjB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EACT,iPAAiP;KACpP,CAAC;IACY,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,sBAAa,CAAC,CAAA;;;;oDAU3C;iCAjGU,sBAAsB;IAJlC,IAAA,iBAAO,EAAC,sBAAsB,CAAC;IAC/B,IAAA,uBAAa,GAAE;IACf,IAAA,iBAAQ,EAAC,6CAAoB,CAAC;IAC9B,IAAA,mBAAU,EAAC,0BAA0B,CAAC;qCAGL,0BAAW;QACC,mDAAuB;QAC7B,uCAAiB;GAJ5C,sBAAsB,CA0GlC"}

package/dist/auth/decorators/api.key.scopes.decorator.d.ts

@@ -1,5 +1,9 @@
 export declare const API_KEY_SCOPES_KEY = "api_key_scopes";
 export declare const API_KEY_ANY_SCOPE_KEY = "api_key_any_scope";
+export declare const API_KEY_ROLES_KEY = "api_key_roles";
+export declare const API_KEY_PERMISSIONS_KEY = "api_key_permissions";
 export declare const ApiKeyScopes: (...scopes: string[]) => import("@nestjs/common").CustomDecorator<string>;
 export declare const ApiKeyAnyScope: () => import("@nestjs/common").CustomDecorator<string>;
+export declare const ApiKeyRoles: (...roles: string[]) => import("@nestjs/common").CustomDecorator<string>;
+export declare const ApiKeyPermissions: (...permissions: string[]) => import("@nestjs/common").CustomDecorator<string>;
 //# sourceMappingURL=api.key.scopes.decorator.d.ts.map

package/dist/auth/decorators/api.key.scopes.decorator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.key.scopes.decorator.d.ts","sourceRoot":"","sources":["../../../src/auth/decorators/api.key.scopes.decorator.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AACnD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AAQzD,eAAO,MAAM,YAAY,GAAI,GAAG,QAAQ,MAAM,EAAE,qDACP,CAAC;AAM1C,eAAO,MAAM,cAAc,wDAAiD,CAAC"}
+{"version":3,"file":"api.key.scopes.decorator.d.ts","sourceRoot":"","sources":["../../../src/auth/decorators/api.key.scopes.decorator.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,kBAAkB,mBAAmB,CAAC;AACnD,eAAO,MAAM,qBAAqB,sBAAsB,CAAC;AACzD,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AACjD,eAAO,MAAM,uBAAuB,wBAAwB,CAAC;AAQ7D,eAAO,MAAM,YAAY,GAAI,GAAG,QAAQ,MAAM,EAAE,qDACP,CAAC;AAM1C,eAAO,MAAM,cAAc,wDAAiD,CAAC;AAQ7E,eAAO,MAAM,WAAW,GAAI,GAAG,OAAO,MAAM,EAAE,qDACP,CAAC;AAOxC,eAAO,MAAM,iBAAiB,GAAI,GAAG,aAAa,MAAM,EAAE,qDACP,CAAC"}

package/dist/auth/decorators/api.key.scopes.decorator.js

@@ -1,11 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ApiKeyAnyScope = exports.ApiKeyScopes = exports.API_KEY_ANY_SCOPE_KEY = exports.API_KEY_SCOPES_KEY = void 0;
+exports.ApiKeyPermissions = exports.ApiKeyRoles = exports.ApiKeyAnyScope = exports.ApiKeyScopes = exports.API_KEY_PERMISSIONS_KEY = exports.API_KEY_ROLES_KEY = exports.API_KEY_ANY_SCOPE_KEY = exports.API_KEY_SCOPES_KEY = void 0;
 const common_1 = require("@nestjs/common");
 exports.API_KEY_SCOPES_KEY = 'api_key_scopes';
 exports.API_KEY_ANY_SCOPE_KEY = 'api_key_any_scope';
+exports.API_KEY_ROLES_KEY = 'api_key_roles';
+exports.API_KEY_PERMISSIONS_KEY = 'api_key_permissions';
 const ApiKeyScopes = (...scopes) => (0, common_1.SetMetadata)(exports.API_KEY_SCOPES_KEY, scopes);
 exports.ApiKeyScopes = ApiKeyScopes;
 const ApiKeyAnyScope = () => (0, common_1.SetMetadata)(exports.API_KEY_ANY_SCOPE_KEY, true);
 exports.ApiKeyAnyScope = ApiKeyAnyScope;
+const ApiKeyRoles = (...roles) => (0, common_1.SetMetadata)(exports.API_KEY_ROLES_KEY, roles);
+exports.ApiKeyRoles = ApiKeyRoles;
+const ApiKeyPermissions = (...permissions) => (0, common_1.SetMetadata)(exports.API_KEY_PERMISSIONS_KEY, permissions);
+exports.ApiKeyPermissions = ApiKeyPermissions;
 //# sourceMappingURL=api.key.scopes.decorator.js.map

package/dist/auth/decorators/api.key.scopes.decorator.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.key.scopes.decorator.js","sourceRoot":"","sources":["../../../src/auth/decorators/api.key.scopes.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAEhC,QAAA,kBAAkB,GAAG,gBAAgB,CAAC;AACtC,QAAA,qBAAqB,GAAG,mBAAmB,CAAC;AAQlD,MAAM,YAAY,GAAG,CAAC,GAAG,MAAgB,EAAE,EAAE,CAClD,IAAA,oBAAW,EAAC,0BAAkB,EAAE,MAAM,CAAC,CAAC;AAD7B,QAAA,YAAY,gBACiB;AAMnC,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,6BAAqB,EAAE,IAAI,CAAC,CAAC;AAAhE,QAAA,cAAc,kBAAkD"}
+{"version":3,"file":"api.key.scopes.decorator.js","sourceRoot":"","sources":["../../../src/auth/decorators/api.key.scopes.decorator.ts"],"names":[],"mappings":";;;AAAA,2CAA6C;AAEhC,QAAA,kBAAkB,GAAG,gBAAgB,CAAC;AACtC,QAAA,qBAAqB,GAAG,mBAAmB,CAAC;AAC5C,QAAA,iBAAiB,GAAG,eAAe,CAAC;AACpC,QAAA,uBAAuB,GAAG,qBAAqB,CAAC;AAQtD,MAAM,YAAY,GAAG,CAAC,GAAG,MAAgB,EAAE,EAAE,CAClD,IAAA,oBAAW,EAAC,0BAAkB,EAAE,MAAM,CAAC,CAAC;AAD7B,QAAA,YAAY,gBACiB;AAMnC,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,IAAA,oBAAW,EAAC,6BAAqB,EAAE,IAAI,CAAC,CAAC;AAAhE,QAAA,cAAc,kBAAkD;AAQtE,MAAM,WAAW,GAAG,CAAC,GAAG,KAAe,EAAE,EAAE,CAChD,IAAA,oBAAW,EAAC,yBAAiB,EAAE,KAAK,CAAC,CAAC;AAD3B,QAAA,WAAW,eACgB;AAOjC,MAAM,iBAAiB,GAAG,CAAC,GAAG,WAAqB,EAAE,EAAE,CAC5D,IAAA,oBAAW,EAAC,+BAAuB,EAAE,WAAW,CAAC,CAAC;AADvC,QAAA,iBAAiB,qBACsB"}

package/dist/auth/entities/api.key.role.entity.d.ts

@@ -0,0 +1,13 @@
+import { CommonAdminEntity } from '../../common/entities/common.admin.entity';
+import { AdminUserEntity } from './admin.user.entity';
+import { ApiKeyEntity } from './api.key.entity';
+import { SystemRoleEntity } from './system.role.entity';
+export declare class ApiKeyRoleEntity extends CommonAdminEntity {
+    api_key_id: string;
+    role_id: string;
+    revoked_by: string;
+    apiKey: ApiKeyEntity;
+    role: SystemRoleEntity;
+    revoker: AdminUserEntity;
+}
+//# sourceMappingURL=api.key.role.entity.d.ts.map

package/dist/auth/entities/api.key.role.entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.key.role.entity.d.ts","sourceRoot":"","sources":["../../../src/auth/entities/api.key.role.entity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD,qBACa,gBAAiB,SAAQ,iBAAiB;IAErD,UAAU,EAAE,MAAM,CAAC;IAGnB,OAAO,EAAE,MAAM,CAAC;IAGhB,UAAU,EAAE,MAAM,CAAC;IAInB,MAAM,EAAE,YAAY,CAAC;IAIrB,IAAI,EAAE,gBAAgB,CAAC;IAIvB,OAAO,EAAE,eAAe,CAAC;CAC1B"}

package/dist/auth/entities/api.key.role.entity.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyRoleEntity = void 0;
+const typeorm_1 = require("typeorm");
+const common_admin_entity_1 = require("../../common/entities/common.admin.entity");
+const admin_user_entity_1 = require("./admin.user.entity");
+const api_key_entity_1 = require("./api.key.entity");
+const system_role_entity_1 = require("./system.role.entity");
+let ApiKeyRoleEntity = class ApiKeyRoleEntity extends common_admin_entity_1.CommonAdminEntity {
+};
+exports.ApiKeyRoleEntity = ApiKeyRoleEntity;
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid' }),
+    __metadata("design:type", String)
+], ApiKeyRoleEntity.prototype, "api_key_id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid' }),
+    __metadata("design:type", String)
+], ApiKeyRoleEntity.prototype, "role_id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid', nullable: true }),
+    __metadata("design:type", String)
+], ApiKeyRoleEntity.prototype, "revoked_by", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => api_key_entity_1.ApiKeyEntity),
+    (0, typeorm_1.JoinColumn)({ name: 'api_key_id' }),
+    __metadata("design:type", api_key_entity_1.ApiKeyEntity)
+], ApiKeyRoleEntity.prototype, "apiKey", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => system_role_entity_1.SystemRoleEntity),
+    (0, typeorm_1.JoinColumn)({ name: 'role_id' }),
+    __metadata("design:type", system_role_entity_1.SystemRoleEntity)
+], ApiKeyRoleEntity.prototype, "role", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => admin_user_entity_1.AdminUserEntity),
+    (0, typeorm_1.JoinColumn)({ name: 'revoked_by' }),
+    __metadata("design:type", admin_user_entity_1.AdminUserEntity)
+], ApiKeyRoleEntity.prototype, "revoker", void 0);
+exports.ApiKeyRoleEntity = ApiKeyRoleEntity = __decorate([
+    (0, typeorm_1.Entity)({ name: 'sys_api_key_roles' })
+], ApiKeyRoleEntity);
+//# sourceMappingURL=api.key.role.entity.js.map

package/dist/auth/entities/api.key.role.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.key.role.entity.js","sourceRoot":"","sources":["../../../src/auth/entities/api.key.role.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAAgE;AAChE,mFAA8E;AAC9E,2DAAsD;AACtD,qDAAgD;AAChD,6DAAwD;AAIjD,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,uCAAiB;CAqBtD,CAAA;AArBY,4CAAgB;AAE3B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;oDACN;AAGnB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;iDACT;AAGhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oDACtB;AAInB;IAFC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,6BAAY,CAAC;IAC7B,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;8BAC3B,6BAAY;gDAAC;AAIrB;IAFC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,qCAAgB,CAAC;IACjC,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;8BAC1B,qCAAgB;8CAAC;AAIvB;IAFC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,mCAAe,CAAC;IAChC,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;8BAC1B,mCAAe;iDAAC;2BApBd,gBAAgB;IAD5B,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;GACzB,gBAAgB,CAqB5B"}

package/dist/auth/entities/permission.entity.d.ts

@@ -0,0 +1,10 @@
+import { CommonAdminEntity } from '../../common/entities/common.admin.entity';
+import { ScopeEntity } from './scope.entity';
+export declare class PermissionEntity extends CommonAdminEntity {
+    scope_id: string;
+    identifier: string;
+    name: string;
+    description: string;
+    scope: ScopeEntity;
+}
+//# sourceMappingURL=permission.entity.d.ts.map

package/dist/auth/entities/permission.entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.entity.d.ts","sourceRoot":"","sources":["../../../src/auth/entities/permission.entity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAG7C,qBACa,gBAAiB,SAAQ,iBAAiB;IAErD,QAAQ,EAAE,MAAM,CAAC;IAGjB,UAAU,EAAE,MAAM,CAAC;IAGnB,IAAI,EAAE,MAAM,CAAC;IAGb,WAAW,EAAE,MAAM,CAAC;IAIpB,KAAK,EAAE,WAAW,CAAC;CACpB"}

package/dist/auth/entities/permission.entity.js

@@ -0,0 +1,43 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionEntity = void 0;
+const typeorm_1 = require("typeorm");
+const common_admin_entity_1 = require("../../common/entities/common.admin.entity");
+const scope_entity_1 = require("./scope.entity");
+let PermissionEntity = class PermissionEntity extends common_admin_entity_1.CommonAdminEntity {
+};
+exports.PermissionEntity = PermissionEntity;
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid' }),
+    __metadata("design:type", String)
+], PermissionEntity.prototype, "scope_id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], PermissionEntity.prototype, "identifier", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'varchar' }),
+    __metadata("design:type", String)
+], PermissionEntity.prototype, "name", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', nullable: true }),
+    __metadata("design:type", String)
+], PermissionEntity.prototype, "description", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => scope_entity_1.ScopeEntity),
+    (0, typeorm_1.JoinColumn)({ name: 'scope_id' }),
+    __metadata("design:type", scope_entity_1.ScopeEntity)
+], PermissionEntity.prototype, "scope", void 0);
+exports.PermissionEntity = PermissionEntity = __decorate([
+    (0, typeorm_1.Entity)({ name: 'sys_permissions' })
+], PermissionEntity);
+//# sourceMappingURL=permission.entity.js.map

package/dist/auth/entities/permission.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.entity.js","sourceRoot":"","sources":["../../../src/auth/entities/permission.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAAgE;AAChE,mFAA8E;AAC9E,iDAA6C;AAItC,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,uCAAiB;CAgBtD,CAAA;AAhBY,4CAAgB;AAE3B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;kDACR;AAGjB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;oDACT;AAGnB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;8CACf;AAGb;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACrB;AAIpB;IAFC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC;IAC5B,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;8BAC1B,0BAAW;+CAAC;2BAfR,gBAAgB;IAD5B,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;GACvB,gBAAgB,CAgB5B"}

package/dist/auth/entities/role.permission.entity.d.ts

@@ -0,0 +1,10 @@
+import { CommonAdminEntity } from '../../common/entities/common.admin.entity';
+import { PermissionEntity } from './permission.entity';
+import { SystemRoleEntity } from './system.role.entity';
+export declare class RolePermissionEntity extends CommonAdminEntity {
+    role_id: string;
+    permission_id: string;
+    role: SystemRoleEntity;
+    permission: PermissionEntity;
+}
+//# sourceMappingURL=role.permission.entity.d.ts.map

package/dist/auth/entities/role.permission.entity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.permission.entity.d.ts","sourceRoot":"","sources":["../../../src/auth/entities/role.permission.entity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,2CAA2C,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD,qBACa,oBAAqB,SAAQ,iBAAiB;IAEzD,OAAO,EAAE,MAAM,CAAC;IAGhB,aAAa,EAAE,MAAM,CAAC;IAItB,IAAI,EAAE,gBAAgB,CAAC;IAIvB,UAAU,EAAE,gBAAgB,CAAC;CAC9B"}

package/dist/auth/entities/role.permission.entity.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RolePermissionEntity = void 0;
+const typeorm_1 = require("typeorm");
+const common_admin_entity_1 = require("../../common/entities/common.admin.entity");
+const permission_entity_1 = require("./permission.entity");
+const system_role_entity_1 = require("./system.role.entity");
+let RolePermissionEntity = class RolePermissionEntity extends common_admin_entity_1.CommonAdminEntity {
+};
+exports.RolePermissionEntity = RolePermissionEntity;
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid' }),
+    __metadata("design:type", String)
+], RolePermissionEntity.prototype, "role_id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid' }),
+    __metadata("design:type", String)
+], RolePermissionEntity.prototype, "permission_id", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => system_role_entity_1.SystemRoleEntity, (role) => role.rolePermissions),
+    (0, typeorm_1.JoinColumn)({ name: 'role_id' }),
+    __metadata("design:type", system_role_entity_1.SystemRoleEntity)
+], RolePermissionEntity.prototype, "role", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => permission_entity_1.PermissionEntity),
+    (0, typeorm_1.JoinColumn)({ name: 'permission_id' }),
+    __metadata("design:type", permission_entity_1.PermissionEntity)
+], RolePermissionEntity.prototype, "permission", void 0);
+exports.RolePermissionEntity = RolePermissionEntity = __decorate([
+    (0, typeorm_1.Entity)({ name: 'sys_role_permissions' })
+], RolePermissionEntity);
+//# sourceMappingURL=role.permission.entity.js.map

package/dist/auth/entities/role.permission.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.permission.entity.js","sourceRoot":"","sources":["../../../src/auth/entities/role.permission.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAAgE;AAChE,mFAA8E;AAC9E,2DAAuD;AACvD,6DAAwD;AAIjD,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,uCAAiB;CAc1D,CAAA;AAdY,oDAAoB;AAE/B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;qDACT;AAGhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;2DACH;AAItB;IAFC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,qCAAgB,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC;IACjE,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;8BAC1B,qCAAgB;kDAAC;AAIvB;IAFC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,oCAAgB,CAAC;IACjC,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;8BAC1B,oCAAgB;wDAAC;+BAblB,oBAAoB;IADhC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;GAC5B,oBAAoB,CAchC"}

package/dist/auth/entities/system.role.entity.d.ts

@@ -1,4 +1,6 @@
 import { RootEntity } from '../../common/entities/root.entity';
+import { RolePermissionEntity } from './role.permission.entity';
+import { ScopeEntity } from './scope.entity';
 import { UserRoleEntity } from './user.role.entity';
 export declare class SystemRoleEntity extends RootEntity {
     is_active: boolean;
@@ -6,6 +8,10 @@ export declare class SystemRoleEntity extends RootEntity {
     name: string;
     description: string;
     attributes: Record<string, any>;
+    scope_id: string;
+    priority: number;
     userRoles: UserRoleEntity[];
+    scope: ScopeEntity;
+    rolePermissions: RolePermissionEntity[];
 }
 //# sourceMappingURL=system.role.entity.d.ts.map

package/dist/auth/entities/system.role.entity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"system.role.entity.d.ts","sourceRoot":"","sources":["../../../src/auth/entities/system.role.entity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD,qBACa,gBAAiB,SAAQ,UAAU;IAE9C,SAAS,EAAE,OAAO,CAAC;IAGnB,UAAU,EAAE,MAAM,CAAC;IAGnB,IAAI,EAAE,MAAM,CAAC;IAGb,WAAW,EAAE,MAAM,CAAC;IAGpB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAIhC,SAAS,EAAE,cAAc,EAAE,CAAC;CAC7B"}
+{"version":3,"file":"system.role.entity.d.ts","sourceRoot":"","sources":["../../../src/auth/entities/system.role.entity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAE/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAOpD,qBACa,gBAAiB,SAAQ,UAAU;IAE9C,SAAS,EAAE,OAAO,CAAC;IAGnB,UAAU,EAAE,MAAM,CAAC;IAGnB,IAAI,EAAE,MAAM,CAAC;IAGb,WAAW,EAAE,MAAM,CAAC;IAGpB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAIhC,QAAQ,EAAE,MAAM,CAAC;IAGjB,QAAQ,EAAE,MAAM,CAAC;IAIjB,SAAS,EAAE,cAAc,EAAE,CAAC;IAI5B,KAAK,EAAE,WAAW,CAAC;IAGnB,eAAe,EAAE,oBAAoB,EAAE,CAAC;CACzC"}

package/dist/auth/entities/system.role.entity.js

@@ -12,6 +12,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SystemRoleEntity = void 0;
 const typeorm_1 = require("typeorm");
 const root_entity_1 = require("../../common/entities/root.entity");
+const role_default_enum_1 = require("../enums/role.default.enum");
+const role_permission_entity_1 = require("./role.permission.entity");
+const scope_entity_1 = require("./scope.entity");
 const user_role_entity_1 = require("./user.role.entity");
 let SystemRoleEntity = class SystemRoleEntity extends root_entity_1.RootEntity {
 };
@@ -36,10 +39,27 @@ __decorate([
     (0, typeorm_1.Column)({ type: 'jsonb' }),
     __metadata("design:type", Object)
 ], SystemRoleEntity.prototype, "attributes", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'uuid', nullable: true }),
+    __metadata("design:type", String)
+], SystemRoleEntity.prototype, "scope_id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'integer', default: role_default_enum_1.RoleDefault.PRIORITY }),
+    __metadata("design:type", Number)
+], SystemRoleEntity.prototype, "priority", void 0);
 __decorate([
     (0, typeorm_1.OneToMany)(() => user_role_entity_1.UserRoleEntity, (user) => user.role),
     __metadata("design:type", Array)
 ], SystemRoleEntity.prototype, "userRoles", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => scope_entity_1.ScopeEntity),
+    (0, typeorm_1.JoinColumn)({ name: 'scope_id' }),
+    __metadata("design:type", scope_entity_1.ScopeEntity)
+], SystemRoleEntity.prototype, "scope", void 0);
+__decorate([
+    (0, typeorm_1.OneToMany)(() => role_permission_entity_1.RolePermissionEntity, (grant) => grant.role),
+    __metadata("design:type", Array)
+], SystemRoleEntity.prototype, "rolePermissions", void 0);
 exports.SystemRoleEntity = SystemRoleEntity = __decorate([
     (0, typeorm_1.Entity)({ name: 'sys_roles' })
 ], SystemRoleEntity);

package/dist/auth/entities/system.role.entity.js.map

@@ -1 +1 @@
-{"version":3,"file":"system.role.entity.js","sourceRoot":"","sources":["../../../src/auth/entities/system.role.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAAoD;AACpD,mEAA+D;AAC/D,yDAAoD;AAI7C,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,wBAAU;CAmB/C,CAAA;AAnBY,4CAAgB;AAE3B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;mDACxB;AAGnB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;oDACT;AAGnB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;8CACf;AAGb;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;qDACL;AAGpB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;;oDACM;AAIhC;IADC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,iCAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;;mDACzB;2BAlBjB,gBAAgB;IAD5B,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;GACjB,gBAAgB,CAmB5B"}
+{"version":3,"file":"system.role.entity.js","sourceRoot":"","sources":["../../../src/auth/entities/system.role.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAA2E;AAC3E,mEAA+D;AAC/D,kEAAyD;AACzD,qEAAgE;AAChE,iDAA6C;AAC7C,yDAAoD;AAQ7C,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,wBAAU;CAiC/C,CAAA;AAjCY,4CAAgB;AAE3B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;mDACxB;AAGnB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;oDACT;AAGnB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;;8CACf;AAGb;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;qDACL;AAGpB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;;oDACM;AAIhC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDACxB;AAGjB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,+BAAW,CAAC,QAAQ,EAAE,CAAC;;kDAC1C;AAIjB;IADC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,iCAAc,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;;mDACzB;AAI5B;IAFC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC;IAC5B,IAAA,oBAAU,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;8BAC1B,0BAAW;+CAAC;AAGnB;IADC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,6CAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;;yDACrB;2BAhC7B,gBAAgB;IAD5B,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;GACjB,gBAAgB,CAiC5B"}

package/dist/auth/enums/role.default.enum.d.ts

@@ -0,0 +1,8 @@
+export declare enum RoleDefault {
+    PRIORITY = 100,
+    MAX_PRIORITY = 1000
+}
+export declare enum RoleSeedId {
+    GLOBAL_ADMIN = "00000000-0000-4000-8000-000000000001"
+}
+//# sourceMappingURL=role.default.enum.d.ts.map

package/dist/auth/enums/role.default.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.default.enum.d.ts","sourceRoot":"","sources":["../../../src/auth/enums/role.default.enum.ts"],"names":[],"mappings":"AACA,oBAAY,WAAW;IAErB,QAAQ,MAAM;IAEd,YAAY,OAAO;CACpB;AAGD,oBAAY,UAAU;IACpB,YAAY,yCAAyC;CACtD"}

package/dist/auth/enums/role.default.enum.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleSeedId = exports.RoleDefault = void 0;
+var RoleDefault;
+(function (RoleDefault) {
+    RoleDefault[RoleDefault["PRIORITY"] = 100] = "PRIORITY";
+    RoleDefault[RoleDefault["MAX_PRIORITY"] = 1000] = "MAX_PRIORITY";
+})(RoleDefault || (exports.RoleDefault = RoleDefault = {}));
+var RoleSeedId;
+(function (RoleSeedId) {
+    RoleSeedId["GLOBAL_ADMIN"] = "00000000-0000-4000-8000-000000000001";
+})(RoleSeedId || (exports.RoleSeedId = RoleSeedId = {}));
+//# sourceMappingURL=role.default.enum.js.map

package/dist/auth/enums/role.default.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.default.enum.js","sourceRoot":"","sources":["../../../src/auth/enums/role.default.enum.ts"],"names":[],"mappings":";;;AACA,IAAY,WAKX;AALD,WAAY,WAAW;IAErB,uDAAc,CAAA;IAEd,gEAAmB,CAAA;AACrB,CAAC,EALW,WAAW,2BAAX,WAAW,QAKtB;AAGD,IAAY,UAEX;AAFD,WAAY,UAAU;IACpB,mEAAqD,CAAA;AACvD,CAAC,EAFW,UAAU,0BAAV,UAAU,QAErB"}

package/dist/auth/enums/tenant.role.enum.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tenant.role.enum.d.ts","sourceRoot":"","sources":["../../../src/auth/enums/tenant.role.enum.ts"],"names":[],"mappings":"AAQA,oBAAY,UAAU;IAEpB,YAAY,iBAAiB;CAC9B"}
+{"version":3,"file":"tenant.role.enum.d.ts","sourceRoot":"","sources":["../../../src/auth/enums/tenant.role.enum.ts"],"names":[],"mappings":"AAOA,oBAAY,UAAU;IAEpB,YAAY,iBAAiB;CAC9B"}