@open-mercato/core 0.6.8-develop.6924.1.a8d208fcdc → 0.6.8-develop.6925.1.cefa200fa4

package/dist/modules/auth/commands/users.js

@@ -9,7 +9,7 @@ import {
 } from "@open-mercato/shared/lib/commands/helpers";
 import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
-import { UniqueConstraintViolationException } from "@mikro-orm/core";
+import { UniqueConstraintViolationException, LockMode } from "@mikro-orm/core";
 import { User, UserRole, Role, UserAcl, Session, PasswordReset } from "@open-mercato/core/modules/auth/data/entities";
 import { Organization } from "@open-mercato/core/modules/directory/data/entities";
 import { E } from "../../../generated/entities.ids.generated.js";
@@ -74,7 +74,8 @@ const updateSchema = z.object({
   name: displayNameSchema,
   password: passwordSchema.optional(),
   organizationId: z.string().uuid().optional(),
-  roles: z.array(z.string()).optional()
+  roles: z.array(z.string()).optional(),
+  isConfirmed: z.boolean().optional()
 });
 const userCrudEvents = {
   module: "auth",
@@ -256,6 +257,9 @@ const createUserCommand = {
     let removed = null;
     await withAtomicFlush(em, [
       async () => {
+        const current = await findOneWithDecryption(em, User, { id: userId, deletedAt: null }, {}, { tenantId: null, organizationId: null });
+        const floorTenantId = current?.tenantId ? String(current.tenantId) : snapshot?.tenantId ?? null;
+        await enforceProtectedRoleFloor(em, floorTenantId, userId, { deleting: true }, ctx);
         await em.nativeDelete(UserAcl, { user: userId });
         await em.nativeDelete(UserRole, { user: userId });
         await em.nativeDelete(Session, { user: userId });
@@ -280,7 +284,7 @@ const createUserCommand = {
           soft: false
         });
       }
-    ], { transaction: true });
+    ], { transaction: true, label: "auth.users.create.undo" });
     await emitCrudUndoSideEffects({
       dataEngine: de,
       action: "deleted",
@@ -425,6 +429,12 @@ const updateUserCommand = {
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(updateSchema, rawInput);
     const em = ctx.container.resolve("em");
+    const actorTenantScope = resolveActorTenantScope(ctx);
+    const existing = await findOneWithDecryption(em, User, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null });
+    if (!existing) throw new CrudHttpError(404, { error: "User not found" });
+    if (actorTenantScope && existing.tenantId && String(existing.tenantId) !== actorTenantScope) {
+      throw new CrudHttpError(404, { error: "User not found" });
+    }
     const rolesBefore = Array.isArray(parsed.roles) ? await loadUserRoleNames(em, parsed.id) : null;
     let tenantId;
     if (parsed.organizationId !== void 0) {
@@ -438,22 +448,9 @@ const updateUserCommand = {
       if (!organization) throw new CrudHttpError(400, { error: "Organization not found" });
       tenantId = organization.tenant?.id ? String(organization.tenant.id) : null;
     }
-    if (parsed.email !== void 0) {
-      const targetTenantId = tenantId !== void 0 ? tenantId : await resolveUserTenantId(em, parsed.id);
-      const duplicate = await findOneWithDecryption(
-        em,
-        User,
-        {
-          $or: [{ email: parsed.email }, { emailHash: { $in: emailHashLookupValues(parsed.email) } }],
-          deletedAt: null,
-          tenantId: targetTenantId,
-          id: { $ne: parsed.id }
-        },
-        {},
-        { tenantId: null, organizationId: null }
-      );
-      if (duplicate) await throwDuplicateEmailError();
-    }
+    const userTenantId = existing.tenantId ? String(existing.tenantId) : null;
+    const targetTenantId = tenantId !== void 0 ? tenantId : userTenantId;
+    const isTenantChanging = targetTenantId !== userTenantId;
     let hashed = null;
     let emailHash = null;
     if (parsed.password) {
@@ -463,49 +460,75 @@ const updateUserCommand = {
     if (parsed.email !== void 0) {
       emailHash = computeEmailHash(parsed.email);
     }
-    const actorTenantScope = resolveActorTenantScope(ctx);
     const updateWhere = { id: parsed.id, deletedAt: null };
     if (actorTenantScope) updateWhere.tenantId = actorTenantScope;
     const de = ctx.container.resolve("dataEngine");
     let user;
-    try {
-      user = await de.updateOrmEntity({
-        entity: User,
-        where: updateWhere,
-        apply: (entity) => {
-          if (parsed.email !== void 0) {
-            entity.email = parsed.email;
-            entity.emailHash = emailHash;
-          }
-          if (parsed.name !== void 0) {
-            entity.name = parsed.name;
-          }
-          if (parsed.organizationId !== void 0) {
-            entity.organizationId = parsed.organizationId;
-            entity.tenantId = tenantId ?? null;
-          }
-          if (hashed) entity.passwordHash = hashed;
+    await withAtomicFlush(em, [
+      async () => {
+        await enforceProtectedRoleFloor(em, userTenantId, parsed.id, {
+          deactivating: parsed.isConfirmed === false || isTenantChanging,
+          newRoles: parsed.roles
+        }, ctx);
+        if (parsed.email !== void 0) {
+          const duplicate = await findOneWithDecryption(
+            em,
+            User,
+            {
+              $or: [{ email: parsed.email }, { emailHash: { $in: emailHashLookupValues(parsed.email) } }],
+              deletedAt: null,
+              tenantId: targetTenantId,
+              id: { $ne: parsed.id }
+            },
+            {},
+            { tenantId: null, organizationId: null }
+          );
+          if (duplicate) await throwDuplicateEmailError();
         }
-      });
-    } catch (error) {
-      if (isUniqueViolation(error)) await throwDuplicateEmailError();
-      throw error;
-    }
-    if (!user) throw new CrudHttpError(404, { error: "User not found" });
-    if (hashed) {
-      await em.nativeDelete(Session, { user: parsed.id });
-    }
-    if (Array.isArray(parsed.roles)) {
-      await syncUserRoles(em, user, parsed.roles, user.tenantId ? String(user.tenantId) : tenantId ?? null);
-    }
-    await setCustomFieldsIfAny({
-      dataEngine: de,
-      entityId: E.auth.user,
-      recordId: String(user.id),
-      organizationId: user.organizationId ? String(user.organizationId) : null,
-      tenantId: user.tenantId ? String(user.tenantId) : tenantId ?? null,
-      values: custom
-    });
+        try {
+          const updated = await de.updateOrmEntity({
+            entity: User,
+            where: updateWhere,
+            apply: (entity) => {
+              if (parsed.email !== void 0) {
+                entity.email = parsed.email;
+                entity.emailHash = emailHash;
+              }
+              if (parsed.name !== void 0) {
+                entity.name = parsed.name;
+              }
+              if (parsed.organizationId !== void 0) {
+                entity.organizationId = parsed.organizationId;
+                entity.tenantId = tenantId ?? null;
+              }
+              if (parsed.isConfirmed !== void 0) {
+                entity.isConfirmed = parsed.isConfirmed;
+              }
+              if (hashed) entity.passwordHash = hashed;
+            }
+          });
+          if (updated) user = updated;
+        } catch (error) {
+          if (isUniqueViolation(error)) await throwDuplicateEmailError();
+          throw error;
+        }
+        if (!user) throw new CrudHttpError(404, { error: "User not found" });
+        if (hashed || parsed.isConfirmed === false) {
+          await em.nativeDelete(Session, { user: parsed.id });
+        }
+        if (Array.isArray(parsed.roles)) {
+          await syncUserRoles(em, user, parsed.roles, user.tenantId ? String(user.tenantId) : tenantId ?? null);
+        }
+        await setCustomFieldsIfAny({
+          dataEngine: de,
+          entityId: E.auth.user,
+          recordId: String(user.id),
+          organizationId: user.organizationId ? String(user.organizationId) : null,
+          tenantId: user.tenantId ? String(user.tenantId) : tenantId ?? null,
+          values: custom
+        });
+      }
+    ], { transaction: true });
     const identifiers = {
       id: String(user.id),
       organizationId: user.organizationId ? String(user.organizationId) : null,
@@ -588,22 +611,33 @@ const updateUserCommand = {
     const userId = before.id;
     const em = ctx.container.resolve("em");
     const de = ctx.container.resolve("dataEngine");
-    const updated = await de.updateOrmEntity({
-      entity: User,
-      where: { id: userId, deletedAt: null },
-      apply: (entity) => {
-        entity.email = before.email;
-        entity.organizationId = before.organizationId ?? null;
-        entity.tenantId = before.tenantId ?? null;
-        entity.passwordHash = before.passwordHash ?? null;
-        entity.name = before.name ?? null;
-        entity.isConfirmed = before.isConfirmed;
+    const restoredTenantId = before.tenantId ? String(before.tenantId) : null;
+    let updated = null;
+    await withAtomicFlush(em, [
+      async () => {
+        const current = await findOneWithDecryption(em, User, { id: userId, deletedAt: null }, {}, { tenantId: null, organizationId: null });
+        const currentTenantId = current?.tenantId ? String(current.tenantId) : null;
+        await enforceProtectedRoleFloor(em, currentTenantId, userId, {
+          deactivating: before.isConfirmed === false || restoredTenantId !== currentTenantId,
+          newRoles: before.roles
+        }, ctx);
+        updated = await de.updateOrmEntity({
+          entity: User,
+          where: { id: userId, deletedAt: null },
+          apply: (entity) => {
+            entity.email = before.email;
+            entity.organizationId = before.organizationId ?? null;
+            entity.tenantId = before.tenantId ?? null;
+            entity.passwordHash = before.passwordHash ?? null;
+            entity.name = before.name ?? null;
+            entity.isConfirmed = before.isConfirmed;
+          }
+        });
+        if (updated) {
+          await syncUserRoles(em, updated, before.roles, before.tenantId);
+        }
       }
-    });
-    if (updated) {
-      await syncUserRoles(em, updated, before.roles, before.tenantId);
-      await em.flush();
-    }
+    ], { transaction: true, label: "auth.users.update.undo" });
     const reset = buildCustomFieldResetMap(before.custom, after?.custom);
     if (Object.keys(reset).length) {
       await setCustomFieldsIfAny({
@@ -658,11 +692,18 @@ const deleteUserCommand = {
     const em = ctx.container.resolve("em");
     const de = ctx.container.resolve("dataEngine");
     const actorTenantScope = resolveActorTenantScope(ctx);
+    const existing = await findOneWithDecryption(em, User, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null });
+    if (!existing) throw new CrudHttpError(404, { error: "User not found" });
+    if (actorTenantScope && existing.tenantId && String(existing.tenantId) !== actorTenantScope) {
+      throw new CrudHttpError(404, { error: "User not found" });
+    }
     const deleteWhere = { id, deletedAt: null };
     if (actorTenantScope) deleteWhere.tenantId = actorTenantScope;
     let user;
     await withAtomicFlush(em, [
       async () => {
+        const userTenantId = existing.tenantId ? String(existing.tenantId) : null;
+        await enforceProtectedRoleFloor(em, userTenantId, id, { deleting: true }, ctx);
         await em.nativeDelete(UserAcl, { user: id });
         await em.nativeDelete(UserRole, { user: id });
         await em.nativeDelete(Session, { user: id });
@@ -913,10 +954,6 @@ function arrayEquals(left, right) {
   if (left.length !== right.length) return false;
   return left.every((value, idx) => value === right[idx]);
 }
-async function resolveUserTenantId(em, id) {
-  const existing = await findOneWithDecryption(em, User, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null });
-  return existing?.tenantId ? String(existing.tenantId) : null;
-}
 async function throwDuplicateEmailError() {
   const { translate } = await resolveTranslations();
   const message = translate("auth.users.errors.emailExists", "Email already in use");
@@ -926,6 +963,68 @@ async function throwDuplicateEmailError() {
     details: [{ path: ["email"], message, code: "duplicate", origin: "validation" }]
   });
 }
+function couldReduceActiveHolders(options) {
+  return options.deleting === true || options.deactivating === true || options.newRoles !== void 0;
+}
+async function enforceProtectedRoleFloor(em, tenantId, userId, options, ctx) {
+  if (ctx?.systemActor === true) return;
+  if (!couldReduceActiveHolders(options)) return;
+  const normalizedTenantId = normalizeTenantId(tenantId) ?? null;
+  if (!normalizedTenantId) return;
+  const protectedRoles = await findWithDecryption(em, Role, {
+    tenantId: normalizedTenantId,
+    minActiveHolders: { $gt: 0 },
+    deletedAt: null
+  }, {
+    lockMode: LockMode.PESSIMISTIC_WRITE,
+    orderBy: { id: "ASC" }
+  }, { tenantId: normalizedTenantId, organizationId: null });
+  if (protectedRoles.length === 0) return;
+  const { translate } = await resolveTranslations();
+  for (const role of protectedRoles) {
+    const minFloor = role.minActiveHolders ?? 0;
+    if (minFloor <= 0) continue;
+    const activeLinks = await findWithDecryption(em, UserRole, {
+      role: role.id,
+      deletedAt: null,
+      user: {
+        deletedAt: null,
+        isConfirmed: true,
+        tenantId: normalizedTenantId
+      }
+    }, {}, { tenantId: null, organizationId: null });
+    const activeUserIds = Array.from(
+      new Set(
+        activeLinks.map((link) => {
+          const userRef = link.user;
+          const linkedUserId = typeof userRef === "string" ? userRef : userRef?.id;
+          return linkedUserId ? String(linkedUserId) : null;
+        }).filter((id) => !!id)
+      )
+    );
+    if (activeUserIds.includes(userId)) {
+      let willStillBeActiveHolder = true;
+      if (options.deleting || options.deactivating) {
+        willStillBeActiveHolder = false;
+      } else if (options.newRoles !== void 0) {
+        const desiredUnique = Array.from(new Set(options.newRoles.map((r) => r.trim().toLowerCase()).filter(Boolean)));
+        const roleNameLower = role.name.toLowerCase();
+        const hasRoleByName = desiredUnique.includes(roleNameLower) || desiredUnique.includes(String(role.id).toLowerCase());
+        if (!hasRoleByName) {
+          willStillBeActiveHolder = false;
+        }
+      }
+      if (!willStillBeActiveHolder) {
+        const remaining = activeUserIds.length - 1;
+        if (remaining < minFloor) {
+          throw new CrudHttpError(400, {
+            error: translate("auth.users.errors.lastHolderOfCriticalRole", 'Cannot remove the last active holder of role "{roleName}"', { roleName: role.name })
+          });
+        }
+      }
+    }
+  }
+}
 export {
   userCrudEvents,
   userCrudIndexer