@openhi/constructs 0.0.104 → 0.0.106

package/lib/pre-token-generation.handler.js

@@ -24,6 +24,9 @@ __export(pre_token_generation_handler_exports, {
 });
 module.exports = __toCommonJS(pre_token_generation_handler_exports);
 
+// src/data/operations/control/user/user-create-operation.ts
+var import_types2 = require("@openhi/types");
+
 // src/data/dynamo/dynamo-control-service.ts
 var import_electrodb8 = require("electrodb");
 
@@ -41,6 +44,9 @@ var dynamoClient = new import_client_dynamodb.DynamoDBClient({
 // src/data/dynamo/entities/control/configuration-entity.ts
 var import_electrodb = require("electrodb");
 
+// src/data/dynamo/entities/control/control-entity-common.ts
+var import_types = require("@openhi/types");
+
 // src/data/dynamo/shard.ts
 var SHARD_COUNT = 4;
 function computeShard(id) {
@@ -63,6 +69,29 @@ var gsi1ShardAttribute = {
     return String(computeShard(item.id));
   }
 };
+var gsi1skAttribute = {
+  type: "string",
+  watch: ["resource", "lastUpdated", "id"],
+  set: (_val, item) => {
+    const id = typeof item?.id === "string" ? item.id : "";
+    const lastUpdated = typeof item?.lastUpdated === "string" ? item.lastUpdated : "";
+    const fallback = `${lastUpdated}#${id}`;
+    if (typeof item?.resource !== "string" || item.resource.length === 0) {
+      return fallback;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(item.resource);
+    } catch {
+      return fallback;
+    }
+    if (!parsed || typeof parsed !== "object") return fallback;
+    const resourceType = parsed.resourceType;
+    if (typeof resourceType !== "string") return fallback;
+    const label = (0, import_types.extractLabel)(parsed);
+    return label !== void 0 ? `${label}#${id}` : fallback;
+  }
+};
 
 // src/data/dynamo/entities/control/configuration-entity.ts
 var ConfigurationEntity = new import_electrodb.Entity({
@@ -168,8 +197,9 @@ var ConfigurationEntity = new import_electrodb.Entity({
      * (workspaceId = "-") or "list configs scoped to this workspace". Does not support
      * hierarchical resolution in one query; use base table GetItem in fallback order
      * (user → workspace → tenant → baseline) for that.
-     * SK is `<ISO-8601 lastUpdated>#<id>` (control-plane unlabeled per DR-004).
-     * `casing: "none"` on the SK preserves ISO-8601 `T`/`Z`.
+     * SK is `<key>#<id>` — Configuration's `key` is a required entity attribute (the
+     * config category: endpoints, branding, display, …) and the natural sort/lookup
+     * dimension. `casing: "none"` preserves the literal key value.
      */
     gsi1: {
       index: "GSI1",
@@ -181,8 +211,8 @@ var ConfigurationEntity = new import_electrodb.Entity({
       sk: {
         field: "GSI1SK",
         casing: "none",
-        composite: ["lastUpdated", "id"],
-        template: "${lastUpdated}#${id}"
+        composite: ["key", "id"],
+        template: "${key}#${id}"
       }
     }
   }
@@ -236,6 +266,8 @@ var MembershipEntity = new import_electrodb2.Entity({
       required: true
     },
     gsi1Shard: gsi1ShardAttribute,
+    /** Derived GSI1 sort key — name-based when extractable; else `<lastUpdated>#<id>`. */
+    gsi1sk: gsi1skAttribute,
     deleted: {
       type: "boolean",
       required: false
@@ -266,8 +298,9 @@ var MembershipEntity = new import_electrodb2.Entity({
     /**
      * GSI1 — Unified Sharded List per ADR-011: list all Memberships for a tenant across the
      * four shards. Membership is tenant-scoped only, so `WID#-` is a sentinel.
-     * SK is `<ISO-8601 lastUpdated>#<id>` (control-plane unlabeled per DR-004).
-     * `casing: "none"` on the SK preserves ISO-8601 `T`/`Z`.
+     * SK is derived via `gsi1skAttribute` — uses the resource's natural label when
+     * extractable, else `<lastUpdated>#<id>` (DR-004). `casing: "none"` preserves the
+     * normalized label and ISO-8601 `T`/`Z`.
      */
     gsi1: {
       index: "GSI1",
@@ -279,8 +312,8 @@ var MembershipEntity = new import_electrodb2.Entity({
       sk: {
         field: "GSI1SK",
         casing: "none",
-        composite: ["lastUpdated", "id"],
-        template: "${lastUpdated}#${id}"
+        composite: ["gsi1sk"],
+        template: "${gsi1sk}"
       }
     }
   }
@@ -329,6 +362,8 @@ var RoleEntity = new import_electrodb3.Entity({
       required: true
     },
     gsi1Shard: gsi1ShardAttribute,
+    /** Derived GSI1 sort key — name-based when extractable; else `<lastUpdated>#<id>`. */
+    gsi1sk: gsi1skAttribute,
     deleted: {
       type: "boolean",
       required: false
@@ -359,8 +394,9 @@ var RoleEntity = new import_electrodb3.Entity({
     /**
      * GSI1 — Unified Sharded List per ADR-011: list all Roles across the four shards.
      * Non-tenant-isolated, so `TID#-#WID#-` sentinels precede `RT#Role#SHARD#<n>`.
-     * SK is `<ISO-8601 lastUpdated>#<id>` (control-plane unlabeled per DR-004).
-     * `casing: "none"` on the SK preserves ISO-8601 `T`/`Z`.
+     * SK is derived via `gsi1skAttribute` — uses the resource's natural label when
+     * extractable, else `<lastUpdated>#<id>` (DR-004). `casing: "none"` preserves the
+     * normalized label and ISO-8601 `T`/`Z`.
      */
     gsi1: {
       index: "GSI1",
@@ -372,8 +408,8 @@ var RoleEntity = new import_electrodb3.Entity({
       sk: {
         field: "GSI1SK",
         casing: "none",
-        composite: ["lastUpdated", "id"],
-        template: "${lastUpdated}#${id}"
+        composite: ["gsi1sk"],
+        template: "${gsi1sk}"
       }
     }
   }
@@ -427,6 +463,8 @@ var RoleAssignmentEntity = new import_electrodb4.Entity({
       required: true
     },
     gsi1Shard: gsi1ShardAttribute,
+    /** Derived GSI1 sort key — name-based when extractable; else `<lastUpdated>#<id>`. */
+    gsi1sk: gsi1skAttribute,
     deleted: {
       type: "boolean",
       required: false
@@ -457,8 +495,9 @@ var RoleAssignmentEntity = new import_electrodb4.Entity({
     /**
      * GSI1 — Unified Sharded List per ADR-011: list all RoleAssignments for a tenant across the
      * four shards. Tenant-scoped only, so `WID#-` is a sentinel.
-     * SK is `<ISO-8601 lastUpdated>#<id>` (control-plane unlabeled per DR-004).
-     * `casing: "none"` on the SK preserves ISO-8601 `T`/`Z`.
+     * SK is derived via `gsi1skAttribute` — uses the resource's natural label when
+     * extractable, else `<lastUpdated>#<id>` (DR-004). `casing: "none"` preserves the
+     * normalized label and ISO-8601 `T`/`Z`.
      */
     gsi1: {
       index: "GSI1",
@@ -470,8 +509,8 @@ var RoleAssignmentEntity = new import_electrodb4.Entity({
       sk: {
         field: "GSI1SK",
         casing: "none",
-        composite: ["lastUpdated", "id"],
-        template: "${lastUpdated}#${id}"
+        composite: ["gsi1sk"],
+        template: "${gsi1sk}"
       }
     }
   }
@@ -525,6 +564,8 @@ var TenantEntity = new import_electrodb5.Entity({
       required: true
     },
     gsi1Shard: gsi1ShardAttribute,
+    /** Derived GSI1 sort key — name-based when extractable; else `<lastUpdated>#<id>`. */
+    gsi1sk: gsi1skAttribute,
     deleted: {
       type: "boolean",
       required: false
@@ -555,8 +596,9 @@ var TenantEntity = new import_electrodb5.Entity({
     /**
      * GSI1 — Unified Sharded List per ADR-011: list all Tenants across the four shards.
      * Tenant lives at the platform tier (no parent tenant or workspace), so `TID#-#WID#-`
-     * sentinels precede `RT#Tenant#SHARD#<n>`. SK is `<ISO-8601 lastUpdated>#<id>` (control-plane
-     * unlabeled per DR-004). `casing: "none"` on the SK preserves ISO-8601 `T`/`Z`.
+     * sentinels precede `RT#Tenant#SHARD#<n>`. SK is derived via `gsi1skAttribute` —
+     * `<normalizedName>#<id>` when the resource carries a `name`, else `<lastUpdated>#<id>`
+     * (DR-004). `casing: "none"` preserves the normalized label and ISO-8601 `T`/`Z`.
      */
     gsi1: {
       index: "GSI1",
@@ -568,8 +610,8 @@ var TenantEntity = new import_electrodb5.Entity({
       sk: {
         field: "GSI1SK",
         casing: "none",
-        composite: ["lastUpdated", "id"],
-        template: "${lastUpdated}#${id}"
+        composite: ["gsi1sk"],
+        template: "${gsi1sk}"
       }
     }
   }
@@ -626,6 +668,8 @@ var UserEntity = new import_electrodb6.Entity({
       required: true
     },
     gsi1Shard: gsi1ShardAttribute,
+    /** Derived GSI1 sort key — name-based when extractable; else `<lastUpdated>#<id>`. */
+    gsi1sk: gsi1skAttribute,
     deleted: {
       type: "boolean",
       required: false
@@ -656,8 +700,9 @@ var UserEntity = new import_electrodb6.Entity({
     /**
      * GSI1 — Unified Sharded List per ADR-011: list all Users across the four shards.
      * Non-tenant-isolated, so `TID#-#WID#-` sentinels precede `RT#User#SHARD#<n>`.
-     * SK is `<ISO-8601 lastUpdated>#<id>` (control-plane unlabeled per DR-004).
-     * `casing: "none"` on the SK preserves ISO-8601 `T`/`Z` characters.
+     * SK is derived via `gsi1skAttribute` — uses the resource's natural label when
+     * extractable (string `name`/`title` via introspection), else `<lastUpdated>#<id>`
+     * (DR-004). `casing: "none"` preserves the normalized label and ISO-8601 `T`/`Z`.
      */
     gsi1: {
       index: "GSI1",
@@ -669,8 +714,8 @@ var UserEntity = new import_electrodb6.Entity({
       sk: {
         field: "GSI1SK",
         casing: "none",
-        composite: ["lastUpdated", "id"],
-        template: "${lastUpdated}#${id}"
+        composite: ["gsi1sk"],
+        template: "${gsi1sk}"
       }
     },
     /**
@@ -745,6 +790,8 @@ var WorkspaceEntity = new import_electrodb7.Entity({
       required: true
     },
     gsi1Shard: gsi1ShardAttribute,
+    /** Derived GSI1 sort key — name-based when extractable; else `<lastUpdated>#<id>`. */
+    gsi1sk: gsi1skAttribute,
     deleted: {
       type: "boolean",
       required: false
@@ -775,8 +822,9 @@ var WorkspaceEntity = new import_electrodb7.Entity({
     /**
      * GSI1 — Unified Sharded List per ADR-011: list all Workspaces for a tenant across the
      * four shards. Workspace is itself the workspace identity, so `WID#-` is a sentinel.
-     * SK is `<ISO-8601 lastUpdated>#<id>` (control-plane unlabeled per DR-004).
-     * `casing: "none"` on the SK preserves ISO-8601 `T`/`Z`.
+     * SK is derived via `gsi1skAttribute` — `<normalizedName>#<id>` when the resource
+     * carries a `name`, else `<lastUpdated>#<id>` (DR-004). `casing: "none"` preserves
+     * the normalized label and ISO-8601 `T`/`Z`.
      */
     gsi1: {
       index: "GSI1",
@@ -788,8 +836,8 @@ var WorkspaceEntity = new import_electrodb7.Entity({
       sk: {
         field: "GSI1SK",
         casing: "none",
-        composite: ["lastUpdated", "id"],
-        template: "${lastUpdated}#${id}"
+        composite: ["gsi1sk"],
+        template: "${gsi1sk}"
       }
     }
   }
@@ -823,31 +871,15 @@ function getDynamoControlService(tableName) {
   };
 }
 
-// src/components/cognito/pre-token-generation.handler.ts
-var REFERENCE_TYPES = {
-  Tenant: "Tenant/",
-  Workspace: "Workspace/"
-};
-function idFromReference(reference, prefix) {
-  if (!reference || !reference.startsWith(prefix)) return void 0;
-  const id = reference.slice(prefix.length);
-  return id.length > 0 ? id : void 0;
-}
-function displayNameFor(user) {
-  const first = user.name?.[0];
-  return first?.text ?? first?.family ?? user.displayName ?? void 0;
-}
-function safeParseUser(json) {
-  try {
-    return JSON.parse(json);
-  } catch {
-    return void 0;
-  }
-}
-async function findUserBySub(service, cognitoSub) {
+// src/data/operations/control/user/user-find-by-sub-operation.ts
+async function findUserBySubOperation(params) {
+  const { cognitoSub, tableName } = params;
+  const service = getDynamoControlService(tableName);
   const result = await service.entities.user.query.gsi2({ cognitoSub }).go({ limit: 1 });
   const item = result.data?.[0];
-  if (!item) return void 0;
+  if (!item) {
+    return void 0;
+  }
   return {
     id: item.id,
     cognitoSub: item.cognitoSub,
@@ -855,16 +887,64 @@ async function findUserBySub(service, cognitoSub) {
     vid: item.vid
   };
 }
+
+// src/data/operations/data-operations-common.ts
+var import_types3 = require("@openhi/types");
+
+// src/lib/compression.ts
+var import_node_zlib = require("zlib");
+
+// src/data/operations/control/user/user-update-operation.ts
+var import_types4 = require("@openhi/types");
+
+// src/data/operations/control/user/user-resource-helpers.ts
+function parseUserResource(resource) {
+  try {
+    return JSON.parse(resource);
+  } catch {
+    return void 0;
+  }
+}
+
+// src/data/operations/fhir-reference.ts
+function idFromReference(reference, prefix) {
+  if (!reference || !reference.startsWith(prefix)) {
+    return void 0;
+  }
+  const id = reference.slice(prefix.length);
+  return id.length > 0 ? id : void 0;
+}
+
+// src/components/cognito/pre-token-generation.handler.ts
+var REFERENCE_TYPES = {
+  Tenant: "Tenant/",
+  Workspace: "Workspace/"
+};
+function displayNameFor(user) {
+  const names = user.name;
+  const first = names?.[0];
+  return first?.text ?? first?.family ?? void 0;
+}
+var lookupContext = {
+  tenantId: "",
+  workspaceId: "",
+  date: "",
+  actorId: "",
+  actorName: "",
+  actorType: "internal-system"
+};
 async function resolveClaims(cognitoSub) {
-  const service = getDynamoControlService();
-  const user = await findUserBySub(service, cognitoSub);
+  const user = await findUserBySubOperation({
+    context: lookupContext,
+    cognitoSub
+  });
   if (!user) {
     console.warn(
       `PreTokenGeneration: no User found for cognitoSub; emitting token without OpenHI claims (sub=${cognitoSub})`
     );
     return void 0;
   }
-  const parsed = safeParseUser(user.resource);
+  const parsed = parseUserResource(user.resource);
   if (!parsed) {
     console.warn(
       `PreTokenGeneration: User resource JSON could not be parsed (sub=${cognitoSub}, id=${user.id})`
@@ -882,7 +962,7 @@ async function resolveClaims(cognitoSub) {
   const displayName = displayNameFor(parsed);
   if (!tenantId || !workspaceId || !displayName) {
     console.warn(
-      `PreTokenGeneration: resolved User missing currentTenant/currentWorkspace/displayName; emitting token without OpenHI claims (sub=${cognitoSub}, id=${user.id})`
+      `PreTokenGeneration: resolved User missing currentTenant/currentWorkspace/name; emitting token without OpenHI claims (sub=${cognitoSub}, id=${user.id})`
     );
     return void 0;
   }