@openmdm/core 0.2.0 → 0.3.0

package/src/schema.ts

@@ -18,6 +18,15 @@
  * - mdm_rollbacks: Rollback operation history and status
  * - mdm_webhook_endpoints: Outbound webhook configuration
  * - mdm_webhook_deliveries: Webhook delivery history
+ * - mdm_tenants: Multi-tenant organization isolation
+ * - mdm_roles: RBAC role definitions
+ * - mdm_users: User accounts for authorization
+ * - mdm_user_roles: User-role mapping
+ * - mdm_audit_logs: Compliance and audit trail
+ * - mdm_scheduled_tasks: Scheduled task definitions
+ * - mdm_task_executions: Task execution history
+ * - mdm_message_queue: Persistent push message queue
+ * - mdm_plugin_storage: Plugin state persistence
  */
 
 // ============================================
@@ -456,6 +465,274 @@ export const mdmSchema: SchemaDefinition = {
         { columns: ['created_at'] },
       ],
     },
+
+    // ----------------------------------------
+    // Tenants Table (Multi-tenancy)
+    // ----------------------------------------
+    mdm_tenants: {
+      columns: {
+        id: { type: 'string', primaryKey: true },
+        name: { type: 'string' },
+        slug: { type: 'string', unique: true },
+        status: {
+          type: 'enum',
+          enumValues: ['active', 'suspended', 'pending'],
+          default: 'pending',
+        },
+        settings: { type: 'json', nullable: true },
+        metadata: { type: 'json', nullable: true },
+        created_at: { type: 'datetime', default: 'now' },
+        updated_at: { type: 'datetime', default: 'now' },
+      },
+      indexes: [
+        { columns: ['slug'], unique: true },
+        { columns: ['status'] },
+      ],
+    },
+
+    // ----------------------------------------
+    // Roles Table (RBAC)
+    // ----------------------------------------
+    mdm_roles: {
+      columns: {
+        id: { type: 'string', primaryKey: true },
+        tenant_id: {
+          type: 'string',
+          nullable: true,
+          references: { table: 'mdm_tenants', column: 'id', onDelete: 'cascade' },
+        },
+        name: { type: 'string' },
+        description: { type: 'text', nullable: true },
+        permissions: { type: 'json' },
+        is_system: { type: 'boolean', default: false },
+        created_at: { type: 'datetime', default: 'now' },
+        updated_at: { type: 'datetime', default: 'now' },
+      },
+      indexes: [
+        { columns: ['tenant_id'] },
+        { columns: ['name'] },
+        { columns: ['tenant_id', 'name'], unique: true },
+      ],
+    },
+
+    // ----------------------------------------
+    // Users Table (RBAC)
+    // ----------------------------------------
+    mdm_users: {
+      columns: {
+        id: { type: 'string', primaryKey: true },
+        tenant_id: {
+          type: 'string',
+          nullable: true,
+          references: { table: 'mdm_tenants', column: 'id', onDelete: 'cascade' },
+        },
+        email: { type: 'string' },
+        name: { type: 'string', nullable: true },
+        status: {
+          type: 'enum',
+          enumValues: ['active', 'inactive', 'pending'],
+          default: 'pending',
+        },
+        metadata: { type: 'json', nullable: true },
+        last_login_at: { type: 'datetime', nullable: true },
+        created_at: { type: 'datetime', default: 'now' },
+        updated_at: { type: 'datetime', default: 'now' },
+      },
+      indexes: [
+        { columns: ['tenant_id'] },
+        { columns: ['email'] },
+        { columns: ['tenant_id', 'email'], unique: true },
+        { columns: ['status'] },
+      ],
+    },
+
+    // ----------------------------------------
+    // User Roles (Many-to-Many)
+    // ----------------------------------------
+    mdm_user_roles: {
+      columns: {
+        user_id: {
+          type: 'string',
+          references: { table: 'mdm_users', column: 'id', onDelete: 'cascade' },
+        },
+        role_id: {
+          type: 'string',
+          references: { table: 'mdm_roles', column: 'id', onDelete: 'cascade' },
+        },
+        created_at: { type: 'datetime', default: 'now' },
+      },
+      indexes: [
+        { columns: ['user_id', 'role_id'], unique: true },
+        { columns: ['user_id'] },
+        { columns: ['role_id'] },
+      ],
+    },
+
+    // ----------------------------------------
+    // Audit Logs Table
+    // ----------------------------------------
+    mdm_audit_logs: {
+      columns: {
+        id: { type: 'string', primaryKey: true },
+        tenant_id: {
+          type: 'string',
+          nullable: true,
+          references: { table: 'mdm_tenants', column: 'id', onDelete: 'cascade' },
+        },
+        user_id: {
+          type: 'string',
+          nullable: true,
+          references: { table: 'mdm_users', column: 'id', onDelete: 'set null' },
+        },
+        action: { type: 'string' },
+        resource: { type: 'string' },
+        resource_id: { type: 'string', nullable: true },
+        details: { type: 'json', nullable: true },
+        ip_address: { type: 'string', nullable: true },
+        user_agent: { type: 'text', nullable: true },
+        created_at: { type: 'datetime', default: 'now' },
+      },
+      indexes: [
+        { columns: ['tenant_id'] },
+        { columns: ['user_id'] },
+        { columns: ['action'] },
+        { columns: ['resource'] },
+        { columns: ['resource', 'resource_id'] },
+        { columns: ['created_at'] },
+      ],
+    },
+
+    // ----------------------------------------
+    // Scheduled Tasks Table
+    // ----------------------------------------
+    mdm_scheduled_tasks: {
+      columns: {
+        id: { type: 'string', primaryKey: true },
+        tenant_id: {
+          type: 'string',
+          nullable: true,
+          references: { table: 'mdm_tenants', column: 'id', onDelete: 'cascade' },
+        },
+        name: { type: 'string' },
+        description: { type: 'text', nullable: true },
+        task_type: {
+          type: 'enum',
+          enumValues: ['command', 'policy_update', 'app_install', 'maintenance', 'custom'],
+        },
+        schedule: { type: 'json' },
+        target: { type: 'json', nullable: true },
+        payload: { type: 'json', nullable: true },
+        status: {
+          type: 'enum',
+          enumValues: ['active', 'paused', 'completed', 'failed'],
+          default: 'active',
+        },
+        next_run_at: { type: 'datetime', nullable: true },
+        last_run_at: { type: 'datetime', nullable: true },
+        max_retries: { type: 'integer', default: 3 },
+        retry_count: { type: 'integer', default: 0 },
+        created_at: { type: 'datetime', default: 'now' },
+        updated_at: { type: 'datetime', default: 'now' },
+      },
+      indexes: [
+        { columns: ['tenant_id'] },
+        { columns: ['task_type'] },
+        { columns: ['status'] },
+        { columns: ['next_run_at'] },
+      ],
+    },
+
+    // ----------------------------------------
+    // Task Executions Table
+    // ----------------------------------------
+    mdm_task_executions: {
+      columns: {
+        id: { type: 'string', primaryKey: true },
+        task_id: {
+          type: 'string',
+          references: { table: 'mdm_scheduled_tasks', column: 'id', onDelete: 'cascade' },
+        },
+        status: {
+          type: 'enum',
+          enumValues: ['running', 'completed', 'failed'],
+          default: 'running',
+        },
+        started_at: { type: 'datetime', default: 'now' },
+        completed_at: { type: 'datetime', nullable: true },
+        devices_processed: { type: 'integer', default: 0 },
+        devices_succeeded: { type: 'integer', default: 0 },
+        devices_failed: { type: 'integer', default: 0 },
+        error: { type: 'text', nullable: true },
+        details: { type: 'json', nullable: true },
+      },
+      indexes: [
+        { columns: ['task_id'] },
+        { columns: ['status'] },
+        { columns: ['started_at'] },
+      ],
+    },
+
+    // ----------------------------------------
+    // Message Queue Table
+    // ----------------------------------------
+    mdm_message_queue: {
+      columns: {
+        id: { type: 'string', primaryKey: true },
+        tenant_id: {
+          type: 'string',
+          nullable: true,
+          references: { table: 'mdm_tenants', column: 'id', onDelete: 'cascade' },
+        },
+        device_id: {
+          type: 'string',
+          references: { table: 'mdm_devices', column: 'id', onDelete: 'cascade' },
+        },
+        message_type: { type: 'string' },
+        payload: { type: 'json' },
+        priority: {
+          type: 'enum',
+          enumValues: ['high', 'normal', 'low'],
+          default: 'normal',
+        },
+        status: {
+          type: 'enum',
+          enumValues: ['pending', 'processing', 'delivered', 'failed', 'expired'],
+          default: 'pending',
+        },
+        attempts: { type: 'integer', default: 0 },
+        max_attempts: { type: 'integer', default: 3 },
+        last_attempt_at: { type: 'datetime', nullable: true },
+        last_error: { type: 'text', nullable: true },
+        expires_at: { type: 'datetime', nullable: true },
+        created_at: { type: 'datetime', default: 'now' },
+        updated_at: { type: 'datetime', default: 'now' },
+      },
+      indexes: [
+        { columns: ['tenant_id'] },
+        { columns: ['device_id'] },
+        { columns: ['status'] },
+        { columns: ['priority'] },
+        { columns: ['expires_at'] },
+        { columns: ['device_id', 'status', 'priority'] },
+      ],
+    },
+
+    // ----------------------------------------
+    // Plugin Storage Table
+    // ----------------------------------------
+    mdm_plugin_storage: {
+      columns: {
+        plugin_name: { type: 'string' },
+        key: { type: 'string' },
+        value: { type: 'json' },
+        created_at: { type: 'datetime', default: 'now' },
+        updated_at: { type: 'datetime', default: 'now' },
+      },
+      indexes: [
+        { columns: ['plugin_name', 'key'], unique: true },
+        { columns: ['plugin_name'] },
+      ],
+    },
   },
 };
 

package/src/tenant.ts

@@ -0,0 +1,237 @@
+/**
+ * OpenMDM Tenant Manager
+ *
+ * Provides multi-tenancy support for the MDM system.
+ * Enables organization isolation, tenant management, and resource quotas.
+ */
+
+import type {
+  Tenant,
+  TenantManager,
+  TenantFilter,
+  TenantListResult,
+  TenantStats,
+  CreateTenantInput,
+  UpdateTenantInput,
+  DatabaseAdapter,
+} from './types';
+import { TenantNotFoundError, ValidationError } from './types';
+
+/**
+ * Generate a unique ID for entities
+ */
+function generateId(): string {
+  return crypto.randomUUID();
+}
+
+/**
+ * Validate tenant slug format
+ */
+function validateSlug(slug: string): boolean {
+  // Slug must be lowercase alphanumeric with hyphens, 3-50 chars
+  const slugRegex = /^[a-z0-9][a-z0-9-]{1,48}[a-z0-9]$/;
+  return slugRegex.test(slug);
+}
+
+/**
+ * Create a TenantManager instance
+ */
+export function createTenantManager(db: DatabaseAdapter): TenantManager {
+  return {
+    async get(id: string): Promise<Tenant | null> {
+      if (!db.findTenant) {
+        throw new Error('Database adapter does not support tenant operations');
+      }
+      return db.findTenant(id);
+    },
+
+    async getBySlug(slug: string): Promise<Tenant | null> {
+      if (!db.findTenantBySlug) {
+        throw new Error('Database adapter does not support tenant operations');
+      }
+      return db.findTenantBySlug(slug);
+    },
+
+    async list(filter?: TenantFilter): Promise<TenantListResult> {
+      if (!db.listTenants) {
+        throw new Error('Database adapter does not support tenant operations');
+      }
+      return db.listTenants(filter);
+    },
+
+    async create(data: CreateTenantInput): Promise<Tenant> {
+      if (!db.createTenant || !db.findTenantBySlug) {
+        throw new Error('Database adapter does not support tenant operations');
+      }
+
+      // Validate slug format
+      if (!validateSlug(data.slug)) {
+        throw new ValidationError(
+          'Invalid slug format. Must be 3-50 lowercase alphanumeric characters with hyphens.',
+          { slug: data.slug }
+        );
+      }
+
+      // Check for duplicate slug
+      const existing = await db.findTenantBySlug(data.slug);
+      if (existing) {
+        throw new ValidationError(`Tenant with slug '${data.slug}' already exists`, {
+          slug: data.slug,
+        });
+      }
+
+      return db.createTenant({
+        ...data,
+        slug: data.slug.toLowerCase(),
+      });
+    },
+
+    async update(id: string, data: UpdateTenantInput): Promise<Tenant> {
+      if (!db.updateTenant || !db.findTenant || !db.findTenantBySlug) {
+        throw new Error('Database adapter does not support tenant operations');
+      }
+
+      const tenant = await db.findTenant(id);
+      if (!tenant) {
+        throw new TenantNotFoundError(id);
+      }
+
+      // Validate new slug if provided
+      if (data.slug) {
+        if (!validateSlug(data.slug)) {
+          throw new ValidationError(
+            'Invalid slug format. Must be 3-50 lowercase alphanumeric characters with hyphens.',
+            { slug: data.slug }
+          );
+        }
+
+        // Check for duplicate slug
+        const existing = await db.findTenantBySlug(data.slug);
+        if (existing && existing.id !== id) {
+          throw new ValidationError(`Tenant with slug '${data.slug}' already exists`, {
+            slug: data.slug,
+          });
+        }
+
+        data.slug = data.slug.toLowerCase();
+      }
+
+      return db.updateTenant(id, data);
+    },
+
+    async delete(id: string, cascade: boolean = false): Promise<void> {
+      if (!db.deleteTenant || !db.findTenant) {
+        throw new Error('Database adapter does not support tenant operations');
+      }
+
+      const tenant = await db.findTenant(id);
+      if (!tenant) {
+        throw new TenantNotFoundError(id);
+      }
+
+      // If cascade is true, the database adapter should handle
+      // deletion of all related resources (devices, policies, etc.)
+      // This is typically done via ON DELETE CASCADE in the schema
+
+      await db.deleteTenant(id);
+    },
+
+    async getStats(tenantId: string): Promise<TenantStats> {
+      if (!db.getTenantStats || !db.findTenant) {
+        throw new Error('Database adapter does not support tenant operations');
+      }
+
+      const tenant = await db.findTenant(tenantId);
+      if (!tenant) {
+        throw new TenantNotFoundError(tenantId);
+      }
+
+      return db.getTenantStats(tenantId);
+    },
+
+    async activate(id: string): Promise<Tenant> {
+      if (!db.updateTenant || !db.findTenant) {
+        throw new Error('Database adapter does not support tenant operations');
+      }
+
+      const tenant = await db.findTenant(id);
+      if (!tenant) {
+        throw new TenantNotFoundError(id);
+      }
+
+      if (tenant.status === 'active') {
+        return tenant;
+      }
+
+      return db.updateTenant(id, { status: 'active' });
+    },
+
+    async deactivate(id: string): Promise<Tenant> {
+      if (!db.updateTenant || !db.findTenant) {
+        throw new Error('Database adapter does not support tenant operations');
+      }
+
+      const tenant = await db.findTenant(id);
+      if (!tenant) {
+        throw new TenantNotFoundError(id);
+      }
+
+      if (tenant.status === 'suspended') {
+        return tenant;
+      }
+
+      return db.updateTenant(id, { status: 'suspended' });
+    },
+  };
+}
+
+/**
+ * Default system roles that can be used across tenants
+ */
+export const DEFAULT_SYSTEM_ROLES = {
+  SUPER_ADMIN: {
+    name: 'Super Admin',
+    description: 'Full system access across all tenants',
+    permissions: [{ action: '*' as const, resource: '*' as const }],
+    isSystem: true,
+  },
+  TENANT_ADMIN: {
+    name: 'Tenant Admin',
+    description: 'Full access within the tenant',
+    permissions: [
+      { action: 'manage' as const, resource: 'devices' as const },
+      { action: 'manage' as const, resource: 'policies' as const },
+      { action: 'manage' as const, resource: 'applications' as const },
+      { action: 'manage' as const, resource: 'commands' as const },
+      { action: 'manage' as const, resource: 'groups' as const },
+      { action: 'manage' as const, resource: 'users' as const },
+      { action: 'read' as const, resource: 'audit' as const },
+    ],
+    isSystem: true,
+  },
+  DEVICE_MANAGER: {
+    name: 'Device Manager',
+    description: 'Manage devices and send commands',
+    permissions: [
+      { action: 'manage' as const, resource: 'devices' as const },
+      { action: 'manage' as const, resource: 'commands' as const },
+      { action: 'read' as const, resource: 'policies' as const },
+      { action: 'read' as const, resource: 'groups' as const },
+    ],
+    isSystem: true,
+  },
+  VIEWER: {
+    name: 'Viewer',
+    description: 'Read-only access to all resources',
+    permissions: [
+      { action: 'read' as const, resource: 'devices' as const },
+      { action: 'read' as const, resource: 'policies' as const },
+      { action: 'read' as const, resource: 'applications' as const },
+      { action: 'read' as const, resource: 'commands' as const },
+      { action: 'read' as const, resource: 'groups' as const },
+    ],
+    isSystem: true,
+  },
+};
+
+export type SystemRoleName = keyof typeof DEFAULT_SYSTEM_ROLES;