@openora/core 0.4.0

package/dist/iam/drizzle/migrations/meta/0000_snapshot.json

@@ -0,0 +1,377 @@
+{
+  "id": "28077ace-125b-4e04-9ba3-d03ea55ff67d",
+  "prevId": "00000000-0000-0000-0000-000000000000",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.admin_invitation": {
+      "name": "admin_invitation",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role_id": {
+          "name": "role_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "invitation_status",
+          "typeSchema": "public",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accepted_at": {
+          "name": "accepted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "admin_invitation_token_idx": {
+          "name": "admin_invitation_token_idx",
+          "columns": [
+            {
+              "expression": "token",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "admin_invitation_role_id_admin_role_id_fk": {
+          "name": "admin_invitation_role_id_admin_role_id_fk",
+          "tableFrom": "admin_invitation",
+          "tableTo": "admin_role",
+          "columnsFrom": ["role_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "admin_invitation_token_unique": {
+          "name": "admin_invitation_token_unique",
+          "nullsNotDistinct": false,
+          "columns": ["token"]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.admin_role": {
+      "name": "admin_role",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_system": {
+          "name": "is_system",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "is_super_admin": {
+          "name": "is_super_admin",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "admin_role_key_uq": {
+          "name": "admin_role_key_uq",
+          "columns": [
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.admin_role_assignment": {
+      "name": "admin_role_assignment",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role_id": {
+          "name": "role_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "admin_role_assignment_user_id_idx": {
+          "name": "admin_role_assignment_user_id_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "admin_role_assignment_uq": {
+          "name": "admin_role_assignment_uq",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "role_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "admin_role_assignment_role_id_admin_role_id_fk": {
+          "name": "admin_role_assignment_role_id_admin_role_id_fk",
+          "tableFrom": "admin_role_assignment",
+          "tableTo": "admin_role",
+          "columnsFrom": ["role_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.admin_role_permission": {
+      "name": "admin_role_permission",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "role_id": {
+          "name": "role_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource": {
+          "name": "resource",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'no_access'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "admin_role_permission_role_id_idx": {
+          "name": "admin_role_permission_role_id_idx",
+          "columns": [
+            {
+              "expression": "role_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "admin_role_permission_role_resource_uq": {
+          "name": "admin_role_permission_role_resource_uq",
+          "columns": [
+            {
+              "expression": "role_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "admin_role_permission_role_id_admin_role_id_fk": {
+          "name": "admin_role_permission_role_id_admin_role_id_fk",
+          "tableFrom": "admin_role_permission",
+          "tableTo": "admin_role",
+          "columnsFrom": ["role_id"],
+          "columnsTo": ["id"],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {
+    "public.invitation_status": {
+      "name": "invitation_status",
+      "schema": "public",
+      "values": ["pending", "accepted", "revoked"]
+    }
+  },
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}

package/dist/iam/drizzle/migrations/meta/_journal.json

@@ -0,0 +1,13 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1783555225068,
+      "tag": "0000_peaceful_thor",
+      "breakpoints": true
+    }
+  ]
+}

package/dist/iam/drizzle.config.d.ts

@@ -0,0 +1,4 @@
+import 'dotenv/config';
+declare const _default: import("drizzle-kit").Config;
+export default _default;
+//# sourceMappingURL=drizzle.config.d.ts.map

package/dist/iam/drizzle.config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"drizzle.config.d.ts","sourceRoot":"","sources":["../../src/iam/drizzle.config.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;;AAMvB,wBAeG"}

package/dist/iam/drizzle.config.js

@@ -0,0 +1,21 @@
+import 'dotenv/config';
+import { defineConfig } from 'drizzle-kit';
+// Own migration history + tracking table, co-located with the module's schema.
+// One DB shared with sibling modules, but one journal per module so a module can
+// be extracted to its own package without history surgery. See ADR-0020/0027.
+export default defineConfig({
+    dialect: 'postgresql',
+    casing: 'snake_case',
+    schema: ['./schema/index.ts'],
+    out: './drizzle/migrations',
+    migrations: {
+        table: '__drizzle_migrations_iam',
+        schema: 'drizzle',
+    },
+    dbCredentials: {
+        url: process.env['DATABASE_ADMIN_URL'] ??
+            process.env['DATABASE_URL'] ??
+            'postgresql://postgres:postgres@localhost:5432/oss_igaming',
+    },
+});
+//# sourceMappingURL=drizzle.config.js.map

package/dist/iam/drizzle.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"drizzle.config.js","sourceRoot":"","sources":["../../src/iam/drizzle.config.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,CAAC;AACvB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,+EAA+E;AAC/E,iFAAiF;AACjF,8EAA8E;AAC9E,eAAe,YAAY,CAAC;IAC1B,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,YAAY;IACpB,MAAM,EAAE,CAAC,mBAAmB,CAAC;IAC7B,GAAG,EAAE,sBAAsB;IAC3B,UAAU,EAAE;QACV,KAAK,EAAE,0BAA0B;QACjC,MAAM,EAAE,SAAS;KAClB;IACD,aAAa,EAAE;QACb,GAAG,EACD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACjC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YAC3B,2DAA2D;KAC9D;CACF,CAAC,CAAC"}

package/dist/iam/index.d.ts

@@ -0,0 +1,2 @@
+export * from './contract/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/iam/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/iam/index.ts"],"names":[],"mappings":"AAEA,cAAc,qBAAqB,CAAC"}

package/dist/iam/index.js

@@ -0,0 +1,4 @@
+// The public consumer surface: the domain's wire contract (schemas, enum triples, types).
+// Isomorphic - safe in the browser. Server wiring lives in './server', tables in './schema'.
+export * from './contract/index.js';
+//# sourceMappingURL=index.js.map

package/dist/iam/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/iam/index.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,6FAA6F;AAC7F,cAAc,qBAAqB,CAAC"}

package/dist/iam/migrate.d.ts

@@ -0,0 +1,3 @@
+/** Apply the iam module migrations (idempotent: drizzle skips already-recorded ones). */
+export declare function migrate(databaseUrl?: string): Promise<void>;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/iam/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/iam/migrate.ts"],"names":[],"mappings":"AAMA,yFAAyF;AACzF,wBAAgB,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,iBAO3C"}

package/dist/iam/migrate.js

@@ -0,0 +1,15 @@
+// Applies this module's own migration set against its own tracking table, so it
+// never collides with sibling modules that share the database. SQL ships in the
+// tarball ('files') and loads via an import.meta.url-relative path. See ADR-0020/0027.
+import { fileURLToPath } from 'node:url';
+import { runMigrations } from '@openora/core/server/migrate';
+/** Apply the iam module migrations (idempotent: drizzle skips already-recorded ones). */
+export function migrate(databaseUrl) {
+    return runMigrations({
+        migrationsFolder: fileURLToPath(new URL('./drizzle/migrations', import.meta.url)),
+        migrationsTable: '__drizzle_migrations_iam',
+        migrationsSchema: 'drizzle',
+        ...(databaseUrl ? { databaseUrl } : {}),
+    });
+}
+//# sourceMappingURL=migrate.js.map

package/dist/iam/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/iam/migrate.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,gFAAgF;AAChF,uFAAuF;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,yFAAyF;AACzF,MAAM,UAAU,OAAO,CAAC,WAAoB;IAC1C,OAAO,aAAa,CAAC;QACnB,gBAAgB,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjF,eAAe,EAAE,0BAA0B;QAC3C,gBAAgB,EAAE,SAAS;QAC3B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAC;AACL,CAAC"}

package/dist/iam/plugin.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@openora/core/server").Plugin;
+export default _default;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/iam/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../src/iam/plugin.ts"],"names":[],"mappings":";AAaA,wBAmDG"}

package/dist/iam/plugin.js

@@ -0,0 +1,45 @@
+import { definePlugin, EVENT_BUS, DRIZZLE, ADMIN_GUARD, createLogger } from '@openora/core/server';
+import { ADMIN_PERMISSION_RESOLVER, SEND_EMAIL, SESSION_COMMANDS, CACHE, domainEventSchemas, } from '@openora/core/contracts';
+import { IamService, DbAdminPermissionResolver } from './service/iam.service.js';
+import { createIamRouter } from './router/index.js';
+const logger = createLogger('iam');
+export default definePlugin({
+    id: 'iam',
+    dependsOn: ['identity'],
+    register(ctx) {
+        // Captured from the provider factory so the event handlers below purge the SAME
+        // singleton the AdminGuard reads (Container memoizes per token). Null until the
+        // first admin request resolves it - but grant-mutation events only fire on admin
+        // routes, which resolve it first, so it is always set by the time one arrives.
+        let resolverRef = null;
+        // Tenant is resolved per request inside getGrants(), never captured at boot
+        // (factories run once outside any request ALS frame).
+        ctx.provide(ADMIN_PERMISSION_RESOLVER, (c) => {
+            resolverRef = new DbAdminPermissionResolver(c.get(DRIZZLE), c.has(CACHE) ? c.get(CACHE) : undefined);
+            return resolverRef;
+        });
+        // Purge the grant cache the instant a grant changes so a revoked admin loses access
+        // immediately instead of waiting out the TTL. assign/revoke are user-keyed (one key);
+        // a role's permission change fans out to every holder (resolved in invalidateRole).
+        for (const event of ['iam.role.assigned', 'iam.role.revoked']) {
+            ctx.events.on(event, (payload) => {
+                const parsed = domainEventSchemas[event].safeParse(payload);
+                if (!parsed.success || !resolverRef)
+                    return;
+                resolverRef
+                    .invalidateUser(parsed.data.userId)
+                    .catch((err) => logger.error({ err }, 'grant cache purge failed'));
+            });
+        }
+        ctx.events.on('iam.role.permissions.changed', (payload) => {
+            const parsed = domainEventSchemas['iam.role.permissions.changed'].safeParse(payload);
+            if (!parsed.success || !resolverRef)
+                return;
+            resolverRef
+                .invalidateRole(parsed.data.roleId)
+                .catch((err) => logger.error({ err }, 'grant cache purge failed'));
+        });
+        ctx.routers.add('iam', (c) => createIamRouter(new IamService(c.get(DRIZZLE), c.get(EVENT_BUS), c.get(SEND_EMAIL), c.get(SESSION_COMMANDS)), c.get(ADMIN_GUARD)));
+    },
+});
+//# sourceMappingURL=plugin.js.map

package/dist/iam/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/iam/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnG,OAAO,EACL,yBAAyB,EACzB,UAAU,EACV,gBAAgB,EAChB,KAAK,EACL,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;AAEnC,eAAe,YAAY,CAAC;IAC1B,EAAE,EAAE,KAAK;IACT,SAAS,EAAE,CAAC,UAAU,CAAC;IACvB,QAAQ,CAAC,GAAG;QACV,gFAAgF;QAChF,gFAAgF;QAChF,iFAAiF;QACjF,+EAA+E;QAC/E,IAAI,WAAW,GAAqC,IAAI,CAAC;QACzD,4EAA4E;QAC5E,sDAAsD;QACtD,GAAG,CAAC,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAAC,EAAE,EAAE;YAC3C,WAAW,GAAG,IAAI,yBAAyB,CACzC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EACd,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CACxC,CAAC;YACF,OAAO,WAAW,CAAC;QACrB,CAAC,CAAC,CAAC;QAEH,oFAAoF;QACpF,sFAAsF;QACtF,oFAAoF;QACpF,KAAK,MAAM,KAAK,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,CAAU,EAAE,CAAC;YACvE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE;gBAC/B,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,WAAW;oBAAE,OAAO;gBAC5C,WAAW;qBACR,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;qBAClC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;YACvE,CAAC,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,8BAA8B,EAAE,CAAC,OAAO,EAAE,EAAE;YACxD,MAAM,MAAM,GAAG,kBAAkB,CAAC,8BAA8B,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACrF,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,WAAW;gBAAE,OAAO;YAC5C,WAAW;iBACR,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;iBAClC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3B,eAAe,CACb,IAAI,UAAU,CACZ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EACd,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAChB,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EACjB,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CACxB,EACD,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CACnB,CACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}