@openora/core 0.4.0

package/dist/iam/seed/data/default-admin-roles.js

@@ -0,0 +1,227 @@
+import { statement } from '@openora/core/server';
+const RW = 'read_write';
+const R = 'read';
+const allReadWrite = Object.fromEntries(Object.keys(statement).map((m) => [m, RW]));
+export const DEFAULT_ADMIN_ROLES = [
+    {
+        key: 'super-admin',
+        name: 'Super Admin',
+        isSuperAdmin: true,
+        isSystem: true,
+        matrix: allReadWrite,
+    },
+    {
+        key: 'admin',
+        name: 'Admin',
+        isSuperAdmin: false,
+        isSystem: true,
+        matrix: {
+            player: RW,
+            transaction: R,
+            game: R,
+            content: RW,
+            compliance: R,
+            report: RW,
+            withdrawal: R,
+            bonus: R,
+            audit: R,
+            'game-config': R,
+            analytics: RW,
+            sportsbook: R,
+            affiliate: R,
+            sessions: RW,
+            'player-note': RW,
+        },
+    },
+    {
+        key: 'sportsbook-manager',
+        name: 'Sportsbook Manager',
+        isSuperAdmin: false,
+        isSystem: true,
+        matrix: {
+            player: R,
+            transaction: R,
+            game: R,
+            report: R,
+            bonus: R,
+            'game-config': RW,
+            analytics: RW,
+            sportsbook: RW,
+        },
+    },
+    {
+        key: 'casino-manager',
+        name: 'Casino Manager',
+        isSuperAdmin: false,
+        isSystem: true,
+        matrix: {
+            player: R,
+            transaction: R,
+            game: RW,
+            report: R,
+            bonus: R,
+            'game-config': RW,
+            analytics: RW,
+        },
+    },
+    {
+        key: 'payments-manager',
+        name: 'Payments Manager',
+        isSuperAdmin: false,
+        isSystem: true,
+        matrix: {
+            player: R,
+            transaction: RW,
+            compliance: R,
+            report: RW,
+            withdrawal: RW,
+            audit: R,
+            analytics: R,
+        },
+    },
+    {
+        key: 'risk-fraud-manager',
+        name: 'Risk & Fraud Manager',
+        isSuperAdmin: false,
+        isSystem: true,
+        matrix: {
+            player: RW,
+            transaction: R,
+            compliance: RW,
+            report: RW,
+            withdrawal: R,
+            audit: R,
+            analytics: RW,
+        },
+    },
+    {
+        key: 'compliance-manager',
+        name: 'Compliance Manager',
+        isSuperAdmin: false,
+        isSystem: true,
+        matrix: {
+            player: R,
+            transaction: R,
+            compliance: RW,
+            report: RW,
+            withdrawal: R,
+            audit: RW,
+            analytics: R,
+        },
+    },
+    {
+        key: 'kyc-aml-officer',
+        name: 'KYC/AML Officer',
+        isSuperAdmin: false,
+        isSystem: true,
+        matrix: {
+            player: R,
+            transaction: R,
+            compliance: RW,
+            report: R,
+            withdrawal: R,
+            audit: R,
+        },
+    },
+    {
+        key: 'affiliate-manager',
+        name: 'Affiliate Manager',
+        isSuperAdmin: false,
+        isSystem: true,
+        matrix: {
+            player: R,
+            transaction: R,
+            content: R,
+            report: RW,
+            bonus: R,
+            analytics: RW,
+            affiliate: RW,
+        },
+    },
+    {
+        key: 'marketing-banners',
+        name: 'Marketing (Banners)',
+        isSuperAdmin: false,
+        isSystem: true,
+        matrix: {
+            content: RW,
+            report: R,
+            bonus: R,
+            analytics: R,
+        },
+    },
+    {
+        key: 'bonus-promotions',
+        name: 'Bonus & Promotions',
+        isSuperAdmin: false,
+        isSystem: true,
+        matrix: {
+            player: R,
+            transaction: R,
+            content: R,
+            report: R,
+            bonus: RW,
+            analytics: RW,
+        },
+    },
+    {
+        key: 'finance-accounting',
+        name: 'Finance / Accounting',
+        isSuperAdmin: false,
+        isSystem: true,
+        matrix: {
+            player: R,
+            transaction: RW,
+            compliance: R,
+            report: RW,
+            withdrawal: R,
+            audit: R,
+            analytics: R,
+        },
+    },
+    {
+        key: 'customer-support-agent',
+        name: 'Customer Support Agent',
+        isSuperAdmin: false,
+        isSystem: true,
+        matrix: {
+            player: R,
+            transaction: R,
+            compliance: R,
+            withdrawal: R,
+            bonus: R,
+        },
+    },
+    {
+        key: 'support-manager',
+        name: 'Support Manager',
+        isSuperAdmin: false,
+        isSystem: true,
+        matrix: {
+            player: RW,
+            transaction: R,
+            content: R,
+            compliance: R,
+            report: RW,
+            withdrawal: R,
+            bonus: R,
+            audit: R,
+            analytics: R,
+        },
+    },
+    {
+        key: 'vip-manager',
+        name: 'VIP Manager',
+        isSuperAdmin: false,
+        isSystem: true,
+        matrix: {
+            player: RW,
+            transaction: R,
+            content: R,
+            report: R,
+            bonus: RW,
+            analytics: RW,
+        },
+    },
+];
+//# sourceMappingURL=default-admin-roles.js.map

package/dist/iam/seed/data/default-admin-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-admin-roles.js","sourceRoot":"","sources":["../../../../src/iam/seed/data/default-admin-roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA2C,MAAM,sBAAsB,CAAC;AAc1F,MAAM,EAAE,GAAoB,YAAY,CAAC;AACzC,MAAM,CAAC,GAAoB,MAAM,CAAC;AAElC,MAAM,YAAY,GAAgD,MAAM,CAAC,WAAW,CACjF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAC5D,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAgC;IAC9D;QACE,GAAG,EAAE,aAAa;QAClB,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,YAAY;KACrB;IACD;QACE,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,OAAO;QACb,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,EAAE;YACX,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,CAAC;YACR,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,CAAC;YACZ,QAAQ,EAAE,EAAE;YACZ,aAAa,EAAE,EAAE;SAClB;KACF;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,IAAI,EAAE,oBAAoB;QAC1B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,CAAC;YACR,aAAa,EAAE,EAAE;YACjB,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,EAAE;SACf;KACF;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,gBAAgB;QACtB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,CAAC;YACR,aAAa,EAAE,EAAE;YACjB,SAAS,EAAE,EAAE;SACd;KACF;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,IAAI,EAAE,kBAAkB;QACxB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,EAAE;YACd,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,CAAC;SACb;KACF;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,IAAI,EAAE,sBAAsB;QAC5B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,EAAE;SACd;KACF;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,IAAI,EAAE,oBAAoB;QAC1B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,CAAC;SACb;KACF;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,iBAAiB;QACvB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,CAAC;YACT,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;SACT;KACF;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,IAAI,EAAE,mBAAmB;QACzB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;SACd;KACF;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,IAAI,EAAE,qBAAqB;QAC3B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,CAAC;SACb;KACF;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,IAAI,EAAE,oBAAoB;QAC1B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;SACd;KACF;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,IAAI,EAAE,sBAAsB;QAC5B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,CAAC;SACb;KACF;IACD;QACE,GAAG,EAAE,wBAAwB;QAC7B,IAAI,EAAE,wBAAwB;QAC9B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;SACT;KACF;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,iBAAiB;QACvB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,CAAC;SACb;KACF;IACD;QACE,GAAG,EAAE,aAAa;QAClB,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;SACd;KACF;CACF,CAAC"}

package/dist/iam/seed/index.d.ts

@@ -0,0 +1,3 @@
+import type { DrizzleDb } from '@openora/core/server';
+export declare function seedIam(db: DrizzleDb): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/iam/seed/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/iam/seed/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGtD,wBAAsB,OAAO,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D"}

package/dist/iam/seed/index.js

@@ -0,0 +1,5 @@
+import { seedRoles } from './seed-default-roles.js';
+export async function seedIam(db) {
+    await seedRoles(db);
+}
+//# sourceMappingURL=index.js.map

package/dist/iam/seed/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/iam/seed/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,EAAa;IACzC,MAAM,SAAS,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC"}

package/dist/iam/seed/seed-default-roles.d.ts

@@ -0,0 +1,3 @@
+import type { DrizzleDb } from '@openora/core/server';
+export declare function seedRoles(db: DrizzleDb): Promise<void>;
+//# sourceMappingURL=seed-default-roles.d.ts.map

package/dist/iam/seed/seed-default-roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed-default-roles.d.ts","sourceRoot":"","sources":["../../../src/iam/seed/seed-default-roles.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAItD,wBAAsB,SAAS,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CA2C5D"}

package/dist/iam/seed/seed-default-roles.js

@@ -0,0 +1,44 @@
+import { sql } from 'drizzle-orm';
+import { adminRole, adminRolePermission } from '../schema/index.js';
+import { DEFAULT_ADMIN_ROLES } from './data/default-admin-roles.js';
+export async function seedRoles(db) {
+    await db
+        .insert(adminRole)
+        .values(DEFAULT_ADMIN_ROLES.map((r) => ({
+        key: r.key,
+        name: r.name,
+        isSystem: r.isSystem,
+        isSuperAdmin: r.isSuperAdmin,
+    })))
+        .onConflictDoUpdate({
+        target: adminRole.key,
+        set: {
+            name: sql `excluded.name`,
+            // Postgres column identifiers are snake_case at SQL level (drizzle maps camelCase -> snake_case).
+            // Use the snake_case excluded columns here so the ON CONFLICT DO UPDATE references exist.
+            isSystem: sql `excluded."is_system"`,
+            isSuperAdmin: sql `excluded."is_super_admin"`,
+        },
+    });
+    const existing = await db.select({ id: adminRole.id, key: adminRole.key }).from(adminRole);
+    const roleByKey = new Map(existing.map((r) => [r.key, r.id]));
+    // Super-admin bypasses authz, so it stores no permission rows.
+    const permissionRows = DEFAULT_ADMIN_ROLES.filter((r) => !r.isSuperAdmin).flatMap((r) => {
+        const roleId = roleByKey.get(r.key);
+        if (!roleId)
+            return [];
+        return Object.entries(r.matrix)
+            .filter(([, level]) => level !== 'no_access')
+            .map(([resource, level]) => ({ roleId, resource, level }));
+    });
+    if (permissionRows.length > 0) {
+        await db
+            .insert(adminRolePermission)
+            .values(permissionRows)
+            .onConflictDoUpdate({
+            target: [adminRolePermission.roleId, adminRolePermission.resource],
+            set: { level: sql `excluded.level`, updatedAt: sql `now()` },
+        });
+    }
+}
+//# sourceMappingURL=seed-default-roles.js.map

package/dist/iam/seed/seed-default-roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed-default-roles.js","sourceRoot":"","sources":["../../../src/iam/seed/seed-default-roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AAEpE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,EAAa;IAC3C,MAAM,EAAE;SACL,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,CACL,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,YAAY,EAAE,CAAC,CAAC,YAAY;KAC7B,CAAC,CAAC,CACJ;SACA,kBAAkB,CAAC;QAClB,MAAM,EAAE,SAAS,CAAC,GAAG;QACrB,GAAG,EAAE;YACH,IAAI,EAAE,GAAG,CAAA,eAAe;YACxB,kGAAkG;YAClG,0FAA0F;YAC1F,QAAQ,EAAE,GAAG,CAAA,sBAAsB;YACnC,YAAY,EAAE,GAAG,CAAA,2BAA2B;SAC7C;KACF,CAAC,CAAC;IAEL,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3F,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE9D,+DAA+D;IAC/D,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QACtF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;aAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,WAAW,CAAC;aAC5C,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,EAAE;aACL,MAAM,CAAC,mBAAmB,CAAC;aAC3B,MAAM,CAAC,cAAc,CAAC;aACtB,kBAAkB,CAAC;YAClB,MAAM,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,mBAAmB,CAAC,QAAQ,CAAC;YAClE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAA,gBAAgB,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE;SAC3D,CAAC,CAAC;IACP,CAAC;AACH,CAAC"}

package/dist/iam/server.d.ts

@@ -0,0 +1,4 @@
+export { IamService, DbAdminPermissionResolver, RoleNotFoundError, InvitationNotFoundError, InvitationConflictError, InvalidGrantError, GrantEscalationError, NotSuperAdminError, ProtectedRoleError, LastSuperAdminError, AdminUserNotFoundError, NotAnAdminUserError, } from './service/iam.service.js';
+export { createIamRouter } from './router/index.js';
+export { default } from './plugin.js';
+//# sourceMappingURL=server.d.ts.map

package/dist/iam/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/iam/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC"}

package/dist/iam/server.js

@@ -0,0 +1,4 @@
+export { IamService, DbAdminPermissionResolver, RoleNotFoundError, InvitationNotFoundError, InvitationConflictError, InvalidGrantError, GrantEscalationError, NotSuperAdminError, ProtectedRoleError, LastSuperAdminError, AdminUserNotFoundError, NotAnAdminUserError, } from './service/iam.service.js';
+export { createIamRouter } from './router/index.js';
+export { default } from './plugin.js';
+//# sourceMappingURL=server.js.map

package/dist/iam/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/iam/server.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC"}

package/dist/iam/service/iam.service.d.ts

@@ -0,0 +1,207 @@
+import { type EventBus, DrizzleService, type PermissionLevel } from '@openora/core/server';
+import type { SendEmailPort, AdminPermissionResolver, AdminGrant, CacheAdapter, SessionCommands } from '@openora/core/contracts';
+import type { EffectivePermissions } from '../contract/index.js';
+export declare const RoleNotFoundError: new (id: string) => Error;
+export declare const InvitationNotFoundError: new (id: string) => Error;
+export declare const InvitationConflictError: new () => Error;
+export declare const InvalidGrantError: new () => Error;
+export declare const GrantEscalationError: new () => Error;
+export declare const NotSuperAdminError: new () => Error;
+export declare const AdminUserNotFoundError: new (id: string) => Error;
+export declare const NotAnAdminUserError: new () => Error;
+export declare const ProtectedRoleError: new () => Error;
+export declare const LastSuperAdminError: new () => Error;
+type Caller = {
+    userId: string;
+    role: string;
+};
+type Page = {
+    page: number;
+    limit: number;
+};
+/** Implements ADMIN_PERMISSION_RESOLVER; returns null when the user has no DB assignment (guard falls back to static roles for the bootstrap admin path). */
+export declare class DbAdminPermissionResolver implements AdminPermissionResolver {
+    private readonly drizzle;
+    private readonly cache?;
+    constructor(drizzle: DrizzleService, cache?: CacheAdapter | undefined);
+    getGrants(userId: string): Promise<AdminGrant[] | null>;
+    private loadGrants;
+    /** Drop one user's cached grants - called on assign/revoke so revocation is instant. */
+    invalidateUser(userId: string): Promise<void>;
+    /** Drop cached grants for every current holder of a role - for a role-wide permission change. */
+    invalidateRole(roleId: string): Promise<void>;
+}
+export declare class IamService {
+    private readonly drizzle;
+    private readonly events;
+    private readonly email;
+    private readonly sessionCommands?;
+    constructor(drizzle: DrizzleService, events: EventBus, email: SendEmailPort, sessionCommands?: SessionCommands | undefined);
+    private callerGrants;
+    private isSuperAdmin;
+    private assertSuperAdmin;
+    listCatalog(): {
+        modules: {
+            resource: "admin" | "player" | "withdrawal" | "bonus" | "transaction" | "game" | "content" | "compliance" | "report" | "audit" | "game-config" | "analytics" | "sportsbook" | "affiliate" | "sessions" | "player-note" | "tag-rule";
+            actions: string[];
+            readActions: string[];
+        }[];
+        levels: ("no_access" | "read" | "read_write")[];
+    };
+    private rolePermissions;
+    listRoles({ page, limit }: Page): Promise<{
+        items: {
+            permissions: {
+                resource: string;
+                level: PermissionLevel;
+            }[];
+            id: string;
+            name: string;
+            key: string | null;
+            isSystem: boolean;
+            isSuperAdmin: boolean;
+            createdAt: string;
+        }[];
+        total: number;
+        page: number;
+        limit: number;
+    }>;
+    getRole(roleId: string): Promise<{
+        permissions: {
+            resource: string;
+            level: PermissionLevel;
+        }[];
+        id: string;
+        name: string;
+        key: string | null;
+        isSystem: boolean;
+        isSuperAdmin: boolean;
+        createdAt: string;
+    }>;
+    createRole(input: {
+        name: string;
+        caller: Caller;
+    }): Promise<import("@openora/core/server").SerializedRow<{
+        id: string;
+        createdAt: Date;
+        name: string;
+        key: string | null;
+        isSystem: boolean;
+        isSuperAdmin: boolean;
+    }, "createdAt">>;
+    updateRole(input: {
+        roleId: string;
+        name?: string;
+        caller: Caller;
+    }): Promise<import("@openora/core/server").SerializedRow<{
+        id: string;
+        createdAt: Date;
+        name: string;
+        key: string | null;
+        isSystem: boolean;
+        isSuperAdmin: boolean;
+    }, "createdAt">>;
+    deleteRole(input: {
+        roleId: string;
+        caller: Caller;
+    }): Promise<{
+        success: true;
+    }>;
+    setRolePermissions(input: {
+        roleId: string;
+        grants: ReadonlyArray<{
+            resource: string;
+            level: PermissionLevel;
+        }>;
+        caller: Caller;
+    }): Promise<{
+        permissions: {
+            resource: string;
+            level: PermissionLevel;
+        }[];
+        id: string;
+        name: string;
+        key: string | null;
+        isSystem: boolean;
+        isSuperAdmin: boolean;
+        createdAt: string;
+    }>;
+    assignRole(input: {
+        userId: string;
+        roleId: string;
+        caller: Caller;
+    }): Promise<import("@openora/core/server").SerializedRow<{
+        id: string;
+        userId: string;
+        createdAt: Date;
+        roleId: string;
+    }, "createdAt">>;
+    unassignRole(input: {
+        userId: string;
+        roleId: string;
+        caller: Caller;
+    }): Promise<{
+        success: true;
+    }>;
+    listAssignments(input: Page & {
+        userId?: string;
+    }): Promise<{
+        items: {
+            id: string;
+            userId: string;
+            roleId: string;
+            createdAt: string;
+            roleName: string;
+            roleKey: string | null;
+        }[];
+        total: number;
+        page: number;
+        limit: number;
+    }>;
+    previewEffectivePermissions(input: {
+        userId: string;
+    } | {
+        roleIds: string[];
+    }): Promise<EffectivePermissions>;
+    listInvitations({ page, limit }: Page): Promise<{
+        items: import("@openora/core/server").SerializedRow<{
+            email: string;
+            status: "pending" | "accepted" | "revoked";
+            id: string;
+            createdAt: Date;
+            token: string;
+            roleId: string;
+            expiresAt: Date;
+            acceptedAt: Date | null;
+        }, "createdAt" | "expiresAt" | "acceptedAt">[];
+        total: number;
+        page: number;
+        limit: number;
+    }>;
+    inviteAdmin(input: {
+        email: string;
+        roleId: string;
+        caller: Caller;
+    }): Promise<import("@openora/core/server").SerializedRow<{
+        email: string;
+        status: "pending" | "accepted" | "revoked";
+        id: string;
+        createdAt: Date;
+        token: string;
+        roleId: string;
+        expiresAt: Date;
+        acceptedAt: Date | null;
+    }, "createdAt" | "expiresAt" | "acceptedAt">>;
+    acceptInvitation(token: string): Promise<{
+        success: true;
+        email: string;
+    }>;
+    forceLogout(input: {
+        userId: string;
+        caller: Caller;
+    }): Promise<{
+        success: true;
+    }>;
+}
+export {};
+//# sourceMappingURL=iam.service.d.ts.map

package/dist/iam/service/iam.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iam.service.d.ts","sourceRoot":"","sources":["../../../src/iam/service/iam.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,QAAQ,EAIb,cAAc,EAgBd,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,UAAU,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,yBAAyB,CAAC;AASjC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,eAAO,MAAM,iBAAiB,2BAAiC,CAAC;AAChE,eAAO,MAAM,uBAAuB,2BAAuC,CAAC;AAC5E,eAAO,MAAM,uBAAuB,iBAGnC,CAAC;AACF,eAAO,MAAM,iBAAiB,iBAG7B,CAAC;AAEF,eAAO,MAAM,oBAAoB,iBAGhC,CAAC;AACF,eAAO,MAAM,kBAAkB,iBAG9B,CAAC;AACF,eAAO,MAAM,sBAAsB,2BAAiC,CAAC;AAErE,eAAO,MAAM,mBAAmB,iBAG/B,CAAC;AACF,eAAO,MAAM,kBAAkB,iBAG9B,CAAC;AAEF,eAAO,MAAM,mBAAmB,iBAG/B,CAAC;AAEF,KAAK,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C,KAAK,IAAI,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAgF5C,6JAA6J;AAC7J,qBAAa,yBAA0B,YAAW,uBAAuB;IAErE,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBADN,OAAO,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,YAAY,YAAA;IAGvC,SAAS,CAAC,MAAM,EAAE,MAAM;YAQV,UAAU;IAgCxB,wFAAwF;IAClF,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,iGAAiG;IAC3F,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAYpD;AAWD,qBAAa,UAAU;IAEnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAHhB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,aAAa,EACpB,eAAe,CAAC,EAAE,eAAe,YAAA;YAGtC,YAAY;YASZ,YAAY;YAkBZ,gBAAgB;IAM9B,WAAW;;;;;;;;YAIG,eAAe;IAQvB,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI;;;;uBAH+B,eAAe;;;;;;;;;;;;;IAkB7E,OAAO,CAAC,MAAM,EAAE,MAAM;;;mBAlBwC,eAAe;;;;;;;;;IA0B7E,UAAU,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;;;;;;;IAYlD,UAAU,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;;;;;;;IA6BnE,UAAU,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAwCjF,kBAAkB,CAAC,KAAK,EAAE;QAC9B,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,eAAe,CAAA;SAAE,CAAC,CAAC;QACpE,MAAM,EAAE,MAAM,CAAC;KAChB;;;mBA/GmE,eAAe;;;;;;;;;IA2K7E,UAAU,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;;;;;IA4CpE,YAAY,CAAC,KAAK,EAAE;QACxB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAoDxB,eAAe,CAAC,KAAK,EAAE,IAAI,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;;;;IAqCjD,2BAA2B,CAC/B,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GAChD,OAAO,CAAC,oBAAoB,CAAC;IAoE1B,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI;;;;;;;;;;;;;;;IASrC,WAAW,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;IAiCpE,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IA+B1E,WAAW,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;;CAQ5D"}