@openora/core 0.4.1-canary.13 → 0.4.1-canary.131

package/dist/iam/router/index.d.ts

@@ -16,6 +16,15 @@ export declare function createIamRouter(svc: IamService, adminGuard: AdminGuard)
     listRoles: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
         page: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
         limit: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+        sortBy: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+            createdAt: "createdAt";
+            name: "name";
+            key: "key";
+        }>>>;
+        sortOrder: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+            asc: "asc";
+            desc: "desc";
+        }>>>;
     }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
         items: import("zod").ZodArray<import("zod").ZodObject<{
             id: import("zod").ZodUUID;
@@ -126,6 +135,13 @@ export declare function createIamRouter(svc: IamService, adminGuard: AdminGuard)
         page: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
         limit: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
         userId: import("zod").ZodOptional<import("zod").ZodUUID>;
+        sortBy: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+            createdAt: "createdAt";
+        }>>>;
+        sortOrder: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+            asc: "asc";
+            desc: "desc";
+        }>>>;
     }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
         items: import("zod").ZodArray<import("zod").ZodObject<{
             id: import("zod").ZodUUID;
@@ -156,6 +172,17 @@ export declare function createIamRouter(svc: IamService, adminGuard: AdminGuard)
     listInvitations: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
         page: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
         limit: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+        sortBy: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+            email: "email";
+            status: "status";
+            createdAt: "createdAt";
+            expiresAt: "expiresAt";
+            acceptedAt: "acceptedAt";
+        }>>>;
+        sortOrder: import("zod").ZodOptional<import("zod").ZodDefault<import("zod").ZodEnum<{
+            asc: "asc";
+            desc: "desc";
+        }>>>;
     }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
         items: import("zod").ZodArray<import("zod").ZodObject<{
             id: import("zod").ZodUUID;
@@ -213,5 +240,15 @@ export declare function createIamRouter(svc: IamService, adminGuard: AdminGuard)
             }>;
         }, import("zod/v4/core").$strip>>;
     }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    reportAccessDenied: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        resource: import("zod").ZodString;
+        level: import("zod").ZodEnum<{
+            no_access: "no_access";
+            read: "read";
+            read_write: "read_write";
+        }>;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        recorded: import("zod").ZodBoolean;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
 };
 //# sourceMappingURL=index.d.ts.map

package/dist/iam/router/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/iam/router/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAa,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAE9E,OAAO,EACL,UAAU,EAWX,MAAM,2BAA2B,CAAC;AAEnC,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmGtE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/iam/router/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAa,KAAK,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAE9E,OAAO,EACL,UAAU,EAWX,MAAM,2BAA2B,CAAC;AAEnC,wBAAgB,eAAe,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyGtE"}

package/dist/iam/router/index.js

@@ -66,7 +66,9 @@ export function createIamRouter(svc, adminGuard) {
             return mapErrors(adminMgmtErrors, () => svc.inviteAdmin({ ...input, caller }));
         }),
         // Public - invitee is not yet an admin.
-        acceptInvitation: os.acceptInvitation.handler(({ input }) => mapErrors({ NOT_FOUND: InvitationNotFoundError, CONFLICT: InvitationConflictError }, () => svc.acceptInvitation(input.token))),
+        acceptInvitation: os.acceptInvitation.handler(({ input, context }) => {
+            return mapErrors({ NOT_FOUND: InvitationNotFoundError, CONFLICT: InvitationConflictError }, () => svc.acceptInvitation(input.token, context.clientMeta));
+        }),
         forceLogout: os.forceLogout.handler(async ({ input, context }) => {
             const caller = await adminGuard.assert(context, 'admin', 'delete');
             return mapErrors(adminMgmtErrors, () => svc.forceLogout({ userId: input.userId, caller }));
@@ -75,6 +77,10 @@ export function createIamRouter(svc, adminGuard) {
             const caller = await adminGuard.assert(context);
             return svc.previewEffectivePermissions({ userId: caller.userId });
         }),
+        reportAccessDenied: os.reportAccessDenied.handler(async ({ input, context }) => {
+            const caller = await adminGuard.assert(context);
+            return svc.reportAccessDenied({ ...input, caller });
+        }),
     });
 }
 //# sourceMappingURL=index.js.map

package/dist/iam/router/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/iam/router/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAc,SAAS,EAAmB,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAEL,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,UAAU,eAAe,CAAC,GAAe,EAAE,UAAsB;IACrE,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAc,CAAC;IAEzD,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,eAAe,GAAG;QACtB,SAAS,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;QACtD,WAAW,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACrD,SAAS,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;QACrD,QAAQ,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;KACpD,CAAC;IAEF,OAAO,EAAE,CAAC,MAAM,CAAC;QACf,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YACxD,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC,CAAC;QAEF,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC3D,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC;QAEF,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACvD,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,CAAC,CAAC;QAEF,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC;QAEF,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CACrC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CACnE,CAAC;QACJ,CAAC,CAAC;QAEF,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5F,CAAC,CAAC;QAEF,kBAAkB,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC;QAEF,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC;QAEF,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACjE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC;QAEF,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACvE,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC;QAEF,2BAA2B,EAAE,EAAE,CAAC,2BAA2B,CAAC,OAAO,CACjE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC3B,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,GAAG,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CACF;QAED,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACvE,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC;QAEF,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC/D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC;QAEF,wCAAwC;QACxC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAC1D,SAAS,CAAC,EAAE,SAAS,EAAE,uBAAuB,EAAE,QAAQ,EAAE,uBAAuB,EAAE,EAAE,GAAG,EAAE,CACxF,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAClC,CACF;QAED,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC/D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7F,CAAC,CAAC;QAEF,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YAClE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO,GAAG,CAAC,2BAA2B,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/iam/router/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAc,SAAS,EAAmB,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAEL,iBAAiB,EACjB,uBAAuB,EACvB,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,UAAU,eAAe,CAAC,GAAe,EAAE,UAAsB;IACrE,MAAM,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAc,CAAC;IAEzD,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,eAAe,GAAG;QACtB,SAAS,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;QACtD,WAAW,EAAE,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;QACrD,SAAS,EAAE,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;QACrD,QAAQ,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,CAAC;KACpD,CAAC;IAEF,OAAO,EAAE,CAAC,MAAM,CAAC;QACf,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YACxD,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC,CAAC;QAEF,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC3D,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC;QAEF,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACvD,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,SAAS,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QACtF,CAAC,CAAC;QAEF,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC;QAEF,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CACrC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CACnE,CAAC;QACJ,CAAC,CAAC;QAEF,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5F,CAAC,CAAC;QAEF,kBAAkB,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,kBAAkB,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC;QAEF,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC;QAEF,YAAY,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACjE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAClF,CAAC,CAAC;QAEF,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACvE,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC;QAEF,2BAA2B,EAAE,EAAE,CAAC,2BAA2B,CAAC,OAAO,CACjE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC3B,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,GAAG,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC;QAChD,CAAC,CACF;QAED,eAAe,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACvE,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAClD,OAAO,GAAG,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC,CAAC;QAEF,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC/D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACjF,CAAC,CAAC;QAEF,wCAAwC;QACxC,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YACnE,OAAO,SAAS,CACd,EAAE,SAAS,EAAE,uBAAuB,EAAE,QAAQ,EAAE,uBAAuB,EAAE,EACzE,GAAG,EAAE,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,CAC5D,CAAC;QACJ,CAAC,CAAC;QAEF,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC/D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YACnE,OAAO,SAAS,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC7F,CAAC,CAAC;QAEF,gBAAgB,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YAClE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO,GAAG,CAAC,2BAA2B,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC;QAEF,kBAAkB,EAAE,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7E,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChD,OAAO,GAAG,CAAC,kBAAkB,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,CAAC,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/iam/seed/data/default-admin-roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"default-admin-roles.d.ts","sourceRoot":"","sources":["../../../../src/iam/seed/data/default-admin-roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAI1F,KAAK,SAAS,GAAG,YAAY,CAAC;AAE9B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,IAAI,CAAC;IACf,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;CACrD,CAAC;AASF,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EA6N1D,CAAC"}
+{"version":3,"file":"default-admin-roles.d.ts","sourceRoot":"","sources":["../../../../src/iam/seed/data/default-admin-roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAI1F,KAAK,SAAS,GAAG,YAAY,CAAC;AAE9B,MAAM,MAAM,gBAAgB,GAAG;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,IAAI,CAAC;IACf,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;CACrD,CAAC;AASF,eAAO,MAAM,mBAAmB,EAAE,SAAS,gBAAgB,EAiO1D,CAAC"}

package/dist/iam/seed/data/default-admin-roles.js

@@ -31,6 +31,9 @@ export const DEFAULT_ADMIN_ROLES = [
             affiliate: R,
             sessions: RW,
             'player-note': RW,
+            'chat-room': RW,
+            'chat-command': RW,
+            'chat-moderation': RW,
         },
     },
     {
@@ -177,6 +180,7 @@ export const DEFAULT_ADMIN_ROLES = [
             withdrawal: R,
             audit: R,
             analytics: R,
+            'wallet-asset': RW,
         },
     },
     {

package/dist/iam/seed/data/default-admin-roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"default-admin-roles.js","sourceRoot":"","sources":["../../../../src/iam/seed/data/default-admin-roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA2C,MAAM,sBAAsB,CAAC;AAc1F,MAAM,EAAE,GAAoB,YAAY,CAAC;AACzC,MAAM,CAAC,GAAoB,MAAM,CAAC;AAElC,MAAM,YAAY,GAAgD,MAAM,CAAC,WAAW,CACjF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAC5D,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAgC;IAC9D;QACE,GAAG,EAAE,aAAa;QAClB,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,YAAY;KACrB;IACD;QACE,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,OAAO;QACb,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,EAAE;YACX,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,CAAC;YACR,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,CAAC;YACZ,QAAQ,EAAE,EAAE;YACZ,aAAa,EAAE,EAAE;SAClB;KACF;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,IAAI,EAAE,oBAAoB;QAC1B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,CAAC;YACR,aAAa,EAAE,EAAE;YACjB,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,EAAE;SACf;KACF;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,gBAAgB;QACtB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,CAAC;YACR,aAAa,EAAE,EAAE;YACjB,SAAS,EAAE,EAAE;SACd;KACF;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,IAAI,EAAE,kBAAkB;QACxB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,EAAE;YACd,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,CAAC;SACb;KACF;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,IAAI,EAAE,sBAAsB;QAC5B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,EAAE;SACd;KACF;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,IAAI,EAAE,oBAAoB;QAC1B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,CAAC;SACb;KACF;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,iBAAiB;QACvB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,CAAC;YACT,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;SACT;KACF;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,IAAI,EAAE,mBAAmB;QACzB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;SACd;KACF;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,IAAI,EAAE,qBAAqB;QAC3B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,CAAC;SACb;KACF;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,IAAI,EAAE,oBAAoB;QAC1B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;SACd;KACF;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,IAAI,EAAE,sBAAsB;QAC5B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,CAAC;SACb;KACF;IACD;QACE,GAAG,EAAE,wBAAwB;QAC7B,IAAI,EAAE,wBAAwB;QAC9B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;SACT;KACF;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,iBAAiB;QACvB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,CAAC;SACb;KACF;IACD;QACE,GAAG,EAAE,aAAa;QAClB,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;SACd;KACF;CACF,CAAC"}
+{"version":3,"file":"default-admin-roles.js","sourceRoot":"","sources":["../../../../src/iam/seed/data/default-admin-roles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAA2C,MAAM,sBAAsB,CAAC;AAc1F,MAAM,EAAE,GAAoB,YAAY,CAAC;AACzC,MAAM,CAAC,GAAoB,MAAM,CAAC;AAElC,MAAM,YAAY,GAAgD,MAAM,CAAC,WAAW,CACjF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAC5D,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAgC;IAC9D;QACE,GAAG,EAAE,aAAa;QAClB,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,YAAY;KACrB;IACD;QACE,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,OAAO;QACb,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,IAAI,EAAE,CAAC;YACP,OAAO,EAAE,EAAE;YACX,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,CAAC;YACR,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,CAAC;YACZ,QAAQ,EAAE,EAAE;YACZ,aAAa,EAAE,EAAE;YACjB,WAAW,EAAE,EAAE;YACf,cAAc,EAAE,EAAE;YAClB,iBAAiB,EAAE,EAAE;SACtB;KACF;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,IAAI,EAAE,oBAAoB;QAC1B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,IAAI,EAAE,CAAC;YACP,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,CAAC;YACR,aAAa,EAAE,EAAE;YACjB,SAAS,EAAE,EAAE;YACb,UAAU,EAAE,EAAE;SACf;KACF;IACD;QACE,GAAG,EAAE,gBAAgB;QACrB,IAAI,EAAE,gBAAgB;QACtB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,IAAI,EAAE,EAAE;YACR,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,CAAC;YACR,aAAa,EAAE,EAAE;YACjB,SAAS,EAAE,EAAE;SACd;KACF;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,IAAI,EAAE,kBAAkB;QACxB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,EAAE;YACd,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,CAAC;SACb;KACF;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,IAAI,EAAE,sBAAsB;QAC5B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,EAAE;SACd;KACF;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,IAAI,EAAE,oBAAoB;QAC1B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,CAAC;SACb;KACF;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,iBAAiB;QACvB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,CAAC;YACT,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;SACT;KACF;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,IAAI,EAAE,mBAAmB;QACzB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,EAAE;YACV,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,EAAE;YACb,SAAS,EAAE,EAAE;SACd;KACF;IACD;QACE,GAAG,EAAE,mBAAmB;QACxB,IAAI,EAAE,qBAAqB;QAC3B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,OAAO,EAAE,EAAE;YACX,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,CAAC;SACb;KACF;IACD;QACE,GAAG,EAAE,kBAAkB;QACvB,IAAI,EAAE,oBAAoB;QAC1B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;SACd;KACF;IACD;QACE,GAAG,EAAE,oBAAoB;QACzB,IAAI,EAAE,sBAAsB;QAC5B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,EAAE;YACf,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,CAAC;YACZ,cAAc,EAAE,EAAE;SACnB;KACF;IACD;QACE,GAAG,EAAE,wBAAwB;QAC7B,IAAI,EAAE,wBAAwB;QAC9B,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,CAAC;YACT,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;SACT;KACF;IACD;QACE,GAAG,EAAE,iBAAiB;QACtB,IAAI,EAAE,iBAAiB;QACvB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,UAAU,EAAE,CAAC;YACb,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,CAAC;YACb,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,CAAC;SACb;KACF;IACD;QACE,GAAG,EAAE,aAAa;QAClB,IAAI,EAAE,aAAa;QACnB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACN,MAAM,EAAE,EAAE;YACV,WAAW,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,CAAC;YACT,KAAK,EAAE,EAAE;YACT,SAAS,EAAE,EAAE;SACd;KACF;CACF,CAAC"}

package/dist/iam/service/iam.service.d.ts

@@ -1,31 +1,49 @@
 import { type EventBus, DrizzleService, type PermissionLevel } from '@openora/core/server';
-import type { SendEmailPort, AdminPermissionResolver, AdminGrant, CacheAdapter, SessionCommands, User } from '@openora/core/contracts';
+import type { MailDispatchPort, AdminPermissionResolver, AdminGrant, IdentityReader, CacheAdapter, SessionCommands, User, ClientMeta, SortOrder, PageQuery, PaginationOptions, RateLimiterAdapter, RateLimitKey } from '@openora/core/contracts';
 import { type AdminRole } from '../schema/index.js';
-import type { EffectivePermissions } from '../contract/index.js';
-export declare const RoleNotFoundError: new (id: string) => Error;
-export declare const InvitationNotFoundError: new (id: string) => Error;
-export declare const InvitationConflictError: new () => Error;
-export declare const InvalidGrantError: new () => Error;
-export declare const GrantEscalationError: new () => Error;
-export declare const NotSuperAdminError: new () => Error;
-export declare const AdminUserNotFoundError: new (id: string) => Error;
-export declare const NotAnAdminUserError: new () => Error;
-export declare const ProtectedRoleError: new () => Error;
-export declare const LastSuperAdminError: new () => Error;
+import type { EffectivePermissions, IamRoleSortBy, IamInvitationSortBy } from '../contract/index.js';
+export declare const RoleNotFoundError: new (id: string) => Error & {
+    data?: Record<string, string>;
+};
+export declare const InvitationNotFoundError: new (id: string) => Error & {
+    data?: Record<string, string>;
+};
+export declare const InvitationConflictError: new () => Error & {
+    data?: Record<string, string>;
+};
+export declare const InvalidGrantError: new () => Error & {
+    data?: Record<string, string>;
+};
+export declare const GrantEscalationError: new () => Error & {
+    data?: Record<string, string>;
+};
+export declare const NotSuperAdminError: new () => Error & {
+    data?: Record<string, string>;
+};
+export declare const AdminUserNotFoundError: new (id: string) => Error & {
+    data?: Record<string, string>;
+};
+export declare const NotAnAdminUserError: new () => Error & {
+    data?: Record<string, string>;
+};
+export declare const ProtectedRoleError: new () => Error & {
+    data?: Record<string, string>;
+};
+export declare const LastSuperAdminError: new () => Error & {
+    data?: Record<string, string>;
+};
 type Caller = {
     userId: User['id'];
     role: string;
-};
-type Page = {
-    page: number;
-    limit: number;
-};
+} & ClientMeta;
 /** Implements ADMIN_PERMISSION_RESOLVER; returns null when the user has no DB assignment (guard falls back to static roles for the bootstrap admin path). */
 export declare class DbAdminPermissionResolver implements AdminPermissionResolver {
     private readonly drizzle;
     private readonly cache?;
     constructor(drizzle: DrizzleService, cache?: CacheAdapter | undefined);
     getGrants(userId: User['id']): Promise<AdminGrant[] | null>;
+    isSuperAdmin(userId: User['id']): Promise<boolean | null>;
+    private loadSuperAdmin;
     private loadGrants;
     /** Drop one user's cached grants - called on assign/revoke so revocation is instant. */
     invalidateUser(userId: User['id']): Promise<void>;
@@ -35,15 +53,18 @@ export declare class DbAdminPermissionResolver implements AdminPermissionResolve
 export declare class IamService {
     private readonly drizzle;
     private readonly events;
-    private readonly email;
+    private readonly mailDispatch;
+    private readonly identityReader;
     private readonly sessionCommands?;
-    constructor(drizzle: DrizzleService, events: EventBus, email: SendEmailPort, sessionCommands?: SessionCommands | undefined);
+    private readonly rateLimiter?;
+    constructor(drizzle: DrizzleService, events: EventBus, mailDispatch: MailDispatchPort, identityReader: IdentityReader, sessionCommands?: SessionCommands | undefined, rateLimiter?: RateLimiterAdapter<RateLimitKey> | undefined);
     private callerGrants;
     private isSuperAdmin;
     private assertSuperAdmin;
+    private emitDenied;
     listCatalog(): {
         modules: {
-            resource: "admin" | "player" | "withdrawal" | "bonus" | "transaction" | "game" | "content" | "compliance" | "report" | "audit" | "game-config" | "analytics" | "sportsbook" | "affiliate" | "sessions" | "player-note" | "tag-rule";
+            resource: "admin" | "player" | "transaction" | "game" | "content" | "compliance" | "report" | "withdrawal" | "bonus" | "audit" | "game-config" | "analytics" | "sportsbook" | "affiliate" | "sessions" | "player-note" | "tag-rule" | "tag" | "chat-room" | "auto-withdrawal-config" | "bonus-rollover-config" | "wallet-asset" | "wallet-custody" | "wallet-reconciliation" | "chat-command" | "chat-moderation";
             actions: string[];
             readActions: string[];
         }[];
@@ -51,7 +72,7 @@ export declare class IamService {
     };
     private rolePermissions;
     private rolePermissionsByRole;
-    listRoles({ page, limit }: Page): Promise<{
+    listRoles({ page, limit, sortBy, sortOrder }: PaginationOptions<object, IamRoleSortBy>): Promise<{
         items: {
             permissions: {
                 resource: string;
@@ -145,8 +166,9 @@ export declare class IamService {
     }): Promise<{
         success: true;
     }>;
-    listAssignments(input: Page & {
+    listAssignments(input: PageQuery & {
         userId?: User['id'];
+        sortOrder?: SortOrder;
     }): Promise<{
         items: {
             id: string;
@@ -165,15 +187,15 @@ export declare class IamService {
     } | {
         roleIds: string[];
     }): Promise<EffectivePermissions>;
-    listInvitations({ page, limit }: Page): Promise<{
+    listInvitations({ page, limit, sortBy, sortOrder, }: PaginationOptions<object, IamInvitationSortBy>): Promise<{
         items: import("@openora/core/server").SerializedRow<{
             email: string;
             status: "pending" | "accepted" | "revoked";
             id: string;
             createdAt: Date;
+            expiresAt: Date;
             token: string;
             roleId: string;
-            expiresAt: Date;
             acceptedAt: Date | null;
         }, "createdAt" | "expiresAt" | "acceptedAt">[];
         total: number;
@@ -189,12 +211,12 @@ export declare class IamService {
         status: "pending" | "accepted" | "revoked";
         id: string;
         createdAt: Date;
+        expiresAt: Date;
         token: string;
         roleId: string;
-        expiresAt: Date;
         acceptedAt: Date | null;
     }, "createdAt" | "expiresAt" | "acceptedAt">>;
-    acceptInvitation(token: string): Promise<{
+    acceptInvitation(token: string, meta?: ClientMeta): Promise<{
         success: true;
         email: string;
     }>;
@@ -204,6 +226,13 @@ export declare class IamService {
     }): Promise<{
         success: true;
     }>;
+    reportAccessDenied(input: {
+        resource: string;
+        level: PermissionLevel;
+        caller: Caller;
+    }): Promise<{
+        recorded: boolean;
+    }>;
 }
 export {};
 //# sourceMappingURL=iam.service.d.ts.map

package/dist/iam/service/iam.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iam.service.d.ts","sourceRoot":"","sources":["../../../src/iam/service/iam.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,QAAQ,EAIb,cAAc,EAgBd,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EACV,aAAa,EACb,uBAAuB,EACvB,UAAU,EACV,YAAY,EACZ,eAAe,EACf,IAAI,EACL,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAEjE,eAAO,MAAM,iBAAiB,2BAAiC,CAAC;AAChE,eAAO,MAAM,uBAAuB,2BAAuC,CAAC;AAC5E,eAAO,MAAM,uBAAuB,iBAGnC,CAAC;AACF,eAAO,MAAM,iBAAiB,iBAG7B,CAAC;AAEF,eAAO,MAAM,oBAAoB,iBAGhC,CAAC;AACF,eAAO,MAAM,kBAAkB,iBAG9B,CAAC;AACF,eAAO,MAAM,sBAAsB,2BAAiC,CAAC;AAErE,eAAO,MAAM,mBAAmB,iBAG/B,CAAC;AACF,eAAO,MAAM,kBAAkB,iBAG9B,CAAC;AAEF,eAAO,MAAM,mBAAmB,iBAG/B,CAAC;AAEF,KAAK,MAAM,GAAG;IAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,KAAK,IAAI,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAwF5C,6JAA6J;AAC7J,qBAAa,yBAA0B,YAAW,uBAAuB;IAErE,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBADN,OAAO,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,YAAY,YAAA;IAGvC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;YAQd,UAAU;IAwCxB,wFAAwF;IAClF,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;IAIvC,iGAAiG;IAC3F,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;CAY7C;AAWD,qBAAa,UAAU;IAEnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;gBAHhB,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,QAAQ,EAChB,KAAK,EAAE,aAAa,EACpB,eAAe,CAAC,EAAE,eAAe,YAAA;YAGtC,YAAY;YASZ,YAAY;YAkBZ,gBAAgB;IAM9B,WAAW;;;;;;;;YAIG,eAAe;YASf,qBAAqB;IAqB7B,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI;;;0BApBiB,MAAM;uBAAS,eAAe;;;;;;;;;;;;;IAkC9E,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;;;mBAvC+B,eAAe;;;;;;;;;IA+C7E,UAAU,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;;;;;;;IAelD,UAAU,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;;;;;;;IAkC5E,UAAU,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAwC1F,kBAAkB,CAAC,KAAK,EAAE;QAC9B,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,eAAe,CAAA;SAAE,CAAC,CAAC;QACpE,MAAM,EAAE,MAAM,CAAC;KAChB;;;mBA5ImE,eAAe;;;;;;;;;IA0M7E,UAAU,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;;;;;IA+CjF,YAAY,CAAC,KAAK,EAAE;QACxB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAoDxB,eAAe,CAAC,KAAK,EAAE,IAAI,GAAG;QAAE,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;KAAE;;;;;;;;;;;;;IAqCrD,2BAA2B,CAC/B,KAAK,EAAE;QAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GACpD,OAAO,CAAC,oBAAoB,CAAC;IA0E1B,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI;;;;;;;;;;;;;;;IASrC,WAAW,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;IAoC7E,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IA8B1E,WAAW,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;;CAQhE"}
+{"version":3,"file":"iam.service.d.ts","sourceRoot":"","sources":["../../../src/iam/service/iam.service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,QAAQ,EAIb,cAAc,EAiBd,KAAK,eAAe,EACrB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,UAAU,EACV,cAAc,EACd,YAAY,EACZ,eAAe,EACf,IAAI,EACJ,UAAU,EACV,SAAS,EACT,SAAS,EACT,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACb,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAG5B,OAAO,KAAK,EACV,oBAAoB,EACpB,aAAa,EACb,mBAAmB,EACpB,MAAM,sBAAsB,CAAC;AAI9B,eAAO,MAAM,iBAAiB;QA/C3B,CAAC;CA+C2D,CAAC;AAChE,eAAO,MAAM,uBAAuB;QAhDjC,CAAC;CAgDuE,CAAC;AAC5E,eAAO,MAAM,uBAAuB;QAjDjC,CAAC;CAoDH,CAAC;AACF,eAAO,MAAM,iBAAiB;QArD3B,CAAC;CAwDH,CAAC;AAEF,eAAO,MAAM,oBAAoB;QA1D9B,CAAC;CA6DH,CAAC;AACF,eAAO,MAAM,kBAAkB;QA9D5B,CAAC;CAiEH,CAAC;AACF,eAAO,MAAM,sBAAsB;QAlEhC,CAAC;CAkEgE,CAAC;AAErE,eAAO,MAAM,mBAAmB;QApE7B,CAAC;CAuEH,CAAC;AACF,eAAO,MAAM,kBAAkB;QAxE5B,CAAC;CA2EH,CAAC;AAEF,eAAO,MAAM,mBAAmB;QA7E7B,CAAC;CAgFH,CAAC;AAEF,KAAK,MAAM,GAAG;IAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAAC;AAyFhE,6JAA6J;AAC7J,qBAAa,yBAA0B,YAAW,uBAAuB;IAErE,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;gBADN,OAAO,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,YAAY,YAAA;IAGvC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;IAQ5B,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;YAMjB,cAAc;YAUd,UAAU;IAwCxB,wFAAwF;IAClF,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC;IAIvC,iGAAiG;IAC3F,cAAc,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;CAY7C;AAWD,qBAAa,UAAU;IAEnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;IACjC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;gBALZ,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,QAAQ,EAChB,YAAY,EAAE,gBAAgB,EAC9B,cAAc,EAAE,cAAc,EAC9B,eAAe,CAAC,EAAE,eAAe,YAAA,EACjC,WAAW,CAAC,EAAE,kBAAkB,CAAC,YAAY,CAAC,YAAA;YAGnD,YAAY;YASZ,YAAY;YAkBZ,gBAAgB;IAO9B,OAAO,CAAC,UAAU;IAsBlB,WAAW;;;;;;;;YAIG,eAAe;YASf,qBAAqB;IAqB7B,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,iBAAiB,CAAC,MAAM,EAAE,aAAa,CAAC;;;0BApBtC,MAAM;uBAAS,eAAe;;;;;;;;;;;;;IA8C9E,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC;;;mBAnD+B,eAAe;;;;;;;;;IA2D7E,UAAU,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;;;;;;;IAiBlD,UAAU,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;;;;;;;IAoC5E,UAAU,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IA4C1F,kBAAkB,CAAC,KAAK,EAAE;QAC9B,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,EAAE,aAAa,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,eAAe,CAAA;SAAE,CAAC,CAAC;QACpE,MAAM,EAAE,MAAM,CAAC;KAChB;;;mBAhKmE,eAAe;;;;;;;;;IAiO7E,UAAU,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;;;;;IAiDjF,YAAY,CAAC,KAAK,EAAE;QACxB,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAsDxB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG;QAAE,MAAM,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;;;;;;;;;;;;;IAuCjF,2BAA2B,CAC/B,KAAK,EAAE;QAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;KAAE,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,GACpD,OAAO,CAAC,oBAAoB,CAAC;IA0E1B,eAAe,CAAC,EACpB,IAAI,EACJ,KAAK,EACL,MAAM,EACN,SAAS,GACV,EAAE,iBAAiB,CAAC,MAAM,EAAE,mBAAmB,CAAC;;;;;;;;;;;;;;;IAuB3C,WAAW,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;;;;;;;;;IAwC7E,gBAAgB,CACpB,KAAK,EAAE,MAAM,EACb,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAgCtC,WAAW,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE;;;IASzD,kBAAkB,CAAC,KAAK,EAAE;QAC9B,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,eAAe,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC;CAmBnC"}

package/dist/iam/service/iam.service.js

@@ -1,8 +1,10 @@
-import { makeNotFoundError, makeConflictError, createDomainError, findOneOrThrow, pageToOffset, serializeRow, statement, roles, readActions, SUPPORTED_LEVELS, levelToActions, levelRank, isLevelSufficient, cached, invalidate, actionsToLevel, } from '@openora/core/server';
-import { eq, and, gt, inArray, sql } from 'drizzle-orm';
+import { makeNotFoundError, makeConflictError, createDomainError, findOneOrThrow, pageToOffset, serializeRow, statement, roles, readActions, SUPPORTED_LEVELS, levelToActions, levelRank, isLevelSufficient, cached, invalidate, createLogger, actionsToLevel, } from '@openora/core/server';
+import { eq, and, gt, inArray, sql, asc, desc } from 'drizzle-orm';
+import { RATE_LIMIT_KEYS, makeRateLimitKey } from '@openora/core/contracts';
 import { adminRole, adminRolePermission, adminRoleAssignment, adminInvitation, } from '../schema/index.js';
 // Read-only cross-domain schema import (sanctioned): assignRole verifies the target is an admin user.
 import { user } from '@openora/core/pam/schema/identity';
+const logger = createLogger('iam-service');
 export const RoleNotFoundError = makeNotFoundError('AdminRole');
 export const InvitationNotFoundError = makeNotFoundError('AdminInvitation');
 export const InvitationConflictError = makeConflictError('AdminInvitation', 'Invitation already exists or token invalid');
@@ -92,6 +94,7 @@ function toInvitationDto(row) {
 // event-driven purge below normally beats the TTL; this is just the safety floor.
 const GRANTS_CACHE_TTL_MS = 10_000;
 const grantsCacheKey = (userId) => `admin-grants:${userId}`;
+const superAdminCacheKey = (userId) => `admin-super:${userId}`;
 /** Implements ADMIN_PERMISSION_RESOLVER; returns null when the user has no DB assignment (guard falls back to static roles for the bootstrap admin path). */
 export class DbAdminPermissionResolver {
     drizzle;
@@ -105,6 +108,17 @@ export class DbAdminPermissionResolver {
         // only `undefined` as a miss, so repeated forbidden hits don't re-query either.
         return cached(this.cache, grantsCacheKey(userId), GRANTS_CACHE_TTL_MS, () => this.loadGrants(userId));
     }
+    isSuperAdmin(userId) {
+        return cached(this.cache, superAdminCacheKey(userId), GRANTS_CACHE_TTL_MS, () => this.loadSuperAdmin(userId));
+    }
+    async loadSuperAdmin(userId) {
+        const rows = await this.drizzle.db
+            .select({ isSuperAdmin: adminRole.isSuperAdmin })
+            .from(adminRoleAssignment)
+            .innerJoin(adminRole, eq(adminRole.id, adminRoleAssignment.roleId))
+            .where(eq(adminRoleAssignment.userId, userId));
+        return rows.length === 0 ? null : rows.some((r) => r.isSuperAdmin);
+    }
     async loadGrants(userId) {
         // One indexed join (on admin_role_assignment_user_id_idx) replaces the old
         // 2 + N-per-role fan-out. leftJoin keeps super-admin roles (no permission rows)
@@ -144,7 +158,7 @@ export class DbAdminPermissionResolver {
     }
     /** Drop one user's cached grants - called on assign/revoke so revocation is instant. */
     async invalidateUser(userId) {
-        await invalidate(this.cache, grantsCacheKey(userId));
+        await invalidate(this.cache, [grantsCacheKey(userId), superAdminCacheKey(userId)]);
     }
     /** Drop cached grants for every current holder of a role - for a role-wide permission change. */
     async invalidateRole(roleId) {
@@ -153,7 +167,7 @@ export class DbAdminPermissionResolver {
             .from(adminRoleAssignment)
             .where(eq(adminRoleAssignment.roleId, roleId));
         if (holders.length > 0) {
-            await invalidate(this.cache, holders.map((h) => grantsCacheKey(h.userId)));
+            await invalidate(this.cache, holders.flatMap((h) => [grantsCacheKey(h.userId), superAdminCacheKey(h.userId)]));
         }
     }
 }
@@ -166,13 +180,17 @@ function allGrants() {
 export class IamService {
     drizzle;
     events;
-    email;
+    mailDispatch;
+    identityReader;
     sessionCommands;
-    constructor(drizzle, events, email, sessionCommands) {
+    rateLimiter;
+    constructor(drizzle, events, mailDispatch, identityReader, sessionCommands, rateLimiter) {
         this.drizzle = drizzle;
         this.events = events;
-        this.email = email;
+        this.mailDispatch = mailDispatch;
+        this.identityReader = identityReader;
         this.sessionCommands = sessionCommands;
+        this.rateLimiter = rateLimiter;
     }
     async callerGrants(caller) {
         const resolver = new DbAdminPermissionResolver(this.drizzle);
@@ -199,9 +217,31 @@ export class IamService {
     }
     async assertSuperAdmin(caller) {
         if (!(await this.isSuperAdmin(caller))) {
+            this.emitDenied(caller, 'admin', 'update');
             throw new NotSuperAdminError();
         }
     }
+    emitDenied(caller, resource, action) {
+        void (async () => {
+            const playerId = caller.role === 'player'
+                ? await this.identityReader.getPlayerIdByUserIdSafe(caller.userId)
+                : null;
+            try {
+                this.events.emit('identity.user.unauthorized_access', {
+                    userId: caller.userId,
+                    playerId,
+                    resource,
+                    action,
+                    ip: caller.ip,
+                    userAgent: caller.userAgent,
+                    role: caller.role,
+                });
+            }
+            catch (err) {
+                logger.error({ err, userId: caller.userId, resource, action }, 'denial audit event failed');
+            }
+        })();
+    }
     listCatalog() {
         return buildCatalog();
     }
@@ -233,10 +273,22 @@ export class IamService {
         }
         return byRole;
     }
-    async listRoles({ page, limit }) {
+    async listRoles({ page, limit, sortBy, sortOrder }) {
         const offset = pageToOffset(page, limit);
+        const dir = (sortOrder ?? 'asc') === 'asc' ? asc : desc;
+        const ROLE_SORT_COLS = {
+            name: adminRole.name,
+            createdAt: adminRole.createdAt,
+            key: adminRole.key,
+        };
+        const col = ROLE_SORT_COLS[sortBy ?? 'name'];
         const [rows, countResult] = await Promise.all([
-            this.drizzle.db.select().from(adminRole).limit(limit).offset(offset),
+            this.drizzle.db
+                .select()
+                .from(adminRole)
+                .orderBy(dir(col), desc(adminRole.id))
+                .limit(limit)
+                .offset(offset),
             this.drizzle.db.select({ count: sql `count(*)::int` }).from(adminRole),
         ]);
         const permissionsByRole = await this.rolePermissionsByRole(rows.map((r) => r.id));
@@ -258,6 +310,8 @@ export class IamService {
             roleId: dto.id,
             name: dto.name,
             actorId: input.caller.userId,
+            ip: input.caller.ip ?? null,
+            userAgent: input.caller.userAgent ?? null,
         });
         return dto;
     }
@@ -282,6 +336,8 @@ export class IamService {
             roleId: dto.id,
             name: input.name,
             actorId: input.caller.userId,
+            ip: input.caller.ip ?? null,
+            userAgent: input.caller.userAgent ?? null,
         });
         return dto;
     }
@@ -309,11 +365,15 @@ export class IamService {
                 roleId: input.roleId,
                 userId,
                 actorId: input.caller.userId,
+                ip: input.caller.ip ?? null,
+                userAgent: input.caller.userAgent ?? null,
             });
         }
         this.events.emit('iam.role.deleted', {
             roleId: input.roleId,
             actorId: input.caller.userId,
+            ip: input.caller.ip ?? null,
+            userAgent: input.caller.userAgent ?? null,
         });
         return { success: true };
     }
@@ -333,6 +393,7 @@ export class IamService {
             }
             const have = callerMap[g.resource] ?? 'no_access';
             if (!isLevelSufficient(have, g.level)) {
+                this.emitDenied(input.caller, g.resource, 'update');
                 throw new GrantEscalationError();
             }
         }
@@ -361,6 +422,8 @@ export class IamService {
             before,
             after,
             actorId: input.caller.userId,
+            ip: input.caller.ip ?? null,
+            userAgent: input.caller.userAgent ?? null,
         });
         return this.getRole(input.roleId);
     }
@@ -390,6 +453,8 @@ export class IamService {
             roleId: input.roleId,
             userId: input.userId,
             actorId: input.caller.userId,
+            ip: input.caller.ip ?? null,
+            userAgent: input.caller.userAgent ?? null,
         });
         return dto;
     }
@@ -427,14 +492,17 @@ export class IamService {
                 roleId: input.roleId,
                 userId: input.userId,
                 actorId: input.caller.userId,
+                ip: input.caller.ip ?? null,
+                userAgent: input.caller.userAgent ?? null,
             });
         }
         return { success: true };
     }
     async listAssignments(input) {
-        const { page, limit, userId } = input;
+        const { page, limit, userId, sortOrder } = input;
         const offset = pageToOffset(page, limit);
         const where = userId ? eq(adminRoleAssignment.userId, userId) : undefined;
+        const dir = (sortOrder ?? 'desc') === 'asc' ? asc : desc;
         const [rows, countResult] = await Promise.all([
             this.drizzle.db
                 .select({
@@ -448,6 +516,7 @@ export class IamService {
                 .from(adminRoleAssignment)
                 .innerJoin(adminRole, eq(adminRole.id, adminRoleAssignment.roleId))
                 .where(where)
+                .orderBy(dir(adminRoleAssignment.createdAt), desc(adminRoleAssignment.id))
                 .limit(limit)
                 .offset(offset),
             this.drizzle.db
@@ -534,10 +603,24 @@ export class IamService {
             permissions: [...max.entries()].map(([resource, level]) => ({ resource, level })),
         };
     }
-    async listInvitations({ page, limit }) {
+    async listInvitations({ page, limit, sortBy, sortOrder, }) {
         const offset = pageToOffset(page, limit);
+        const dir = (sortOrder ?? 'desc') === 'asc' ? asc : desc;
+        const INV_SORT_COLS = {
+            createdAt: adminInvitation.createdAt,
+            expiresAt: adminInvitation.expiresAt,
+            email: adminInvitation.email,
+            status: adminInvitation.status,
+            acceptedAt: adminInvitation.acceptedAt,
+        };
+        const col = INV_SORT_COLS[sortBy ?? 'createdAt'];
         const [rows, countResult] = await Promise.all([
-            this.drizzle.db.select().from(adminInvitation).limit(limit).offset(offset),
+            this.drizzle.db
+                .select()
+                .from(adminInvitation)
+                .orderBy(dir(col), desc(adminInvitation.id))
+                .limit(limit)
+                .offset(offset),
             this.drizzle.db.select({ count: sql `count(*)::int` }).from(adminInvitation),
         ]);
         return { items: rows.map(toInvitationDto), total: countResult[0]?.count ?? 0, page, limit };
@@ -560,14 +643,18 @@ export class IamService {
             expiresAt,
         })
             .returning(), new InvitationNotFoundError(input.email));
-        await this.email.send({
-            to: input.email,
-            subject: 'You have been invited as an administrator',
-            body: `Your admin invitation token: ${token}. It expires at ${expiresAt.toISOString()}.`,
+        await this.mailDispatch.toAddress({
+            email: input.email,
+            locale: 'en',
+            template: {
+                key: 'adminInvitation',
+                data: { token, expiresAt: expiresAt.toISOString() },
+            },
+            idempotencyKey: `admin-invitation:${row.id}`,
         });
         return toInvitationDto(row);
     }
-    async acceptInvitation(token) {
+    async acceptInvitation(token, meta) {
         // Atomic conditional UPDATE: the DB evaluates pending + not-expired under row lock,
         // so two concurrent accepts cannot both succeed. Public path - tenant is derived
         // from the row, not the request, so no tenant predicate is needed.
@@ -582,6 +669,8 @@ export class IamService {
             email: row.email,
             roleId: row.roleId,
             invitationId: row.id,
+            ip: meta?.ip ?? null,
+            userAgent: meta?.userAgent ?? null,
         });
         return { success: true, email: row.email };
     }
@@ -593,5 +682,21 @@ export class IamService {
         await this.sessionCommands.revokeAll(input.userId, input.caller.userId);
         return { success: true };
     }
+    async reportAccessDenied(input) {
+        const grantMap = grantsToLevelMap(await this.callerGrants(input.caller));
+        const actualLevel = grantMap[input.resource] ?? 'no_access';
+        if (isLevelSufficient(actualLevel, input.level)) {
+            return { recorded: false };
+        }
+        if (this.rateLimiter) {
+            const key = makeRateLimitKey(RATE_LIMIT_KEYS.REPORT_ACCESS_DENIED, `${input.caller.userId}:${input.resource}`);
+            const { allowed } = await this.rateLimiter.consume(key, { limit: 1, windowMs: 60_000 });
+            if (!allowed) {
+                return { recorded: false };
+            }
+        }
+        this.emitDenied(input.caller, input.resource, 'access');
+        return { recorded: true };
+    }
 }
 //# sourceMappingURL=iam.service.js.map