@pikku/kysely 0.13.27 → 0.13.28

package/CHANGELOG.md

@@ -1,3 +1,39 @@
+## 0.13.28
+
+### Patch Changes
+
+- 4a9dcd2: `admin:listUsers` now pages, counts and can carry roles.
+
+  `ListUsersInput` gains `offset` and `includeRoles`; `ListUsersOutput` gains `total`, and each `User` gains `roles` and `fields`. `total` is how many users match `search`, which is what a pager counts against — `users.length` never was, because it is capped by `limit`.
+
+  ```typescript
+  const { users, total } = await rpc.invoke('admin:listUsers', {
+    search: 'example.com',
+    limit: 50,
+    offset: 50,
+    includeRoles: true,
+  })
+  ```
+
+  Paging only means something over a stable order, so the query now sorts newest first rather than however the database felt like returning rows.
+
+  Synthetic principals — the platform credential owner, Fabric service users, scenario actors — are excluded by the query instead of dropped from the page afterwards. Filtering after the fact broke both halves of paging: `limit` had already counted the rows it then discarded, so a page came back short, and `offset` skipped synthetic rows as though they were people, so the same person could appear on two pages or on none.
+
+  `includeRoles` is refused without `admin:scopes:read`. `admin:users:list` says who may see the directory; it does not say who may see what each of those users can do.
+
+  `ScopeService` gains `listRolesForUsers(userIds)`, implemented in `@pikku/kysely`. It answers for every id asked for — an empty array for a user holding no roles, so a caller cannot read a missing key as "holds nothing" — and chunks its `in` list to stay inside the bound-parameter cap. A page of users used to cost one query per row, which on a database reached over the network is a round trip per row.
+
+  ```typescript
+  listRolesForUsers(userIds: string[]): Promise<Record<string, string[]>>
+  ```
+
+  Anything implementing `ScopeService` outside this repository has to add it.
+
+- Updated dependencies [4a9dcd2]
+- Updated dependencies [5ab24ad]
+- Updated dependencies [42b7ac3]
+  - @pikku/core@0.12.120
+
 ## 0.13.27
 
 ### Patch Changes

package/dist/src/kysely-scope-service.d.ts

@@ -61,6 +61,7 @@ export declare class KyselyScopeService implements ScopeService {
     addUserToRole(userId: string, role: string, grantedBy?: string): Promise<void>;
     removeUserFromRole(userId: string, role: string): Promise<void>;
     listUserRoles(userId: string): Promise<string[]>;
+    listRolesForUsers(userIds: string[]): Promise<Record<string, string[]>>;
     addScopeToUser(userId: string, scope: string, grantedBy?: string): Promise<void>;
     removeScopeFromUser(userId: string, scope: string): Promise<void>;
     listUserScopes(userId: string): Promise<string[]>;

package/dist/src/kysely-scope-service.js

@@ -236,6 +236,35 @@ export class KyselyScopeService {
             .execute();
         return rows.map((row) => row.role);
     }
+    async listRolesForUsers(userIds) {
+        // Seeded with every id asked for, so a user holding no roles is an empty
+        // array rather than a missing key.
+        const byUser = {};
+        for (const userId of userIds) {
+            byUser[userId] = [];
+        }
+        const distinct = Object.keys(byUser);
+        if (distinct.length === 0) {
+            return byUser;
+        }
+        // Chunked because an `in` list is one bound parameter per id, and every
+        // engine caps those — SQLite at 999 on older builds, Postgres at 65535 for
+        // the whole statement. A caller asking for a page of users stays well
+        // inside one chunk; one asking for thousands still gets an answer instead
+        // of a driver error.
+        for (let i = 0; i < distinct.length; i += 500) {
+            const chunk = distinct.slice(i, i + 500);
+            const rows = await this.db
+                .selectFrom('pikkuUserRole')
+                .select(['userId', 'role'])
+                .where('userId', 'in', chunk)
+                .execute();
+            for (const row of rows) {
+                byUser[row.userId].push(row.role);
+            }
+        }
+        return byUser;
+    }
     async addScopeToUser(userId, scope, grantedBy) {
         await this.db
             .insertInto('pikkuUserScope')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/kysely",
-  "version": "0.13.27",
+  "version": "0.13.28",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/pikkujs/pikku.git",
@@ -26,7 +26,7 @@
     "prepublishOnly": "bun run build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.111"
+    "@pikku/core": "^0.12.120"
   },
   "dependencies": {
     "kysely": "^0.29.5"