@portaidentity/server 1.7.0

package/dist/organizations/repository.js

@@ -0,0 +1,354 @@
+/**
+ * Organization repository — PostgreSQL data access layer.
+ *
+ * Provides CRUD operations for the `organizations` table using
+ * parameterized queries. Each function acquires the pool via
+ * `getPool()` and returns mapped Organization objects.
+ *
+ * This module is the sole interface to the database for organization
+ * data. The service layer composes repository + cache + validation.
+ *
+ * Key patterns:
+ * - Dynamic UPDATE query builder for partial updates
+ * - Paginated listing with optional status/search filters
+ * - Whitelisted sort columns to prevent SQL injection
+ * - All rows mapped through `mapRowToOrganization()`
+ */
+import { getPool } from '../lib/database.js';
+import { mapRowToOrganization } from './types.js';
+import { decodeCursor, buildCursorResult } from '../lib/cursor.js';
+/**
+ * Insert a new organization into the database.
+ *
+ * Uses RETURNING * to get the full row back in a single round trip.
+ * The slug must be unique (enforced by the DB unique constraint).
+ *
+ * @param data - Organization data to insert
+ * @returns The newly created organization
+ * @throws If slug already exists (unique constraint violation)
+ */
+export async function insertOrganization(data) {
+    const pool = getPool();
+    // Build the column list and value placeholders dynamically so we can omit
+    // `default_login_methods` when not provided — letting the DB DEFAULT take
+    // effect (back-compatible with callers that don't know about the column).
+    const columns = [
+        'name',
+        'slug',
+        'default_locale',
+        'branding_logo_url',
+        'branding_favicon_url',
+        'branding_primary_color',
+        'branding_company_name',
+        'branding_custom_css',
+    ];
+    const values = [
+        data.name,
+        data.slug,
+        data.defaultLocale,
+        data.brandingLogoUrl ?? null,
+        data.brandingFaviconUrl ?? null,
+        data.brandingPrimaryColor ?? null,
+        data.brandingCompanyName ?? null,
+        data.brandingCustomCss ?? null,
+    ];
+    if (data.defaultLoginMethods !== undefined) {
+        columns.push('default_login_methods');
+        values.push(data.defaultLoginMethods);
+    }
+    const placeholders = values.map((_, i) => `$${i + 1}`).join(', ');
+    const sql = `INSERT INTO organizations (${columns.join(', ')}) VALUES (${placeholders}) RETURNING *`;
+    const result = await pool.query(sql, values);
+    return mapRowToOrganization(result.rows[0]);
+}
+// ---------------------------------------------------------------------------
+// Find
+// ---------------------------------------------------------------------------
+/**
+ * Find an organization by its UUID.
+ *
+ * @param id - Organization UUID
+ * @returns Organization or null if not found
+ */
+export async function findOrganizationById(id) {
+    const pool = getPool();
+    const result = await pool.query('SELECT * FROM organizations WHERE id = $1', [id]);
+    if (result.rows.length === 0)
+        return null;
+    return mapRowToOrganization(result.rows[0]);
+}
+/**
+ * Find an organization by its slug.
+ *
+ * Returns organizations of any status (active, suspended, archived).
+ * The caller (service/middleware) is responsible for status-based access control.
+ *
+ * @param slug - Organization slug
+ * @returns Organization or null if not found
+ */
+export async function findOrganizationBySlug(slug) {
+    const pool = getPool();
+    const result = await pool.query('SELECT * FROM organizations WHERE slug = $1', [slug]);
+    if (result.rows.length === 0)
+        return null;
+    return mapRowToOrganization(result.rows[0]);
+}
+/**
+ * Find the super-admin organization (is_super_admin = TRUE).
+ *
+ * The partial unique index ensures at most one such org exists.
+ *
+ * @returns Super-admin organization or null if not yet seeded
+ */
+export async function findSuperAdminOrganization() {
+    const pool = getPool();
+    const result = await pool.query('SELECT * FROM organizations WHERE is_super_admin = TRUE LIMIT 1');
+    if (result.rows.length === 0)
+        return null;
+    return mapRowToOrganization(result.rows[0]);
+}
+/**
+ * Mapping from UpdateOrganizationData keys to database column names.
+ * Used by the dynamic query builder to construct SET clauses.
+ */
+const FIELD_TO_COLUMN = {
+    name: 'name',
+    status: 'status',
+    defaultLocale: 'default_locale',
+    twoFactorPolicy: 'two_factor_policy',
+    defaultLoginMethods: 'default_login_methods',
+    brandingLogoUrl: 'branding_logo_url',
+    brandingFaviconUrl: 'branding_favicon_url',
+    brandingPrimaryColor: 'branding_primary_color',
+    brandingCompanyName: 'branding_company_name',
+    brandingCustomCss: 'branding_custom_css',
+};
+/**
+ * Update an organization's fields using a dynamic SET clause.
+ *
+ * Only explicitly provided fields (not undefined) are included in the
+ * UPDATE statement. This allows partial updates without overwriting
+ * fields that weren't specified.
+ *
+ * The `updated_at` column is handled automatically by the DB trigger,
+ * but we don't rely on it here — we just build the SET clauses for
+ * the provided fields.
+ *
+ * @param id - Organization UUID
+ * @param data - Fields to update (only non-undefined fields are applied)
+ * @returns Updated organization
+ * @throws Error if organization not found or no fields provided
+ */
+export async function updateOrganization(id, data) {
+    const pool = getPool();
+    // Build dynamic SET clause from provided fields
+    const setClauses = [];
+    const values = [id]; // $1 is always the ID
+    let paramIndex = 2;
+    for (const [field, column] of Object.entries(FIELD_TO_COLUMN)) {
+        const value = data[field];
+        // Include the field if it's explicitly set (including null for clearing)
+        if (value !== undefined) {
+            setClauses.push(`${column} = $${paramIndex}`);
+            values.push(value);
+            paramIndex++;
+        }
+    }
+    if (setClauses.length === 0) {
+        throw new Error('No fields to update');
+    }
+    const sql = `UPDATE organizations SET ${setClauses.join(', ')} WHERE id = $1 RETURNING *`;
+    const result = await pool.query(sql, values);
+    if (result.rows.length === 0) {
+        throw new Error('Organization not found');
+    }
+    return mapRowToOrganization(result.rows[0]);
+}
+// ---------------------------------------------------------------------------
+// List
+// ---------------------------------------------------------------------------
+/**
+ * Allowed sort columns — whitelisted to prevent SQL injection.
+ * These are interpolated directly into the SQL ORDER BY clause.
+ */
+const ALLOWED_SORT_COLUMNS = {
+    name: 'name',
+    created_at: 'created_at',
+};
+/**
+ * List organizations with pagination, optional status filter, search, and sorting.
+ *
+ * Executes two queries:
+ * 1. COUNT query for total matching rows
+ * 2. Data query with LIMIT/OFFSET for the current page
+ *
+ * Sort column and direction are whitelisted (not parameterized) since
+ * they're SQL identifiers/keywords, not user data values.
+ *
+ * @param options - Pagination, filter, and sort options
+ * @returns Paginated result with organizations and metadata
+ */
+export async function listOrganizations(options) {
+    const pool = getPool();
+    const { page, pageSize, status, search, sortBy, sortOrder } = options;
+    // Build WHERE conditions
+    const conditions = [];
+    const params = [];
+    let paramIndex = 1;
+    if (status) {
+        conditions.push(`status = $${paramIndex}`);
+        params.push(status);
+        paramIndex++;
+    }
+    if (search) {
+        // Search by name or slug using case-insensitive LIKE
+        conditions.push(`(name ILIKE $${paramIndex} OR slug ILIKE $${paramIndex})`);
+        params.push(`%${search}%`);
+        paramIndex++;
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+    // Whitelist sort column and direction to prevent SQL injection
+    const sortColumn = ALLOWED_SORT_COLUMNS[sortBy ?? 'created_at'] ?? 'created_at';
+    const direction = sortOrder === 'asc' ? 'ASC' : 'DESC';
+    // Count total matching rows
+    const countResult = await pool.query(`SELECT COUNT(*) as count FROM organizations ${whereClause}`, params);
+    const total = parseInt(countResult.rows[0].count, 10);
+    // Fetch paginated data
+    const offset = (page - 1) * pageSize;
+    const dataResult = await pool.query(`SELECT * FROM organizations ${whereClause} ORDER BY ${sortColumn} ${direction} LIMIT $${paramIndex} OFFSET $${paramIndex + 1}`, [...params, pageSize, offset]);
+    return {
+        data: dataResult.rows.map(mapRowToOrganization),
+        total,
+        page,
+        pageSize,
+        totalPages: Math.ceil(total / pageSize),
+    };
+}
+/**
+ * List organizations with cursor-based keyset pagination.
+ *
+ * Uses `(sort_column, id) > (cursor_sort, cursor_id)` for efficient
+ * paging without COUNT queries. Queries limit+1 rows to detect hasMore.
+ *
+ * Backward compatible: when no cursor is provided, returns the first page.
+ *
+ * @param options - Cursor pagination, filter, and sort options
+ * @returns Cursor-paginated result with organizations
+ */
+export async function listOrganizationsCursor(options) {
+    const pool = getPool();
+    const limit = Math.min(Math.max(1, options.limit ?? 25), 100);
+    const sortColumn = ALLOWED_SORT_COLUMNS[options.sortBy ?? 'created_at'] ?? 'created_at';
+    const direction = options.sortOrder === 'asc' ? 'ASC' : 'DESC';
+    const comparator = direction === 'ASC' ? '>' : '<';
+    const conditions = [];
+    const params = [];
+    let paramIndex = 1;
+    // Cursor-based WHERE clause
+    if (options.cursor) {
+        const decoded = decodeCursor(options.cursor);
+        if (decoded) {
+            if (decoded.s === null) {
+                // NULL sort values: skip rows with NULL, then compare by ID
+                conditions.push(`(${sortColumn} IS NOT NULL OR (${sortColumn} IS NULL AND id ${comparator} $${paramIndex}))`);
+                params.push(decoded.i);
+                paramIndex++;
+            }
+            else {
+                conditions.push(`(${sortColumn}, id) ${comparator} ($${paramIndex}, $${paramIndex + 1})`);
+                params.push(decoded.s, decoded.i);
+                paramIndex += 2;
+            }
+        }
+    }
+    if (options.status) {
+        conditions.push(`status = $${paramIndex}`);
+        params.push(options.status);
+        paramIndex++;
+    }
+    if (options.search) {
+        conditions.push(`(name ILIKE $${paramIndex} OR slug ILIKE $${paramIndex})`);
+        params.push(`%${options.search}%`);
+        paramIndex++;
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')}` : '';
+    // Fetch limit + 1 to detect hasMore
+    const sql = `SELECT * FROM organizations ${whereClause} ORDER BY ${sortColumn} ${direction}, id ${direction} LIMIT $${paramIndex}`;
+    params.push(limit + 1);
+    const result = await pool.query(sql, params);
+    const rows = result.rows.map(mapRowToOrganization);
+    return buildCursorResult(rows, limit, (org) => sortColumn === 'name' ? org.name : org.createdAt.toISOString(), (org) => org.id);
+}
+// ---------------------------------------------------------------------------
+// Slug existence check
+// ---------------------------------------------------------------------------
+/**
+ * Check if a slug is already taken in the database.
+ *
+ * Checks across all statuses (active, suspended, archived) because
+ * slugs must be globally unique regardless of organization status.
+ *
+ * @param slug - Slug to check
+ * @param excludeId - Optional org ID to exclude (useful for updates)
+ * @returns true if the slug already exists
+ */
+export async function slugExists(slug, excludeId) {
+    const pool = getPool();
+    if (excludeId) {
+        const result = await pool.query('SELECT EXISTS(SELECT 1 FROM organizations WHERE slug = $1 AND id != $2) as exists', [slug, excludeId]);
+        return result.rows[0].exists;
+    }
+    const result = await pool.query('SELECT EXISTS(SELECT 1 FROM organizations WHERE slug = $1) as exists', [slug]);
+    return result.rows[0].exists;
+}
+// ---------------------------------------------------------------------------
+// Hard delete
+// ---------------------------------------------------------------------------
+/**
+ * Hard-delete an organization from the database.
+ *
+ * PostgreSQL CASCADE foreign keys automatically delete all child entities:
+ * applications, clients, users, roles, permissions, claim definitions,
+ * user claim values, user roles, branding assets, and admin sessions.
+ * Audit log entries have their organization_id set to NULL (ON DELETE SET NULL).
+ *
+ * The `AND is_super_admin = FALSE` clause is a database-level safety check —
+ * even if application code has a bug, the super-admin org cannot be deleted.
+ *
+ * @param id - Organization UUID
+ * @returns true if the row was deleted, false if not found or super-admin
+ */
+export async function hardDeleteOrganization(id) {
+    const pool = getPool();
+    const result = await pool.query('DELETE FROM organizations WHERE id = $1 AND is_super_admin = FALSE RETURNING id', [id]);
+    return (result.rowCount ?? 0) > 0;
+}
+/**
+ * Count all child entities that will be cascade-deleted with an organization.
+ * Used for dry-run display and confirmation prompts.
+ *
+ * Runs all counts in a single query using scalar subqueries for efficiency.
+ * Roles, permissions, and claim definitions are counted via their parent
+ * application's organization_id join.
+ *
+ * @param orgId - Organization UUID
+ * @returns Counts of each child entity type
+ */
+export async function getCascadeCounts(orgId) {
+    const pool = getPool();
+    const result = await pool.query(`SELECT
+       (SELECT COUNT(*) FROM applications WHERE organization_id = $1)::int AS applications,
+       (SELECT COUNT(*) FROM clients WHERE organization_id = $1)::int AS clients,
+       (SELECT COUNT(*) FROM users WHERE organization_id = $1)::int AS users,
+       (SELECT COUNT(*) FROM roles r
+        JOIN applications a ON r.application_id = a.id
+        WHERE a.organization_id = $1)::int AS roles,
+       (SELECT COUNT(*) FROM permissions p
+        JOIN applications a ON p.application_id = a.id
+        WHERE a.organization_id = $1)::int AS permissions,
+       (SELECT COUNT(*) FROM claim_definitions cd
+        JOIN applications a ON cd.application_id = a.id
+        WHERE a.organization_id = $1)::int AS claim_definitions`, [orgId]);
+    return result.rows[0];
+}
+//# sourceMappingURL=repository.js.map

package/dist/organizations/repository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../src/organizations/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAO7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAyBnE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAA4B;IACnE,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,OAAO,GAAa;QACxB,MAAM;QACN,MAAM;QACN,gBAAgB;QAChB,mBAAmB;QACnB,sBAAsB;QACtB,wBAAwB;QACxB,uBAAuB;QACvB,qBAAqB;KACtB,CAAC;IACF,MAAM,MAAM,GAAc;QACxB,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,aAAa;QAClB,IAAI,CAAC,eAAe,IAAI,IAAI;QAC5B,IAAI,CAAC,kBAAkB,IAAI,IAAI;QAC/B,IAAI,CAAC,oBAAoB,IAAI,IAAI;QACjC,IAAI,CAAC,mBAAmB,IAAI,IAAI;QAChC,IAAI,CAAC,iBAAiB,IAAI,IAAI;KAC/B,CAAC;IAEF,IAAI,IAAI,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,YAAY,eAAe,CAAC;IAErG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAkB,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,EAAU;IACnD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,2CAA2C,EAC3C,CAAC,EAAE,CAAC,CACL,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAY;IACvD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,6CAA6C,EAC7C,CAAC,IAAI,CAAC,CACP,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B;IAC9C,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,iEAAiE,CAClE,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAoBD;;;GAGG;AACH,MAAM,eAAe,GAA2B;IAC9C,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,aAAa,EAAE,gBAAgB;IAC/B,eAAe,EAAE,mBAAmB;IACpC,mBAAmB,EAAE,uBAAuB;IAC5C,eAAe,EAAE,mBAAmB;IACpC,kBAAkB,EAAE,sBAAsB;IAC1C,oBAAoB,EAAE,wBAAwB;IAC9C,mBAAmB,EAAE,uBAAuB;IAC5C,iBAAiB,EAAE,qBAAqB;CACzC,CAAC;AAEF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAU,EACV,IAA4B;IAE5B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,gDAAgD;IAChD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB;IACtD,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAqC,CAAC,CAAC;QAC1D,yEAAyE;QACzE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,UAAU,EAAE,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,UAAU,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,GAAG,GAAG,4BAA4B,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,4BAA4B,CAAC;IAC1F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAkB,GAAG,EAAE,MAAM,CAAC,CAAC;IAE9D,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,oBAAoB,GAA2B;IACnD,IAAI,EAAE,MAAM;IACZ,UAAU,EAAE,YAAY;CACzB,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAiC;IAEjC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAEtE,yBAAyB;IACzB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,IAAI,CAAC,aAAa,UAAU,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpB,UAAU,EAAE,CAAC;IACf,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,qDAAqD;QACrD,UAAU,CAAC,IAAI,CAAC,gBAAgB,UAAU,mBAAmB,UAAU,GAAG,CAAC,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;QAC3B,UAAU,EAAE,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAErF,+DAA+D;IAC/D,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC;IAChF,MAAM,SAAS,GAAG,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAEvD,4BAA4B;IAC5B,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAClC,+CAA+C,WAAW,EAAE,EAC5D,MAAM,CACP,CAAC;IACF,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEtD,uBAAuB;IACvB,MAAM,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC;IACrC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CACjC,+BAA+B,WAAW,aAAa,UAAU,IAAI,SAAS,WAAW,UAAU,YAAY,UAAU,GAAG,CAAC,EAAE,EAC/H,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAC9B,CAAC;IAEF,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC/C,KAAK;QACL,IAAI;QACJ,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC;KACxC,CAAC;AACJ,CAAC;AAgBD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAuC;IAEvC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC;IACxF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,MAAM,UAAU,GAAG,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAEnD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,4BAA4B;IAC5B,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvB,4DAA4D;gBAC5D,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,oBAAoB,UAAU,mBAAmB,UAAU,KAAK,UAAU,IAAI,CAAC,CAAC;gBAC9G,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBACvB,UAAU,EAAE,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,SAAS,UAAU,MAAM,UAAU,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC1F,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;gBAClC,UAAU,IAAI,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,aAAa,UAAU,EAAE,CAAC,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,UAAU,EAAE,CAAC;IACf,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,gBAAgB,UAAU,mBAAmB,UAAU,GAAG,CAAC,CAAC;QAC5E,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;QACnC,UAAU,EAAE,CAAC;IACf,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAErF,oCAAoC;IACpC,MAAM,GAAG,GAAG,+BAA+B,WAAW,aAAa,UAAU,IAAI,SAAS,QAAQ,SAAS,WAAW,UAAU,EAAE,CAAC;IACnI,MAAM,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAEvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAkB,GAAG,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAEnD,OAAO,iBAAiB,CACtB,IAAI,EACJ,KAAK,EACL,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,EACvE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,SAAkB;IAC/D,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IAEvB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,mFAAmF,EACnF,CAAC,IAAI,EAAE,SAAS,CAAC,CAClB,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,sEAAsE,EACtE,CAAC,IAAI,CAAC,CACP,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC/B,CAAC;AAED,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,EAAU;IACrD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,iFAAiF,EACjF,CAAC,EAAE,CAAC,CACL,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAQlD,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;;;;;;;gEAY4D,EAC5D,CAAC,KAAK,CAAC,CACR,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC"}

package/dist/organizations/service.d.ts

@@ -0,0 +1,168 @@
+/**
+ * Organization service — business logic orchestrator.
+ *
+ * Composes the repository, cache, slug utilities, and audit log
+ * to provide the complete organization management API. All write
+ * operations follow the pattern:
+ *   1. Validate inputs
+ *   2. Perform DB operation (via repository)
+ *   3. Invalidate + re-cache (via cache)
+ *   4. Write audit log (fire-and-forget)
+ *
+ * Read operations check cache first, fall back to DB on miss.
+ *
+ * Status lifecycle rules:
+ *   - suspend: active → suspended (super-admin blocked)
+ *   - activate: suspended → active
+ *   - archive: active|suspended → archived (super-admin blocked)
+ *   - restore: archived → active
+ */
+import type { Organization, CreateOrganizationInput, UpdateOrganizationInput, BrandingInput, ListOrganizationsOptions, PaginatedResult, CascadeCounts, DestroyResult } from './types.js';
+import type { ListOrganizationsCursorOptions } from './repository.js';
+import type { CursorPaginatedResult } from '../lib/cursor.js';
+/**
+ * Create a new organization.
+ *
+ * 1. Generate slug from name if not provided
+ * 2. Validate slug format and reserved words
+ * 3. Check slug uniqueness in the database
+ * 4. Insert organization via repository
+ * 5. Cache the new organization
+ * 6. Write audit log entry
+ *
+ * @param input - Organization creation data
+ * @param actorId - UUID of the user performing the action (for audit)
+ * @returns Created organization
+ * @throws OrganizationValidationError if slug is invalid or already taken
+ */
+export declare function createOrganization(input: CreateOrganizationInput, actorId?: string): Promise<Organization>;
+/**
+ * Find an organization by ID.
+ * Checks Redis cache first, falls back to database on miss.
+ *
+ * @param id - Organization UUID
+ * @returns Organization or null if not found
+ */
+export declare function getOrganizationById(id: string): Promise<Organization | null>;
+/**
+ * Find an organization by slug.
+ * Checks Redis cache first, falls back to database on miss.
+ *
+ * @param slug - Organization slug
+ * @returns Organization or null if not found
+ */
+export declare function getOrganizationBySlug(slug: string): Promise<Organization | null>;
+/**
+ * Update an organization's basic fields (name, locale).
+ *
+ * @param id - Organization UUID
+ * @param input - Fields to update
+ * @param actorId - UUID of the user performing the action
+ * @returns Updated organization
+ * @throws OrganizationNotFoundError if organization not found
+ */
+export declare function updateOrganization(id: string, input: UpdateOrganizationInput, actorId?: string): Promise<Organization>;
+/**
+ * Update an organization's branding configuration.
+ *
+ * @param id - Organization UUID
+ * @param branding - Branding fields to update
+ * @param actorId - UUID of the user performing the action
+ * @returns Updated organization
+ * @throws OrganizationNotFoundError if organization not found
+ */
+export declare function updateOrganizationBranding(id: string, branding: BrandingInput, actorId?: string): Promise<Organization>;
+/**
+ * Suspend an organization (active → suspended).
+ * Super-admin organization cannot be suspended.
+ *
+ * @param id - Organization UUID
+ * @param reason - Optional reason for suspension
+ * @param actorId - UUID of the user performing the action
+ * @throws OrganizationNotFoundError if not found
+ * @throws OrganizationValidationError if super-admin, already suspended, or archived
+ */
+export declare function suspendOrganization(id: string, reason?: string, actorId?: string): Promise<void>;
+/**
+ * Activate an organization (suspended → active).
+ *
+ * @param id - Organization UUID
+ * @param actorId - UUID of the user performing the action
+ * @throws OrganizationNotFoundError if not found
+ * @throws OrganizationValidationError if not currently suspended
+ */
+export declare function activateOrganization(id: string, actorId?: string): Promise<void>;
+/**
+ * Archive an organization (soft-delete).
+ * Super-admin organization cannot be archived.
+ *
+ * @param id - Organization UUID
+ * @param actorId - UUID of the user performing the action
+ * @throws OrganizationNotFoundError if not found
+ * @throws OrganizationValidationError if super-admin or already archived
+ */
+export declare function archiveOrganization(id: string, actorId?: string): Promise<void>;
+/**
+ * Restore an archived organization (archived → active).
+ *
+ * @param id - Organization UUID
+ * @param actorId - UUID of the user performing the action
+ * @throws OrganizationNotFoundError if not found
+ * @throws OrganizationValidationError if not currently archived
+ */
+export declare function restoreOrganization(id: string, actorId?: string): Promise<void>;
+/**
+ * List organizations with pagination and filtering.
+ * Delegates directly to the repository.
+ *
+ * @param options - Pagination, filter, and sort options
+ * @returns Paginated result
+ */
+export declare function listOrganizations(options: ListOrganizationsOptions): Promise<PaginatedResult<Organization>>;
+/**
+ * List organizations with cursor-based keyset pagination.
+ * Provides stable, efficient pagination without COUNT queries.
+ * Delegates directly to the repository cursor implementation.
+ *
+ * @param options - Cursor, limit, filter, and sort options
+ * @returns Cursor-paginated result with nextCursor/hasMore
+ */
+export declare function listOrganizationsCursor(options: ListOrganizationsCursorOptions): Promise<CursorPaginatedResult<Organization>>;
+/**
+ * Validate if a slug is available and valid.
+ * Checks both format/reserved words AND database uniqueness.
+ *
+ * @param slug - Slug to validate
+ * @param excludeId - Optional org ID to exclude (for updates)
+ * @returns Object with isValid boolean and optional error message
+ */
+export declare function validateSlugAvailability(slug: string, excludeId?: string): Promise<{
+    isValid: boolean;
+    error?: string;
+}>;
+/**
+ * Get cascade counts for an organization (preview of what will be deleted).
+ *
+ * @param orgId - Organization UUID
+ * @returns Counts of each child entity type
+ */
+export declare function getCascadeCounts(orgId: string): Promise<CascadeCounts>;
+/**
+ * Destroy an organization and all its child entities via CASCADE.
+ *
+ * Safety checks:
+ * 1. Organization must exist
+ * 2. Organization must NOT be the super-admin org (application-level check)
+ * 3. Cascade counts are calculated before deletion (for audit trail)
+ * 4. Audit log is written BEFORE deletion (org_id becomes NULL after DELETE)
+ * 5. Hard-delete with SQL-level super-admin guard (defense in depth)
+ * 6. Cache invalidated after successful deletion
+ *
+ * @param idOrSlug - Organization ID or slug
+ * @param actorId - ID of the admin performing the destruction (for audit log)
+ * @returns Object with the deleted org and cascade counts
+ * @throws OrganizationNotFoundError if org doesn't exist
+ * @throws OrganizationValidationError if org is super-admin
+ */
+export declare function destroyOrganization(idOrSlug: string, actorId?: string): Promise<DestroyResult>;
+//# sourceMappingURL=service.d.ts.map

package/dist/organizations/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/organizations/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,aAAa,EACb,wBAAwB,EACxB,eAAe,EACf,aAAa,EACb,aAAa,EACd,MAAM,YAAY,CAAC;AAYpB,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAqD9D;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,uBAAuB,EAC9B,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,CAAC,CAsDvB;AAMD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAWlF;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAWtF;AAMD;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,uBAAuB,EAC9B,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,CAAC,CAiEvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,aAAa,EACvB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,YAAY,CAAC,CA+BvB;AAgBD;;;;;;;;;GASG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAuBf;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAgBf;AAMD;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC,CAExC;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,8BAA8B,GACtC,OAAO,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAE9C;AAMD;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAc/C;AAMD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAE5E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CA6CxB"}