@portaidentity/server 1.7.0

package/dist/organizations/service.js

@@ -0,0 +1,511 @@
+/**
+ * Organization service — business logic orchestrator.
+ *
+ * Composes the repository, cache, slug utilities, and audit log
+ * to provide the complete organization management API. All write
+ * operations follow the pattern:
+ *   1. Validate inputs
+ *   2. Perform DB operation (via repository)
+ *   3. Invalidate + re-cache (via cache)
+ *   4. Write audit log (fire-and-forget)
+ *
+ * Read operations check cache first, fall back to DB on miss.
+ *
+ * Status lifecycle rules:
+ *   - suspend: active → suspended (super-admin blocked)
+ *   - activate: suspended → active
+ *   - archive: active|suspended → archived (super-admin blocked)
+ *   - restore: archived → active
+ */
+import { insertOrganization, findOrganizationById, findOrganizationBySlug, updateOrganization as repoUpdate, listOrganizations as repoList, listOrganizationsCursor as repoListCursor, slugExists, hardDeleteOrganization, getCascadeCounts as repoGetCascadeCounts, } from './repository.js';
+import { getCachedOrganizationById, getCachedOrganizationBySlug, cacheOrganization, invalidateOrganizationCache, } from './cache.js';
+import { generateSlug, validateSlug } from './slugs.js';
+import { writeAuditLog } from '../lib/audit-log.js';
+import { OrganizationNotFoundError, OrganizationValidationError } from './errors.js';
+// Import directly from the type/resolver modules (not the clients barrel)
+// to keep the org→clients dependency narrow and avoid pulling the entire
+// clients service surface into the organizations module.
+import { LOGIN_METHODS } from '../clients/types.js';
+import { normalizeLoginMethods } from '../clients/resolve-login-methods.js';
+// ---------------------------------------------------------------------------
+// Validation helpers (private)
+// ---------------------------------------------------------------------------
+/**
+ * Validate + normalize a `defaultLoginMethods` input array.
+ *
+ * Throws {@link OrganizationValidationError} when:
+ *   - the value is not an array
+ *   - the array is empty
+ *   - any element is not a valid {@link LoginMethod}
+ *
+ * Returns the normalized (deduplicated, order-preserving) array on success.
+ */
+function validateDefaultLoginMethods(methods) {
+    if (methods === undefined)
+        return undefined;
+    if (!Array.isArray(methods) || methods.length === 0) {
+        throw new OrganizationValidationError('defaultLoginMethods: must be a non-empty array');
+    }
+    for (const m of methods) {
+        if (!LOGIN_METHODS.includes(m)) {
+            throw new OrganizationValidationError(`defaultLoginMethods: invalid method "${String(m)}"`);
+        }
+    }
+    return normalizeLoginMethods(methods);
+}
+// ---------------------------------------------------------------------------
+// Create
+// ---------------------------------------------------------------------------
+/**
+ * Create a new organization.
+ *
+ * 1. Generate slug from name if not provided
+ * 2. Validate slug format and reserved words
+ * 3. Check slug uniqueness in the database
+ * 4. Insert organization via repository
+ * 5. Cache the new organization
+ * 6. Write audit log entry
+ *
+ * @param input - Organization creation data
+ * @param actorId - UUID of the user performing the action (for audit)
+ * @returns Created organization
+ * @throws OrganizationValidationError if slug is invalid or already taken
+ */
+export async function createOrganization(input, actorId) {
+    // Generate or use provided slug
+    const slug = input.slug ?? generateSlug(input.name);
+    // Validate slug format and reserved words
+    const validation = validateSlug(slug);
+    if (!validation.isValid) {
+        throw new OrganizationValidationError(validation.error);
+    }
+    // Check uniqueness
+    const taken = await slugExists(slug);
+    if (taken) {
+        throw new OrganizationValidationError('Slug already in use');
+    }
+    // Validate + normalize defaultLoginMethods (throws on invalid input).
+    // Undefined → fall back to DB DEFAULT in the repository INSERT.
+    const defaultLoginMethods = validateDefaultLoginMethods(input.defaultLoginMethods);
+    // Insert into database
+    const org = await insertOrganization({
+        name: input.name,
+        slug,
+        defaultLocale: input.defaultLocale ?? 'en',
+        brandingLogoUrl: input.branding?.logoUrl,
+        brandingFaviconUrl: input.branding?.faviconUrl,
+        brandingPrimaryColor: input.branding?.primaryColor,
+        brandingCompanyName: input.branding?.companyName,
+        brandingCustomCss: input.branding?.customCss,
+        defaultLoginMethods,
+    });
+    // Cache the new organization
+    await cacheOrganization(org);
+    // Audit log (fire-and-forget) — include the resolved defaults so audit
+    // captures the effective configuration even when the caller relied on
+    // the DB DEFAULT.
+    await writeAuditLog({
+        organizationId: org.id,
+        actorId,
+        eventType: 'org.created',
+        eventCategory: 'admin',
+        metadata: {
+            slug: org.slug,
+            name: org.name,
+            defaultLoginMethods: org.defaultLoginMethods,
+        },
+    });
+    return org;
+}
+// ---------------------------------------------------------------------------
+// Read
+// ---------------------------------------------------------------------------
+/**
+ * Find an organization by ID.
+ * Checks Redis cache first, falls back to database on miss.
+ *
+ * @param id - Organization UUID
+ * @returns Organization or null if not found
+ */
+export async function getOrganizationById(id) {
+    // Try cache first
+    const cached = await getCachedOrganizationById(id);
+    if (cached)
+        return cached;
+    // Fall back to database
+    const org = await findOrganizationById(id);
+    if (org) {
+        await cacheOrganization(org);
+    }
+    return org;
+}
+/**
+ * Find an organization by slug.
+ * Checks Redis cache first, falls back to database on miss.
+ *
+ * @param slug - Organization slug
+ * @returns Organization or null if not found
+ */
+export async function getOrganizationBySlug(slug) {
+    // Try cache first
+    const cached = await getCachedOrganizationBySlug(slug);
+    if (cached)
+        return cached;
+    // Fall back to database
+    const org = await findOrganizationBySlug(slug);
+    if (org) {
+        await cacheOrganization(org);
+    }
+    return org;
+}
+// ---------------------------------------------------------------------------
+// Update
+// ---------------------------------------------------------------------------
+/**
+ * Update an organization's basic fields (name, locale).
+ *
+ * @param id - Organization UUID
+ * @param input - Fields to update
+ * @param actorId - UUID of the user performing the action
+ * @returns Updated organization
+ * @throws OrganizationNotFoundError if organization not found
+ */
+export async function updateOrganization(id, input, actorId) {
+    // Build update data from input
+    const updateData = {};
+    if (input.name !== undefined)
+        updateData.name = input.name;
+    if (input.defaultLocale !== undefined)
+        updateData.defaultLocale = input.defaultLocale;
+    if (input.twoFactorPolicy !== undefined)
+        updateData.twoFactorPolicy = input.twoFactorPolicy;
+    // Validate + normalize defaultLoginMethods if provided (throws on invalid).
+    // Capture the previous value (for audit log diff) before the update is
+    // applied, so we can record the old → new transition.
+    let previousDefaultLoginMethods;
+    if (input.defaultLoginMethods !== undefined) {
+        const normalized = validateDefaultLoginMethods(input.defaultLoginMethods);
+        updateData.defaultLoginMethods = normalized;
+        // Look up the current value for the audit diff. We use the cache-aware
+        // accessor so we get a Date-deserialized object back; if the org doesn't
+        // exist the repo update will throw OrganizationNotFoundError below.
+        const existing = await getOrganizationById(id);
+        if (existing) {
+            previousDefaultLoginMethods = existing.defaultLoginMethods;
+        }
+    }
+    // Include branding fields if provided
+    if (input.branding) {
+        if (input.branding.logoUrl !== undefined)
+            updateData.brandingLogoUrl = input.branding.logoUrl;
+        if (input.branding.faviconUrl !== undefined)
+            updateData.brandingFaviconUrl = input.branding.faviconUrl;
+        if (input.branding.primaryColor !== undefined)
+            updateData.brandingPrimaryColor = input.branding.primaryColor;
+        if (input.branding.companyName !== undefined)
+            updateData.brandingCompanyName = input.branding.companyName;
+        if (input.branding.customCss !== undefined)
+            updateData.brandingCustomCss = input.branding.customCss;
+    }
+    let org;
+    try {
+        org = await repoUpdate(id, updateData);
+    }
+    catch (err) {
+        if (err instanceof Error && err.message === 'Organization not found') {
+            throw new OrganizationNotFoundError(id);
+        }
+        throw err;
+    }
+    // Invalidate old cache and re-cache the updated version
+    await invalidateOrganizationCache(org.slug, org.id);
+    await cacheOrganization(org);
+    // Audit log (fire-and-forget) — include old/new login methods when
+    // they changed, for forensic traceability.
+    const auditMetadata = {
+        fields: Object.keys(updateData),
+    };
+    if (input.defaultLoginMethods !== undefined) {
+        auditMetadata.previousDefaultLoginMethods = previousDefaultLoginMethods ?? null;
+        auditMetadata.newDefaultLoginMethods = org.defaultLoginMethods;
+    }
+    await writeAuditLog({
+        organizationId: org.id,
+        actorId,
+        eventType: 'org.updated',
+        eventCategory: 'admin',
+        metadata: auditMetadata,
+    });
+    return org;
+}
+/**
+ * Update an organization's branding configuration.
+ *
+ * @param id - Organization UUID
+ * @param branding - Branding fields to update
+ * @param actorId - UUID of the user performing the action
+ * @returns Updated organization
+ * @throws OrganizationNotFoundError if organization not found
+ */
+export async function updateOrganizationBranding(id, branding, actorId) {
+    const updateData = {};
+    if (branding.logoUrl !== undefined)
+        updateData.brandingLogoUrl = branding.logoUrl;
+    if (branding.faviconUrl !== undefined)
+        updateData.brandingFaviconUrl = branding.faviconUrl;
+    if (branding.primaryColor !== undefined)
+        updateData.brandingPrimaryColor = branding.primaryColor;
+    if (branding.companyName !== undefined)
+        updateData.brandingCompanyName = branding.companyName;
+    if (branding.customCss !== undefined)
+        updateData.brandingCustomCss = branding.customCss;
+    let org;
+    try {
+        org = await repoUpdate(id, updateData);
+    }
+    catch (err) {
+        if (err instanceof Error && err.message === 'Organization not found') {
+            throw new OrganizationNotFoundError(id);
+        }
+        throw err;
+    }
+    await invalidateOrganizationCache(org.slug, org.id);
+    await cacheOrganization(org);
+    // Audit log (fire-and-forget)
+    await writeAuditLog({
+        organizationId: org.id,
+        actorId,
+        eventType: 'org.branding.updated',
+        eventCategory: 'admin',
+        metadata: { fields: Object.keys(updateData) },
+    });
+    return org;
+}
+// ---------------------------------------------------------------------------
+// Status lifecycle
+// ---------------------------------------------------------------------------
+/**
+ * Load and validate an organization exists before a status change.
+ * @throws OrganizationNotFoundError if not found
+ */
+async function loadOrgForStatusChange(id) {
+    const org = await findOrganizationById(id);
+    if (!org)
+        throw new OrganizationNotFoundError(id);
+    return org;
+}
+/**
+ * Suspend an organization (active → suspended).
+ * Super-admin organization cannot be suspended.
+ *
+ * @param id - Organization UUID
+ * @param reason - Optional reason for suspension
+ * @param actorId - UUID of the user performing the action
+ * @throws OrganizationNotFoundError if not found
+ * @throws OrganizationValidationError if super-admin, already suspended, or archived
+ */
+export async function suspendOrganization(id, reason, actorId) {
+    const org = await loadOrgForStatusChange(id);
+    if (org.isSuperAdmin) {
+        throw new OrganizationValidationError('Super-admin organization cannot be suspended');
+    }
+    if (org.status === 'suspended') {
+        throw new OrganizationValidationError('Organization is already suspended');
+    }
+    if (org.status !== 'active') {
+        throw new OrganizationValidationError(`Cannot suspend organization from status: ${org.status}`);
+    }
+    await repoUpdate(id, { status: 'suspended' });
+    await invalidateOrganizationCache(org.slug, org.id);
+    await writeAuditLog({
+        organizationId: org.id,
+        actorId,
+        eventType: 'org.suspended',
+        eventCategory: 'admin',
+        metadata: { reason: reason ?? null },
+    });
+}
+/**
+ * Activate an organization (suspended → active).
+ *
+ * @param id - Organization UUID
+ * @param actorId - UUID of the user performing the action
+ * @throws OrganizationNotFoundError if not found
+ * @throws OrganizationValidationError if not currently suspended
+ */
+export async function activateOrganization(id, actorId) {
+    const org = await loadOrgForStatusChange(id);
+    if (org.status !== 'suspended') {
+        throw new OrganizationValidationError(`Cannot activate organization from status: ${org.status}`);
+    }
+    await repoUpdate(id, { status: 'active' });
+    await invalidateOrganizationCache(org.slug, org.id);
+    await writeAuditLog({
+        organizationId: org.id,
+        actorId,
+        eventType: 'org.activated',
+        eventCategory: 'admin',
+    });
+}
+/**
+ * Archive an organization (soft-delete).
+ * Super-admin organization cannot be archived.
+ *
+ * @param id - Organization UUID
+ * @param actorId - UUID of the user performing the action
+ * @throws OrganizationNotFoundError if not found
+ * @throws OrganizationValidationError if super-admin or already archived
+ */
+export async function archiveOrganization(id, actorId) {
+    const org = await loadOrgForStatusChange(id);
+    if (org.isSuperAdmin) {
+        throw new OrganizationValidationError('Super-admin organization cannot be archived');
+    }
+    if (org.status === 'archived') {
+        throw new OrganizationValidationError('Organization is already archived');
+    }
+    await repoUpdate(id, { status: 'archived' });
+    await invalidateOrganizationCache(org.slug, org.id);
+    await writeAuditLog({
+        organizationId: org.id,
+        actorId,
+        eventType: 'org.archived',
+        eventCategory: 'admin',
+    });
+}
+/**
+ * Restore an archived organization (archived → active).
+ *
+ * @param id - Organization UUID
+ * @param actorId - UUID of the user performing the action
+ * @throws OrganizationNotFoundError if not found
+ * @throws OrganizationValidationError if not currently archived
+ */
+export async function restoreOrganization(id, actorId) {
+    const org = await loadOrgForStatusChange(id);
+    if (org.status !== 'archived') {
+        throw new OrganizationValidationError(`Cannot restore organization from status: ${org.status}`);
+    }
+    await repoUpdate(id, { status: 'active' });
+    await invalidateOrganizationCache(org.slug, org.id);
+    await writeAuditLog({
+        organizationId: org.id,
+        actorId,
+        eventType: 'org.restored',
+        eventCategory: 'admin',
+    });
+}
+// ---------------------------------------------------------------------------
+// List
+// ---------------------------------------------------------------------------
+/**
+ * List organizations with pagination and filtering.
+ * Delegates directly to the repository.
+ *
+ * @param options - Pagination, filter, and sort options
+ * @returns Paginated result
+ */
+export async function listOrganizations(options) {
+    return repoList(options);
+}
+/**
+ * List organizations with cursor-based keyset pagination.
+ * Provides stable, efficient pagination without COUNT queries.
+ * Delegates directly to the repository cursor implementation.
+ *
+ * @param options - Cursor, limit, filter, and sort options
+ * @returns Cursor-paginated result with nextCursor/hasMore
+ */
+export async function listOrganizationsCursor(options) {
+    return repoListCursor(options);
+}
+// ---------------------------------------------------------------------------
+// Slug validation
+// ---------------------------------------------------------------------------
+/**
+ * Validate if a slug is available and valid.
+ * Checks both format/reserved words AND database uniqueness.
+ *
+ * @param slug - Slug to validate
+ * @param excludeId - Optional org ID to exclude (for updates)
+ * @returns Object with isValid boolean and optional error message
+ */
+export async function validateSlugAvailability(slug, excludeId) {
+    // Check format and reserved words first
+    const validation = validateSlug(slug);
+    if (!validation.isValid) {
+        return validation;
+    }
+    // Check database uniqueness
+    const taken = await slugExists(slug, excludeId);
+    if (taken) {
+        return { isValid: false, error: 'Slug already in use' };
+    }
+    return { isValid: true };
+}
+// ---------------------------------------------------------------------------
+// Destroy (hard delete)
+// ---------------------------------------------------------------------------
+/**
+ * Get cascade counts for an organization (preview of what will be deleted).
+ *
+ * @param orgId - Organization UUID
+ * @returns Counts of each child entity type
+ */
+export async function getCascadeCounts(orgId) {
+    return repoGetCascadeCounts(orgId);
+}
+/**
+ * Destroy an organization and all its child entities via CASCADE.
+ *
+ * Safety checks:
+ * 1. Organization must exist
+ * 2. Organization must NOT be the super-admin org (application-level check)
+ * 3. Cascade counts are calculated before deletion (for audit trail)
+ * 4. Audit log is written BEFORE deletion (org_id becomes NULL after DELETE)
+ * 5. Hard-delete with SQL-level super-admin guard (defense in depth)
+ * 6. Cache invalidated after successful deletion
+ *
+ * @param idOrSlug - Organization ID or slug
+ * @param actorId - ID of the admin performing the destruction (for audit log)
+ * @returns Object with the deleted org and cascade counts
+ * @throws OrganizationNotFoundError if org doesn't exist
+ * @throws OrganizationValidationError if org is super-admin
+ */
+export async function destroyOrganization(idOrSlug, actorId) {
+    // 1. Resolve org (try by ID first, then by slug)
+    let org = await findOrganizationById(idOrSlug);
+    if (!org) {
+        org = await findOrganizationBySlug(idOrSlug);
+    }
+    if (!org) {
+        throw new OrganizationNotFoundError(idOrSlug);
+    }
+    // 2. Super-admin protection (application-level check)
+    if (org.isSuperAdmin) {
+        throw new OrganizationValidationError('Cannot destroy the super-admin organization');
+    }
+    // 3. Count cascade targets (for audit trail and response)
+    const cascadeCounts = await repoGetCascadeCounts(org.id);
+    // 4. Write audit log BEFORE deletion (org_id will be SET NULL after delete)
+    await writeAuditLog({
+        organizationId: org.id,
+        actorId,
+        eventType: 'org.destroyed',
+        eventCategory: 'admin',
+        metadata: {
+            name: org.name,
+            slug: org.slug,
+            cascadeCounts,
+        },
+    });
+    // 5. Hard-delete (CASCADE handles children)
+    const deleted = await hardDeleteOrganization(org.id);
+    if (!deleted) {
+        throw new OrganizationValidationError('Failed to delete organization — it may be the super-admin org');
+    }
+    // 6. Invalidate cache
+    await invalidateOrganizationCache(org.slug, org.id);
+    return { organization: org, cascadeCounts };
+}
+//# sourceMappingURL=service.js.map

package/dist/organizations/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/organizations/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAYH,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,IAAI,UAAU,EAChC,iBAAiB,IAAI,QAAQ,EAC7B,uBAAuB,IAAI,cAAc,EACzC,UAAU,EACV,sBAAsB,EACtB,gBAAgB,IAAI,oBAAoB,GACzC,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,yBAAyB,EACzB,2BAA2B,EAC3B,iBAAiB,EACjB,2BAA2B,GAC5B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AACrF,0EAA0E;AAC1E,yEAAyE;AACzE,yDAAyD;AACzD,OAAO,EAAE,aAAa,EAAoB,MAAM,qBAAqB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,8EAA8E;AAC9E,+BAA+B;AAC/B,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,SAAS,2BAA2B,CAClC,OAAkC;IAElC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,2BAA2B,CACnC,gDAAgD,CACjD,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,2BAA2B,CACnC,wCAAwC,MAAM,CAAC,CAAC,CAAC,GAAG,CACrD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAA8B,EAC9B,OAAgB;IAEhB,gCAAgC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAEpD,0CAA0C;IAC1C,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,2BAA2B,CAAC,UAAU,CAAC,KAAM,CAAC,CAAC;IAC3D,CAAC;IAED,mBAAmB;IACnB,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,2BAA2B,CAAC,qBAAqB,CAAC,CAAC;IAC/D,CAAC;IAED,sEAAsE;IACtE,gEAAgE;IAChE,MAAM,mBAAmB,GAAG,2BAA2B,CACrD,KAAK,CAAC,mBAAmB,CAC1B,CAAC;IAEF,uBAAuB;IACvB,MAAM,GAAG,GAAG,MAAM,kBAAkB,CAAC;QACnC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI;QACJ,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;QAC1C,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO;QACxC,kBAAkB,EAAE,KAAK,CAAC,QAAQ,EAAE,UAAU;QAC9C,oBAAoB,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY;QAClD,mBAAmB,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW;QAChD,iBAAiB,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS;QAC5C,mBAAmB;KACpB,CAAC,CAAC;IAEH,6BAA6B;IAC7B,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAE7B,uEAAuE;IACvE,sEAAsE;IACtE,kBAAkB;IAClB,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,GAAG,CAAC,EAAE;QACtB,OAAO;QACP,SAAS,EAAE,aAAa;QACxB,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE;YACR,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,mBAAmB,EAAE,GAAG,CAAC,mBAAmB;SAC7C;KACF,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAU;IAClD,kBAAkB;IAClB,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,wBAAwB;IACxB,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAAY;IACtD,kBAAkB;IAClB,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,wBAAwB;IACxB,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAU,EACV,KAA8B,EAC9B,OAAgB;IAEhB,+BAA+B;IAC/B,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,UAAU,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IAC3D,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;QAAE,UAAU,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IACtF,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS;QAAE,UAAU,CAAC,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAE5F,4EAA4E;IAC5E,uEAAuE;IACvE,sDAAsD;IACtD,IAAI,2BAAsD,CAAC;IAC3D,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QAC1E,UAAU,CAAC,mBAAmB,GAAG,UAAU,CAAC;QAE5C,uEAAuE;QACvE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC/C,IAAI,QAAQ,EAAE,CAAC;YACb,2BAA2B,GAAG,QAAQ,CAAC,mBAAmB,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,sCAAsC;IACtC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,KAAK,SAAS;YAAE,UAAU,CAAC,eAAe,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC9F,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,KAAK,SAAS;YAAE,UAAU,CAAC,kBAAkB,GAAG,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QACvG,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,KAAK,SAAS;YAAE,UAAU,CAAC,oBAAoB,GAAG,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC7G,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,KAAK,SAAS;YAAE,UAAU,CAAC,mBAAmB,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC1G,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,iBAAiB,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;IACtG,CAAC;IAED,IAAI,GAAiB,CAAC;IACtB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;YACrE,MAAM,IAAI,yBAAyB,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,wDAAwD;IACxD,MAAM,2BAA2B,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAE7B,mEAAmE;IACnE,2CAA2C;IAC3C,MAAM,aAAa,GAA4B;QAC7C,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC;KAChC,CAAC;IACF,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5C,aAAa,CAAC,2BAA2B,GAAG,2BAA2B,IAAI,IAAI,CAAC;QAChF,aAAa,CAAC,sBAAsB,GAAG,GAAG,CAAC,mBAAmB,CAAC;IACjE,CAAC;IACD,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,GAAG,CAAC,EAAE;QACtB,OAAO;QACP,SAAS,EAAE,aAAa;QACxB,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE,aAAa;KACxB,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAU,EACV,QAAuB,EACvB,OAAgB;IAEhB,MAAM,UAAU,GAA4B,EAAE,CAAC;IAC/C,IAAI,QAAQ,CAAC,OAAO,KAAK,SAAS;QAAE,UAAU,CAAC,eAAe,GAAG,QAAQ,CAAC,OAAO,CAAC;IAClF,IAAI,QAAQ,CAAC,UAAU,KAAK,SAAS;QAAE,UAAU,CAAC,kBAAkB,GAAG,QAAQ,CAAC,UAAU,CAAC;IAC3F,IAAI,QAAQ,CAAC,YAAY,KAAK,SAAS;QAAE,UAAU,CAAC,oBAAoB,GAAG,QAAQ,CAAC,YAAY,CAAC;IACjG,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,UAAU,CAAC,mBAAmB,GAAG,QAAQ,CAAC,WAAW,CAAC;IAC9F,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;QAAE,UAAU,CAAC,iBAAiB,GAAG,QAAQ,CAAC,SAAS,CAAC;IAExF,IAAI,GAAiB,CAAC;IACtB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,KAAK,wBAAwB,EAAE,CAAC;YACrE,MAAM,IAAI,yBAAyB,CAAC,EAAE,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,2BAA2B,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACpD,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAE7B,8BAA8B;IAC9B,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,GAAG,CAAC,EAAE;QACtB,OAAO;QACP,SAAS,EAAE,sBAAsB;QACjC,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;KAC9C,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CAAC,EAAU;IAC9C,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAClD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAU,EACV,MAAe,EACf,OAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAE7C,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QACrB,MAAM,IAAI,2BAA2B,CAAC,8CAA8C,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,2BAA2B,CAAC,mCAAmC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,2BAA2B,CAAC,4CAA4C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC9C,MAAM,2BAA2B,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAEpD,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,GAAG,CAAC,EAAE;QACtB,OAAO;QACP,SAAS,EAAE,eAAe;QAC1B,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE;KACrC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAU,EACV,OAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAE7C,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,2BAA2B,CAAC,6CAA6C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3C,MAAM,2BAA2B,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAEpD,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,GAAG,CAAC,EAAE;QACtB,OAAO;QACP,SAAS,EAAE,eAAe;QAC1B,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAU,EACV,OAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAE7C,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QACrB,MAAM,IAAI,2BAA2B,CAAC,6CAA6C,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,2BAA2B,CAAC,kCAAkC,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;IAC7C,MAAM,2BAA2B,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAEpD,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,GAAG,CAAC,EAAE;QACtB,OAAO;QACP,SAAS,EAAE,cAAc;QACzB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAU,EACV,OAAgB;IAEhB,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAE7C,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC9B,MAAM,IAAI,2BAA2B,CAAC,4CAA4C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,UAAU,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3C,MAAM,2BAA2B,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAEpD,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,GAAG,CAAC,EAAE;QACtB,OAAO;QACP,SAAS,EAAE,cAAc;QACzB,aAAa,EAAE,OAAO;KACvB,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,OAAO;AACP,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAiC;IAEjC,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAuC;IAEvC,OAAO,cAAc,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAY,EACZ,SAAkB;IAElB,wCAAwC;IACxC,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,4BAA4B;IAC5B,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAChD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAa;IAClD,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,OAAgB;IAEhB,iDAAiD;IACjD,IAAI,GAAG,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,sDAAsD;IACtD,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QACrB,MAAM,IAAI,2BAA2B,CACnC,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEzD,4EAA4E;IAC5E,MAAM,aAAa,CAAC;QAClB,cAAc,EAAE,GAAG,CAAC,EAAE;QACtB,OAAO;QACP,SAAS,EAAE,eAAe;QAC1B,aAAa,EAAE,OAAO;QACtB,QAAQ,EAAE;YACR,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,aAAa;SACd;KACF,CAAC,CAAC;IAEH,4CAA4C;IAC5C,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,2BAA2B,CACnC,+DAA+D,CAChE,CAAC;IACJ,CAAC;IAED,sBAAsB;IACtB,MAAM,2BAA2B,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAEpD,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;AAC9C,CAAC"}

package/dist/organizations/slugs.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Slug generation and validation utilities.
+ *
+ * Organization slugs are URL-safe identifiers used in path-based
+ * multi-tenancy (e.g., /{slug}/.well-known/openid-configuration).
+ * They must be 3–100 characters, lowercase alphanumeric with hyphens,
+ * and cannot be a reserved system word.
+ *
+ * This module provides:
+ * - `generateSlug(name)` — Derive a slug from an organization name
+ * - `validateSlug(slug)` — Check format and reserved-word rules
+ * - `RESERVED_SLUGS` — The set of words that cannot be used as slugs
+ */
+/**
+ * Reserved slugs that cannot be used as organization slugs.
+ * These conflict with system routes, well-known paths, or
+ * could cause confusion with internal functionality.
+ */
+export declare const RESERVED_SLUGS: ReadonlySet<string>;
+/**
+ * Generate a URL-safe slug from an organization name.
+ *
+ * Transformation rules:
+ * 1. Convert to lowercase
+ * 2. Replace non-alphanumeric characters with hyphens
+ * 3. Collapse multiple consecutive hyphens into one
+ * 4. Trim leading and trailing hyphens
+ * 5. Truncate to 100 characters (trimming trailing hyphens after truncation)
+ *
+ * Returns an empty string for empty/whitespace-only input — the caller
+ * (service layer) is responsible for validation.
+ *
+ * @param name - Organization name to derive a slug from
+ * @returns Generated slug string
+ */
+export declare function generateSlug(name: string): string;
+/** Result of slug validation — isValid flag with optional error message */
+export interface SlugValidationResult {
+    isValid: boolean;
+    error?: string;
+}
+/**
+ * Validate a slug against format and reserved word rules.
+ *
+ * Checks (in order):
+ * 1. Minimum length (3 characters)
+ * 2. Maximum length (100 characters)
+ * 3. Format (lowercase alphanumeric + hyphens, no leading/trailing hyphens)
+ * 4. Not a reserved word
+ *
+ * Does NOT check uniqueness — that's the repository/service layer's job.
+ *
+ * @param slug - Slug string to validate
+ * @returns Object with isValid boolean and optional error message
+ */
+export declare function validateSlug(slug: string): SlugValidationResult;
+//# sourceMappingURL=slugs.d.ts.map

package/dist/organizations/slugs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slugs.d.ts","sourceRoot":"","sources":["../../src/organizations/slugs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAAE,WAAW,CAAC,MAAM,CA8B7C,CAAC;AAiBH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgBjD;AAMD,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,oBAAoB,CA2B/D"}