@rpcbase/db 0.148.0 → 0.150.0

package/dist/acl/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["AbilityBuilder","AclContext","AclSubjectType","AppAbility","AclPolicy","subject","Exclude","define","builder","ctx","POLICIES_GLOBAL_KEY","Symbol","for","getGlobalPoliciesMap","Map","Set","store","globalThis","Record","existing","created","policiesBySubject","isPolicy","value","maybe","Partial","registerPolicy","policy","set","get","add","registerPoliciesFromModules","modules","exportName","Object","entries","endsWith","Error","expectedSubject","slice","length","getRegisteredPolicies","Array","out","values","fn","push","hasRegisteredPolicy","has","AbilityBuilder","createMongoAbility","getRegisteredPolicies","AclContext","AppAbility","buildAbility","ctx","builder","can","roles","includes","define","build","buildAbility","AppAbility","TenantRolesByTenantId","SessionUserLike","id","signedInTenants","tenantRoles","SessionLike","user","normalizeRole","raw","normalized","trim","normalizeRoles","Array","isArray","map","filter","r","Boolean","role","normalizeRolesByTenantId","Map","Object","fromEntries","from","entries","key","value","String","obj","Record","out","tenantId","getTenantRolesFromSessionUser","rolesByTenantId","buildAbilityFromSession","session","claims","userId","hasExplicitTenantEntry","prototype","hasOwnProperty","call","signedInTenantsRaw","roles","includes","accessibleBy","AclAction","AclSubjectType","AppAbility","getAccessibleByQuery","ability","action","subject","Exclude","Record","ofType"],"sources":["../../src/acl/registry.ts","../../src/acl/buildAbility.ts","../../src/acl/session.ts","../../src/acl/accessible.ts","../../src/acl/can.ts"],"sourcesContent":["import type { AbilityBuilder } from \"@casl/ability\"\n\nimport type { AclContext, AclSubjectType, AppAbility } from \"./types\"\n\n\nexport type AclPolicy = {\n  subject: Exclude<AclSubjectType, \"all\">\n  define: (builder: AbilityBuilder<AppAbility>, ctx: AclContext) => void\n}\n\nconst POLICIES_GLOBAL_KEY = Symbol.for(\"@rpcbase/db/acl/policiesBySubject\")\n\nconst getGlobalPoliciesMap = (): Map<string, Set<AclPolicy[\"define\"]>> => {\n  const store = globalThis as unknown as Record<symbol, unknown>\n  const existing = store[POLICIES_GLOBAL_KEY]\n  if (existing instanceof Map) {\n    return existing as Map<string, Set<AclPolicy[\"define\"]>>\n  }\n  const created = new Map<string, Set<AclPolicy[\"define\"]>>()\n  store[POLICIES_GLOBAL_KEY] = created\n  return created\n}\n\nconst policiesBySubject = getGlobalPoliciesMap()\n\nconst isPolicy = (value: unknown): value is AclPolicy => {\n  if (!value || typeof value !== \"object\") return false\n  const maybe = value as Partial<AclPolicy>\n  return typeof maybe.subject === \"string\" && typeof maybe.define === \"function\"\n}\n\nexport const registerPolicy = (policy: AclPolicy): void => {\n  const set = policiesBySubject.get(policy.subject) ?? new Set<AclPolicy[\"define\"]>()\n  set.add(policy.define)\n  policiesBySubject.set(policy.subject, set)\n}\n\nexport const registerPoliciesFromModules = (modules: Record<string, unknown>): void => {\n  for (const [exportName, value] of Object.entries(modules)) {\n    if (!isPolicy(value)) continue\n\n    if (!exportName.endsWith(\"Policy\")) {\n      throw new Error(\n        `Invalid policy export name \"${exportName}\". Policies must be exported as \"<ModelName>Policy\".`,\n      )\n    }\n\n    const expectedSubject = exportName.slice(0, -(\"Policy\".length))\n    if (value.subject !== expectedSubject) {\n      throw new Error(\n        `Invalid policy \"${exportName}\": expected subject \"${expectedSubject}\", got \"${value.subject}\".`,\n      )\n    }\n\n    registerPolicy(value)\n  }\n}\n\nexport const getRegisteredPolicies = (): Array<AclPolicy[\"define\"]> => {\n  const out: Array<AclPolicy[\"define\"]> = []\n  for (const set of policiesBySubject.values()) {\n    for (const fn of set) out.push(fn)\n  }\n  return out\n}\n\nexport const hasRegisteredPolicy = (subject: string): boolean => {\n  return policiesBySubject.has(subject)\n}\n","import { AbilityBuilder, createMongoAbility } from \"@casl/ability\"\n\nimport { getRegisteredPolicies } from \"./registry\"\nimport type { AclContext, AppAbility } from \"./types\"\n\n\nexport const buildAbility = (ctx: AclContext): AppAbility => {\n  const builder = new AbilityBuilder<AppAbility>(createMongoAbility)\n\n  const { can } = builder\n\n  if (ctx.roles.includes(\"owner\") || ctx.roles.includes(\"admin\")) {\n    can(\"manage\", \"all\")\n  }\n\n  for (const define of getRegisteredPolicies()) {\n    define(builder, ctx)\n  }\n\n  return builder.build()\n}\n\n","import { buildAbility } from \"./buildAbility\"\nimport type { AppAbility, TenantRolesByTenantId } from \"./types\"\n\n\ntype SessionUserLike = {\n  id?: unknown\n  signedInTenants?: unknown\n  tenantRoles?: unknown\n}\n\ntype SessionLike = {\n  user?: SessionUserLike\n}\n\nconst normalizeRole = (raw: unknown): string | null => {\n  if (typeof raw !== \"string\") return null\n  const normalized = raw.trim()\n  return normalized ? normalized : null\n}\n\nconst normalizeRoles = (raw: unknown): string[] => {\n  if (Array.isArray(raw)) {\n    return raw.map(normalizeRole).filter((r): r is string => Boolean(r))\n  }\n  const role = normalizeRole(raw)\n  return role ? [role] : []\n}\n\nconst normalizeRolesByTenantId = (raw: unknown): TenantRolesByTenantId | null => {\n  if (!raw || typeof raw !== \"object\") return null\n  if (raw instanceof Map) {\n    return Object.fromEntries(Array.from(raw.entries()).map(([key, value]) => [String(key), normalizeRoles(value)]))\n  }\n  const obj = raw as Record<string, unknown>\n  const out: TenantRolesByTenantId = {}\n  for (const [key, value] of Object.entries(obj)) {\n    const tenantId = String(key).trim()\n    if (!tenantId) continue\n    out[tenantId] = normalizeRoles(value)\n  }\n  return out\n}\n\nexport const getTenantRolesFromSessionUser = (user: unknown, tenantId: string): string[] => {\n  if (!user || typeof user !== \"object\") return []\n  const rolesByTenantId = normalizeRolesByTenantId((user as SessionUserLike).tenantRoles)\n  if (!rolesByTenantId) return []\n  return rolesByTenantId[tenantId]?.filter(Boolean) ?? []\n}\n\nexport const buildAbilityFromSession = ({\n  tenantId,\n  session,\n  claims,\n}: {\n  tenantId: string\n  session: SessionLike | null | undefined\n  claims?: Record<string, unknown>\n}): AppAbility => {\n  const user = session?.user\n  const userId = typeof user?.id === \"string\" ? user.id.trim() : \"\"\n  const rolesByTenantId = normalizeRolesByTenantId(user?.tenantRoles)\n  const hasExplicitTenantEntry = Boolean(\n    rolesByTenantId && Object.prototype.hasOwnProperty.call(rolesByTenantId, tenantId),\n  )\n\n  const signedInTenantsRaw = user?.signedInTenants\n  const signedInTenants = Array.isArray(signedInTenantsRaw) ? signedInTenantsRaw.map(String) : []\n\n  const roles = hasExplicitTenantEntry\n    ? rolesByTenantId![tenantId] ?? []\n    : userId && signedInTenants.includes(tenantId)\n      ? [\"owner\"]\n      : getTenantRolesFromSessionUser(user, tenantId)\n\n  return buildAbility({\n    tenantId,\n    userId: userId || null,\n    roles,\n    claims,\n  })\n}\n","import { accessibleBy } from \"@casl/mongoose\"\n\nimport type { AclAction, AclSubjectType, AppAbility } from \"./types\"\n\n\nexport const getAccessibleByQuery = (\n  ability: AppAbility,\n  action: AclAction,\n  subject: Exclude<AclSubjectType, \"all\">,\n): Record<string, unknown> => {\n  return accessibleBy(ability, action).ofType(subject)\n}\n","import { subject } from \"@casl/ability\"\n\nimport type { AclAction, AclSubject, AclSubjectMap, AclSubjectType, AppAbility } from \"./types\"\n\n\nexport const can = <TSubject extends Exclude<AclSubjectType, \"all\">>(\n  ability: AppAbility,\n  action: AclAction,\n  subjectType: TSubject,\n  object?: Partial<AclSubjectMap[TSubject]> | null,\n): boolean => {\n  if (object && typeof object === \"object\") {\n    return ability.can(action, subject(subjectType, object) as unknown as AclSubject)\n  }\n  return ability.can(action, subjectType)\n}\n"],"mappings":";;;AAUA,IAAMU,sBAAsBC,OAAOC,IAAI,mCAAmC;AAE1E,IAAMC,6BAAoE;CACxE,MAAMG,QAAQC;CACd,MAAME,WAAWH,MAAMN;CACvB,IAAIS,oBAAoBL,KACtB,OAAOK;CAET,MAAMC,0BAAU,IAAIN,IAAsC;CAC1DE,MAAMN,uBAAuBU;CAC7B,OAAOA;AACT;AAEA,IAAMC,oBAAoBR,qBAAqB;AAE/C,IAAMS,YAAYC,UAAuC;CACvD,IAAI,CAACA,SAAS,OAAOA,UAAU,UAAU,OAAO;CAChD,MAAMC,QAAQD;CACd,OAAO,OAAOC,MAAMnB,YAAY,YAAY,OAAOmB,MAAMjB,WAAW;AACtE;AAEA,IAAamB,kBAAkBC,WAA4B;CACzD,MAAMC,MAAMP,kBAAkBQ,IAAIF,OAAOtB,OAAO,qBAAK,IAAIU,IAAyB;CAClFa,IAAIE,IAAIH,OAAOpB,MAAM;CACrBc,kBAAkBO,IAAID,OAAOtB,SAASuB,GAAG;AAC3C;AAEA,IAAaG,+BAA+BC,YAA2C;CACrF,KAAK,MAAM,CAACC,YAAYV,UAAUW,OAAOC,QAAQH,OAAO,GAAG;EACzD,IAAI,CAACV,SAASC,KAAK,GAAG;EAEtB,IAAI,CAACU,WAAWG,SAAS,QAAQ,GAC/B,MAAM,IAAIC,MACR,+BAA+BJ,WAAU,qDAC3C;EAGF,MAAMK,kBAAkBL,WAAWM,MAAM,GAAG,EAAkB;EAC9D,IAAIhB,MAAMlB,YAAYiC,iBACpB,MAAM,IAAID,MACR,mBAAmBJ,WAAU,uBAAwBK,gBAAe,UAAWf,MAAMlB,QAAO,GAC9F;EAGFqB,eAAeH,KAAK;CACtB;AACF;AAEA,IAAakB,8BAA0D;CACrE,MAAME,MAAkC,CAAA;CACxC,KAAK,MAAMf,OAAOP,kBAAkBuB,OAAO,GACzC,KAAK,MAAMC,MAAMjB,KAAKe,IAAIG,KAAKD,EAAE;CAEnC,OAAOF;AACT;AAEA,IAAaI,uBAAuB1C,YAA6B;CAC/D,OAAOgB,kBAAkB2B,IAAI3C,OAAO;AACtC;;;AC9DA,IAAaiD,gBAAgBC,QAAgC;CAC3D,MAAMC,UAAU,IAAIP,eAA2BC,kBAAkB;CAEjE,MAAM,EAAEO,QAAQD;CAEhB,IAAID,IAAIG,MAAMC,SAAS,OAAO,KAAKJ,IAAIG,MAAMC,SAAS,OAAO,GAC3DF,IAAI,UAAU,KAAK;CAGrB,KAAK,MAAMG,UAAUT,sBAAsB,GACzCS,OAAOJ,SAASD,GAAG;CAGrB,OAAOC,QAAQK,MAAM;AACvB;;;ACNA,IAAMU,iBAAiBC,QAAgC;CACrD,IAAI,OAAOA,QAAQ,UAAU,OAAO;CACpC,MAAMC,aAAaD,IAAIE,KAAK;CAC5B,OAAOD,aAAaA,aAAa;AACnC;AAEA,IAAME,kBAAkBH,QAA2B;CACjD,IAAII,MAAMC,QAAQL,GAAG,GACnB,OAAOA,IAAIM,IAAIP,aAAa,CAAC,CAACQ,QAAQC,MAAmBC,QAAQD,CAAC,CAAC;CAErE,MAAME,OAAOX,cAAcC,GAAG;CAC9B,OAAOU,OAAO,CAACA,IAAI,IAAI,CAAA;AACzB;AAEA,IAAMC,4BAA4BX,QAA+C;CAC/E,IAAI,CAACA,OAAO,OAAOA,QAAQ,UAAU,OAAO;CAC5C,IAAIA,eAAeY,KACjB,OAAOC,OAAOC,YAAYV,MAAMW,KAAKf,IAAIgB,QAAQ,CAAC,CAAC,CAACV,KAAK,CAACW,KAAKC,WAAW,CAACC,OAAOF,GAAG,GAAGd,eAAee,KAAK,CAAC,CAAC,CAAC;CAEjH,MAAME,MAAMpB;CACZ,MAAMsB,MAA6B,CAAC;CACpC,KAAK,MAAM,CAACL,KAAKC,UAAUL,OAAOG,QAAQI,GAAG,GAAG;EAC9C,MAAMG,WAAWJ,OAAOF,GAAG,CAAC,CAACf,KAAK;EAClC,IAAI,CAACqB,UAAU;EACfD,IAAIC,YAAYpB,eAAee,KAAK;CACtC;CACA,OAAOI;AACT;AAEA,IAAaE,iCAAiC1B,MAAeyB,aAA+B;CAC1F,IAAI,CAACzB,QAAQ,OAAOA,SAAS,UAAU,OAAO,CAAA;CAC9C,MAAM2B,kBAAkBd,yBAA0Bb,KAAyBF,WAAW;CACtF,IAAI,CAAC6B,iBAAiB,OAAO,CAAA;CAC7B,OAAOA,gBAAgBF,SAAS,EAAEhB,OAAOE,OAAO,KAAK,CAAA;AACvD;AAEA,IAAaiB,2BAA2B,EACtCH,UACAI,SACAC,aAKgB;CAChB,MAAM9B,OAAO6B,SAAS7B;CACtB,MAAM+B,SAAS,OAAO/B,MAAMJ,OAAO,WAAWI,KAAKJ,GAAGQ,KAAK,IAAI;CAC/D,MAAMuB,kBAAkBd,yBAAyBb,MAAMF,WAAW;CAClE,MAAMkC,yBAAyBrB,QAC7BgB,mBAAmBZ,OAAOkB,UAAUC,eAAeC,KAAKR,iBAAiBF,QAAQ,CACnF;CAEA,MAAMW,qBAAqBpC,MAAMH;CACjC,MAAMA,kBAAkBS,MAAMC,QAAQ6B,kBAAkB,IAAIA,mBAAmB5B,IAAIa,MAAM,IAAI,CAAA;CAE7F,MAAMgB,QAAQL,yBACVL,gBAAiBF,aAAa,CAAA,IAC9BM,UAAUlC,gBAAgByC,SAASb,QAAQ,IACzC,CAAC,OAAO,IACRC,8BAA8B1B,MAAMyB,QAAQ;CAElD,OAAOjC,aAAa;EAClBiC;EACAM,QAAQA,UAAU;EAClBM;EACAP;CACF,CAAC;AACH;;;AC5EA,IAAaa,wBACXC,SACAC,QACAC,YAC4B;CAC5B,OAAOP,aAAaK,SAASC,MAAM,CAAC,CAACI,OAAOH,OAAO;AACrD;;;ACNA,IAAa,OACX,SACA,QACA,aACA,WACY;CACZ,IAAI,UAAU,OAAO,WAAW,UAC9B,OAAO,QAAQ,IAAI,QAAQ,QAAQ,aAAa,MAAM,CAA0B;CAElF,OAAO,QAAQ,IAAI,QAAQ,WAAW;AACxC"}
+{"version":3,"file":"index.js","names":[],"sources":["../../src/acl/registry.ts","../../src/acl/buildAbility.ts","../../src/acl/session.ts","../../src/acl/accessible.ts","../../src/acl/can.ts"],"sourcesContent":["import type { AbilityBuilder } from \"@casl/ability\"\n\nimport type { AclContext, AclSubjectType, AppAbility } from \"./types\"\n\n\nexport type AclPolicy = {\n  subject: Exclude<AclSubjectType, \"all\">\n  define: (builder: AbilityBuilder<AppAbility>, ctx: AclContext) => void\n}\n\nconst POLICIES_GLOBAL_KEY = Symbol.for(\"@rpcbase/db/acl/policiesBySubject\")\n\nconst getGlobalPoliciesMap = (): Map<string, Set<AclPolicy[\"define\"]>> => {\n  const store = globalThis as unknown as Record<symbol, unknown>\n  const existing = store[POLICIES_GLOBAL_KEY]\n  if (existing instanceof Map) {\n    return existing as Map<string, Set<AclPolicy[\"define\"]>>\n  }\n  const created = new Map<string, Set<AclPolicy[\"define\"]>>()\n  store[POLICIES_GLOBAL_KEY] = created\n  return created\n}\n\nconst policiesBySubject = getGlobalPoliciesMap()\n\nconst isPolicy = (value: unknown): value is AclPolicy => {\n  if (!value || typeof value !== \"object\") return false\n  const maybe = value as Partial<AclPolicy>\n  return typeof maybe.subject === \"string\" && typeof maybe.define === \"function\"\n}\n\nexport const registerPolicy = (policy: AclPolicy): void => {\n  const set = policiesBySubject.get(policy.subject) ?? new Set<AclPolicy[\"define\"]>()\n  set.add(policy.define)\n  policiesBySubject.set(policy.subject, set)\n}\n\nexport const registerPoliciesFromModules = (modules: Record<string, unknown>): void => {\n  for (const [exportName, value] of Object.entries(modules)) {\n    if (!isPolicy(value)) continue\n\n    if (!exportName.endsWith(\"Policy\")) {\n      throw new Error(\n        `Invalid policy export name \"${exportName}\". Policies must be exported as \"<ModelName>Policy\".`,\n      )\n    }\n\n    const expectedSubject = exportName.slice(0, -(\"Policy\".length))\n    if (value.subject !== expectedSubject) {\n      throw new Error(\n        `Invalid policy \"${exportName}\": expected subject \"${expectedSubject}\", got \"${value.subject}\".`,\n      )\n    }\n\n    registerPolicy(value)\n  }\n}\n\nexport const getRegisteredPolicies = (): Array<AclPolicy[\"define\"]> => {\n  const out: Array<AclPolicy[\"define\"]> = []\n  for (const set of policiesBySubject.values()) {\n    for (const fn of set) out.push(fn)\n  }\n  return out\n}\n\nexport const hasRegisteredPolicy = (subject: string): boolean => {\n  return policiesBySubject.has(subject)\n}\n","import { AbilityBuilder, createMongoAbility } from \"@casl/ability\"\n\nimport { getRegisteredPolicies } from \"./registry\"\nimport type { AclContext, AppAbility } from \"./types\"\n\n\nexport const buildAbility = (ctx: AclContext): AppAbility => {\n  const builder = new AbilityBuilder<AppAbility>(createMongoAbility)\n\n  const { can } = builder\n\n  if (ctx.roles.includes(\"owner\") || ctx.roles.includes(\"admin\")) {\n    can(\"manage\", \"all\")\n  }\n\n  for (const define of getRegisteredPolicies()) {\n    define(builder, ctx)\n  }\n\n  return builder.build()\n}\n\n","import { buildAbility } from \"./buildAbility\"\nimport type { AppAbility, TenantRolesByTenantId } from \"./types\"\n\n\ntype SessionUserLike = {\n  id?: unknown\n  signedInTenants?: unknown\n  tenantRoles?: unknown\n}\n\ntype SessionLike = {\n  user?: SessionUserLike\n}\n\nconst normalizeRole = (raw: unknown): string | null => {\n  if (typeof raw !== \"string\") return null\n  const normalized = raw.trim()\n  return normalized ? normalized : null\n}\n\nconst normalizeRoles = (raw: unknown): string[] => {\n  if (Array.isArray(raw)) {\n    return raw.map(normalizeRole).filter((r): r is string => Boolean(r))\n  }\n  const role = normalizeRole(raw)\n  return role ? [role] : []\n}\n\nconst normalizeRolesByTenantId = (raw: unknown): TenantRolesByTenantId | null => {\n  if (!raw || typeof raw !== \"object\") return null\n  if (raw instanceof Map) {\n    return Object.fromEntries(Array.from(raw.entries()).map(([key, value]) => [String(key), normalizeRoles(value)]))\n  }\n  const obj = raw as Record<string, unknown>\n  const out: TenantRolesByTenantId = {}\n  for (const [key, value] of Object.entries(obj)) {\n    const tenantId = String(key).trim()\n    if (!tenantId) continue\n    out[tenantId] = normalizeRoles(value)\n  }\n  return out\n}\n\nexport const getTenantRolesFromSessionUser = (user: unknown, tenantId: string): string[] => {\n  if (!user || typeof user !== \"object\") return []\n  const rolesByTenantId = normalizeRolesByTenantId((user as SessionUserLike).tenantRoles)\n  if (!rolesByTenantId) return []\n  return rolesByTenantId[tenantId]?.filter(Boolean) ?? []\n}\n\nexport const buildAbilityFromSession = ({\n  tenantId,\n  session,\n  claims,\n}: {\n  tenantId: string\n  session: SessionLike | null | undefined\n  claims?: Record<string, unknown>\n}): AppAbility => {\n  const user = session?.user\n  const userId = typeof user?.id === \"string\" ? user.id.trim() : \"\"\n  const rolesByTenantId = normalizeRolesByTenantId(user?.tenantRoles)\n  const hasExplicitTenantEntry = Boolean(\n    rolesByTenantId && Object.prototype.hasOwnProperty.call(rolesByTenantId, tenantId),\n  )\n\n  const signedInTenantsRaw = user?.signedInTenants\n  const signedInTenants = Array.isArray(signedInTenantsRaw) ? signedInTenantsRaw.map(String) : []\n\n  const roles = hasExplicitTenantEntry\n    ? rolesByTenantId![tenantId] ?? []\n    : userId && signedInTenants.includes(tenantId)\n      ? [\"owner\"]\n      : getTenantRolesFromSessionUser(user, tenantId)\n\n  return buildAbility({\n    tenantId,\n    userId: userId || null,\n    roles,\n    claims,\n  })\n}\n","import { accessibleBy } from \"@casl/mongoose\"\n\nimport type { AclAction, AclSubjectType, AppAbility } from \"./types\"\n\n\nexport const getAccessibleByQuery = (\n  ability: AppAbility,\n  action: AclAction,\n  subject: Exclude<AclSubjectType, \"all\">,\n): Record<string, unknown> => {\n  return accessibleBy(ability, action).ofType(subject)\n}\n","import { subject } from \"@casl/ability\"\n\nimport type { AclAction, AclSubject, AclSubjectMap, AclSubjectType, AppAbility } from \"./types\"\n\n\nexport const can = <TSubject extends Exclude<AclSubjectType, \"all\">>(\n  ability: AppAbility,\n  action: AclAction,\n  subjectType: TSubject,\n  object?: Partial<AclSubjectMap[TSubject]> | null,\n): boolean => {\n  if (object && typeof object === \"object\") {\n    return ability.can(action, subject(subjectType, object) as unknown as AclSubject)\n  }\n  return ability.can(action, subjectType)\n}\n"],"mappings":";;;AAUA,IAAM,sBAAsB,OAAO,IAAI,mCAAmC;AAE1E,IAAM,6BAAoE;CACxE,MAAM,QAAQ;CACd,MAAM,WAAW,MAAM;CACvB,IAAI,oBAAoB,KACtB,OAAO;CAET,MAAM,0BAAU,IAAI,IAAsC;CAC1D,MAAM,uBAAuB;CAC7B,OAAO;AACT;AAEA,IAAM,oBAAoB,qBAAqB;AAE/C,IAAM,YAAY,UAAuC;CACvD,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,MAAM,QAAQ;CACd,OAAO,OAAO,MAAM,YAAY,YAAY,OAAO,MAAM,WAAW;AACtE;AAEA,IAAa,kBAAkB,WAA4B;CACzD,MAAM,MAAM,kBAAkB,IAAI,OAAO,OAAO,qBAAK,IAAI,IAAyB;CAClF,IAAI,IAAI,OAAO,MAAM;CACrB,kBAAkB,IAAI,OAAO,SAAS,GAAG;AAC3C;AAEA,IAAa,+BAA+B,YAA2C;CACrF,KAAK,MAAM,CAAC,YAAY,UAAU,OAAO,QAAQ,OAAO,GAAG;EACzD,IAAI,CAAC,SAAS,KAAK,GAAG;EAEtB,IAAI,CAAC,WAAW,SAAS,QAAQ,GAC/B,MAAM,IAAI,MACR,+BAA+B,WAAU,qDAC3C;EAGF,MAAM,kBAAkB,WAAW,MAAM,GAAG,EAAkB;EAC9D,IAAI,MAAM,YAAY,iBACpB,MAAM,IAAI,MACR,mBAAmB,WAAU,uBAAwB,gBAAe,UAAW,MAAM,QAAO,GAC9F;EAGF,eAAe,KAAK;CACtB;AACF;AAEA,IAAa,8BAA0D;CACrE,MAAM,MAAkC,CAAA;CACxC,KAAK,MAAM,OAAO,kBAAkB,OAAO,GACzC,KAAK,MAAM,MAAM,KAAK,IAAI,KAAK,EAAE;CAEnC,OAAO;AACT;AAEA,IAAa,uBAAuB,YAA6B;CAC/D,OAAO,kBAAkB,IAAI,OAAO;AACtC;;;AC9DA,IAAa,gBAAgB,QAAgC;CAC3D,MAAM,UAAU,IAAI,eAA2B,kBAAkB;CAEjE,MAAM,EAAE,QAAQ;CAEhB,IAAI,IAAI,MAAM,SAAS,OAAO,KAAK,IAAI,MAAM,SAAS,OAAO,GAC3D,IAAI,UAAU,KAAK;CAGrB,KAAK,MAAM,UAAU,sBAAsB,GACzC,OAAO,SAAS,GAAG;CAGrB,OAAO,QAAQ,MAAM;AACvB;;;ACNA,IAAM,iBAAiB,QAAgC;CACrD,IAAI,OAAO,QAAQ,UAAU,OAAO;CACpC,MAAM,aAAa,IAAI,KAAK;CAC5B,OAAO,aAAa,aAAa;AACnC;AAEA,IAAM,kBAAkB,QAA2B;CACjD,IAAI,MAAM,QAAQ,GAAG,GACnB,OAAO,IAAI,IAAI,aAAa,CAAC,CAAC,QAAQ,MAAmB,QAAQ,CAAC,CAAC;CAErE,MAAM,OAAO,cAAc,GAAG;CAC9B,OAAO,OAAO,CAAC,IAAI,IAAI,CAAA;AACzB;AAEA,IAAM,4BAA4B,QAA+C;CAC/E,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAC5C,IAAI,eAAe,KACjB,OAAO,OAAO,YAAY,MAAM,KAAK,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,OAAO,GAAG,GAAG,eAAe,KAAK,CAAC,CAAC,CAAC;CAEjH,MAAM,MAAM;CACZ,MAAM,MAA6B,CAAC;CACpC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,GAAG,GAAG;EAC9C,MAAM,WAAW,OAAO,GAAG,CAAC,CAAC,KAAK;EAClC,IAAI,CAAC,UAAU;EACf,IAAI,YAAY,eAAe,KAAK;CACtC;CACA,OAAO;AACT;AAEA,IAAa,iCAAiC,MAAe,aAA+B;CAC1F,IAAI,CAAC,QAAQ,OAAO,SAAS,UAAU,OAAO,CAAA;CAC9C,MAAM,kBAAkB,yBAA0B,KAAyB,WAAW;CACtF,IAAI,CAAC,iBAAiB,OAAO,CAAA;CAC7B,OAAO,gBAAgB,SAAS,EAAE,OAAO,OAAO,KAAK,CAAA;AACvD;AAEA,IAAa,2BAA2B,EACtC,UACA,SACA,aAKgB;CAChB,MAAM,OAAO,SAAS;CACtB,MAAM,SAAS,OAAO,MAAM,OAAO,WAAW,KAAK,GAAG,KAAK,IAAI;CAC/D,MAAM,kBAAkB,yBAAyB,MAAM,WAAW;CAClE,MAAM,yBAAyB,QAC7B,mBAAmB,OAAO,UAAU,eAAe,KAAK,iBAAiB,QAAQ,CACnF;CAEA,MAAM,qBAAqB,MAAM;CACjC,MAAM,kBAAkB,MAAM,QAAQ,kBAAkB,IAAI,mBAAmB,IAAI,MAAM,IAAI,CAAA;CAE7F,MAAM,QAAQ,yBACV,gBAAiB,aAAa,CAAA,IAC9B,UAAU,gBAAgB,SAAS,QAAQ,IACzC,CAAC,OAAO,IACR,8BAA8B,MAAM,QAAQ;CAElD,OAAO,aAAa;EAClB;EACA,QAAQ,UAAU;EAClB;EACA;CACF,CAAC;AACH;;;AC5EA,IAAa,wBACX,SACA,QACA,YAC4B;CAC5B,OAAO,aAAa,SAAS,MAAM,CAAC,CAAC,OAAO,OAAO;AACrD;;;ACNA,IAAa,OACX,SACA,QACA,aACA,WACY;CACZ,IAAI,UAAU,OAAO,WAAW,UAC9B,OAAO,QAAQ,IAAI,QAAQ,QAAQ,aAAa,MAAM,CAA0B;CAElF,OAAO,QAAQ,IAAI,QAAQ,WAAW;AACxC"}

package/dist/index.js

@@ -1,5 +1,5 @@
 import { buildAbility, buildAbilityFromSession, can, getAccessibleByQuery, getRegisteredPolicies, getTenantRolesFromSessionUser, hasRegisteredPolicy, registerPoliciesFromModules, registerPolicy } from "./acl/index.js";
-import { t as rtsChangesTtlSeconds } from "./rtsChanges-xIGFCLGa.js";
+import { t as rtsChangesTtlSeconds } from "./rtsChanges-269ntyVt.js";
 import { a as makeZE164Phone, c as buildLocaleFallbackChain, d as zI18nString, f as zLocalizedString, i as E164_PHONE_REGEX, l as resolveLocalizedString, n as extendZod, o as zE164Phone, r as E164_PHONE_OR_EMPTY_REGEX, s as LANGUAGE_CODE_REGEX, t as z, u as withLocalizedStringFallback } from "./zod-DSnhyNso.js";
 import "./model.js";
 import { getMongoDirectConnection, getMongoUrl } from "./mongo.js";
@@ -26,7 +26,7 @@ var __exportAll = (all, no_symbols) => {
 //#endregion
 //#region src/models/RBUser.ts
 var ZRBUser = z$1.object({
-	email: z$1.string().email().optional(),
+	email: z$1.string().trim().toLowerCase().email().optional(),
 	password: z$1.string(),
 	name: z$1.string().optional(),
 	phone: z$1.string().optional(),
@@ -34,7 +34,7 @@ var ZRBUser = z$1.object({
 	tenantRoles: z$1.record(z$1.string(), z$1.array(z$1.string())).optional(),
 	oauthProviders: z$1.record(z$1.string(), z$1.object({
 		subject: z$1.string(),
-		email: z$1.string().email().optional(),
+		email: z$1.string().trim().toLowerCase().email().optional(),
 		name: z$1.string().optional(),
 		accessToken: z$1.string().optional(),
 		refreshToken: z$1.string().optional(),
@@ -46,8 +46,10 @@ var ZRBUser = z$1.object({
 		createdAt: z$1.date().optional(),
 		updatedAt: z$1.date().optional()
 	})).optional(),
+	registrationStatus: z$1.enum(["pending_verification", "active"]).optional(),
 	emailVerificationCode: z$1.string().length(6).optional(),
 	emailVerificationExpiresAt: z$1.date().optional(),
+	emailVerificationSentAt: z$1.date().optional(),
 	passwordResetCode: z$1.string().length(6).optional(),
 	passwordResetCodeExpiresAt: z$1.date().optional(),
 	passwordResetToken: z$1.string().optional(),
@@ -57,7 +59,9 @@ var RBUserSchema = new Schema$1({
 	email: {
 		type: String,
 		unique: true,
-		sparse: true
+		sparse: true,
+		trim: true,
+		lowercase: true
 	},
 	phone: {
 		type: String,
@@ -89,7 +93,9 @@ var RBUserSchema = new Schema$1({
 			},
 			email: {
 				type: String,
-				required: false
+				required: false,
+				trim: true,
+				lowercase: true
 			},
 			name: {
 				type: String,
@@ -135,6 +141,11 @@ var RBUserSchema = new Schema$1({
 		default: {},
 		required: false
 	},
+	registrationStatus: {
+		type: String,
+		enum: ["pending_verification", "active"],
+		default: "active"
+	},
 	emailVerificationCode: {
 		type: String,
 		required: false
@@ -143,6 +154,10 @@ var RBUserSchema = new Schema$1({
 		type: Date,
 		required: false
 	},
+	emailVerificationSentAt: {
+		type: Date,
+		required: false
+	},
 	passwordResetCode: {
 		type: String,
 		required: false
@@ -845,7 +860,7 @@ var ZRBNotification = z$1.object({
 	readAt: z$1.date().optional(),
 	archivedAt: z$1.date().optional()
 });
-var TTL_90_DAYS_S$1 = 3600 * 24 * 90;
+var TTL_90_DAYS_S$1 = 7776e3;
 var RBNotificationSchema = new Schema$1({
 	userId: {
 		type: String,
@@ -964,7 +979,7 @@ var ZRBNotificationDelivery = z$1.object({
 	platform: ZRBNotificationPlatformPayload.optional(),
 	createdAt: z$1.date()
 });
-var TTL_90_DAYS_S = 3600 * 24 * 90;
+var TTL_90_DAYS_S = 7776e3;
 var RBNotificationDeliverySchema = new Schema$1({
 	userId: {
 		type: String,