@rytass/bpm-core-nestjs-module 0.5.0 → 0.5.1

package/src/lib/database/reconcile-legacy-migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile-legacy-migrations.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/database/reconcile-legacy-migrations.ts"],"names":[],"mappings":";;AAoDA,sEAkCC;AApFD;;;;;;;;;;;;;GAaG;AACH,MAAM,wBAAwB,GAA6C;IACzE;QACE,uCAAuC;QACvC,uCAAuC;KACxC;IACD;QACE,6CAA6C;QAC7C,6CAA6C;KAC9C;IACD,CAAC,oCAAoC,EAAE,oCAAoC,CAAC;IAC5E;QACE,yCAAyC;QACzC,yCAAyC;KAC1C;IACD;QACE,uCAAuC;QACvC,uCAAuC;KACxC;IACD;QACE,yCAAyC;QACzC,yCAAyC;KAC1C;IACD,CAAC,6BAA6B,EAAE,6BAA6B,CAAC;CAC/D,CAAC;AAEF;;;;;;;;;;GAUG;AACI,KAAK,UAAU,6BAA6B,CACjD,UAAsB;IAEtB,MAAM,UAAU,GAAG,CAAC,MAAM,UAAU,CAAC,KAAK,CACxC,sDAAsD,CACvD,CAA4D,CAAC;IAE9D,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC;QACrC,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,UAAU,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,EAAmB,EAAE;QAC/D,OAAO,wBAAwB,CAAC,MAAM,CACpC,KAAK,EAAE,YAAY,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,EAAmB,EAAE;YACjE,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC;YACjC,MAAM,cAAc,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CACzC,kDAAkD,EAClD,CAAC,WAAW,CAAC,CACd,CAAuB,CAAC;YAEzB,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CACjC,iDAAiD,EACjD,CAAC,WAAW,EAAE,UAAU,CAAC,CAC1B,CAA+B,CAAC;YAEjC,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,CAAC,EACD,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CACnB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/src/lib/database/typeorm.config.d.ts

@@ -0,0 +1,14 @@
+import { TypeOrmModuleOptions } from '@nestjs/typeorm';
+import { VaultService } from '@rytass/secret-adapter-vault-nestjs';
+import { DataSourceOptions } from 'typeorm';
+export interface BPMDatabaseConnectionOptions {
+    readonly host: string;
+    readonly port: number;
+    readonly username: string;
+    readonly password: string;
+    readonly database: string;
+    readonly schema: string;
+}
+export declare function buildTypeOrmModuleOptions(vault: VaultService): Promise<TypeOrmModuleOptions>;
+export declare function buildDataSourceOptionsFromVaultEnv(env: NodeJS.ProcessEnv): Promise<DataSourceOptions>;
+export declare function buildBPMDataSourceOptions(secrets: BPMDatabaseConnectionOptions): DataSourceOptions;

package/src/lib/database/typeorm.config.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildTypeOrmModuleOptions = buildTypeOrmModuleOptions;
+exports.buildDataSourceOptionsFromVaultEnv = buildDataSourceOptionsFromVaultEnv;
+exports.buildBPMDataSourceOptions = buildBPMDataSourceOptions;
+const migrations_1 = require("../migrations");
+const DEFAULT_PORT = 5432;
+const DEFAULT_VAULT_PATH = 'bpm_core/develop';
+async function buildTypeOrmModuleOptions(vault) {
+    const secrets = await readDatabaseSecretsFromVaultService(vault);
+    return {
+        ...buildBPMDataSourceOptions(secrets),
+        autoLoadEntities: true,
+    };
+}
+async function buildDataSourceOptionsFromVaultEnv(env) {
+    return buildBPMDataSourceOptions(await readDatabaseSecretsFromVaultEnv(env));
+}
+function buildBPMDataSourceOptions(secrets) {
+    return {
+        database: secrets.database,
+        entities: [],
+        host: secrets.host,
+        migrations: [...migrations_1.BPM_CORE_MIGRATIONS],
+        migrationsRun: false,
+        password: secrets.password,
+        port: secrets.port,
+        schema: secrets.schema,
+        synchronize: false,
+        type: 'postgres',
+        username: secrets.username,
+    };
+}
+async function readDatabaseSecretsFromVaultService(vault) {
+    const port = await vault.get('DB_PORT');
+    return {
+        database: await readRequiredVaultValue(vault, 'DB_NAME'),
+        host: await readRequiredVaultValue(vault, 'DB_HOST'),
+        password: await readRequiredVaultValue(vault, 'DB_PASS'),
+        port: parseDatabasePort(port),
+        schema: await readRequiredVaultValue(vault, 'DB_SCHEMA'),
+        username: await readRequiredVaultValue(vault, 'DB_USER'),
+    };
+}
+async function readRequiredVaultValue(vault, key) {
+    const value = await vault.get(key);
+    if (!value) {
+        throw new Error(`Missing required Vault secret: ${key}`);
+    }
+    return value;
+}
+async function readDatabaseSecretsFromVaultEnv(env) {
+    const vaultHost = readRequiredEnv(env, 'VAULT_HOST');
+    const vaultAccount = readRequiredEnv(env, 'VAULT_ACCOUNT');
+    const vaultPassword = readRequiredEnv(env, 'VAULT_PASSWORD');
+    const vaultPath = env.VAULT_PATH ?? DEFAULT_VAULT_PATH;
+    const vaultToken = await loginVault(vaultHost, vaultAccount, vaultPassword);
+    const secrets = await readVaultKvSecret(vaultHost, vaultToken, vaultPath);
+    return {
+        database: readRequiredSecret(secrets, 'DB_NAME'),
+        host: readRequiredSecret(secrets, 'DB_HOST'),
+        password: readRequiredSecret(secrets, 'DB_PASS'),
+        port: parseDatabasePort(readOptionalSecret(secrets, 'DB_PORT')),
+        schema: readRequiredSecret(secrets, 'DB_SCHEMA'),
+        username: readRequiredSecret(secrets, 'DB_USER'),
+    };
+}
+function readRequiredEnv(env, key) {
+    const value = env[key];
+    if (!value) {
+        throw new Error(`Missing required environment variable: ${key}`);
+    }
+    return value;
+}
+async function loginVault(vaultHost, account, password) {
+    const response = await fetch(`${trimTrailingSlash(vaultHost)}/v1/auth/userpass/login/${account}`, {
+        body: JSON.stringify({ password }),
+        headers: { 'Content-Type': 'application/json' },
+        method: 'POST',
+    });
+    if (!response.ok) {
+        throw new Error(`Vault login failed with HTTP ${response.status}`);
+    }
+    const payload = (await response.json());
+    const auth = payload.auth;
+    if (!isRecord(auth) || typeof auth.client_token !== 'string') {
+        throw new Error('Vault login response did not include a client token');
+    }
+    return auth.client_token;
+}
+async function readVaultKvSecret(vaultHost, token, path) {
+    const response = await fetch(`${trimTrailingSlash(vaultHost)}/v1/secret/data/${path}`, {
+        headers: { 'X-Vault-Token': token },
+        method: 'GET',
+    });
+    if (!response.ok) {
+        throw new Error(`Vault secret read failed with HTTP ${response.status}`);
+    }
+    const payload = (await response.json());
+    const data = payload.data;
+    if (!isRecord(data) || !isRecord(data.data)) {
+        throw new Error('Vault KV response did not include secret data');
+    }
+    return Object.entries(data.data).reduce((accumulator, [key, value]) => ({
+        ...accumulator,
+        ...(typeof value === 'string' ? { [key]: value } : {}),
+    }), {});
+}
+function readRequiredSecret(secrets, key) {
+    const value = secrets[key];
+    if (!value) {
+        throw new Error(`Missing required Vault secret: ${key}`);
+    }
+    return value;
+}
+function readOptionalSecret(secrets, key) {
+    return secrets[key];
+}
+function parseDatabasePort(value) {
+    if (!value) {
+        return DEFAULT_PORT;
+    }
+    const port = Number(value);
+    if (!Number.isInteger(port) || port <= 0) {
+        return DEFAULT_PORT;
+    }
+    return port;
+}
+function trimTrailingSlash(value) {
+    return value.replace(/\/+$/, '');
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}
+//# sourceMappingURL=typeorm.config.js.map

package/src/lib/database/typeorm.config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"typeorm.config.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/database/typeorm.config.ts"],"names":[],"mappings":";;AAsBA,8DASC;AAED,gFAIC;AAED,8DAgBC;AApDD,8CAAoD;AAEpD,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAgBvC,KAAK,UAAU,yBAAyB,CAC7C,KAAmB;IAEnB,MAAM,OAAO,GAAG,MAAM,mCAAmC,CAAC,KAAK,CAAC,CAAC;IAEjE,OAAO;QACL,GAAG,yBAAyB,CAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAI;KACvB,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,kCAAkC,CACtD,GAAsB;IAEtB,OAAO,yBAAyB,CAAC,MAAM,+BAA+B,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAgB,yBAAyB,CACvC,OAAqC;IAErC,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,EAAE;QACZ,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,CAAC,GAAG,gCAAmB,CAAC;QACpC,aAAa,EAAE,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,KAAK;QAClB,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mCAAmC,CAChD,KAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAS,SAAS,CAAC,CAAC;IAEhD,OAAO;QACL,QAAQ,EAAE,MAAM,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC;QACxD,IAAI,EAAE,MAAM,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC;QACpD,QAAQ,EAAE,MAAM,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC;QACxD,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC;QAC7B,MAAM,EAAE,MAAM,sBAAsB,CAAC,KAAK,EAAE,WAAW,CAAC;QACxD,QAAQ,EAAE,MAAM,sBAAsB,CAAC,KAAK,EAAE,SAAS,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,KAAmB,EACnB,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAS,GAAG,CAAC,CAAC;IAE3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,GAAsB;IAEtB,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,eAAe,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,IAAI,kBAAkB,CAAC;IACvD,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IAE1E,OAAO;QACL,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC;QAChD,IAAI,EAAE,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC;QAC5C,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC;QAChD,IAAI,EAAE,iBAAiB,CAAC,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC/D,MAAM,EAAE,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC;QAChD,QAAQ,EAAE,kBAAkB,CAAC,OAAO,EAAE,SAAS,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAsB,EAAE,GAAW;IAC1D,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IAEvB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,SAAiB,EACjB,OAAe,EACf,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,iBAAiB,CAAC,SAAS,CAAC,2BAA2B,OAAO,EAAE,EACnE;QACE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,MAAM,EAAE,MAAM;KACf,CACF,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAC;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAE1B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,IAAI,CAAC,YAAY,CAAC;AAC3B,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,SAAiB,EACjB,KAAa,EACb,IAAY;IAEZ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,iBAAiB,CAAC,SAAS,CAAC,mBAAmB,IAAI,EAAE,EACxD;QACE,OAAO,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE;QACnC,MAAM,EAAE,KAAK;KACd,CACF,CAAC;IAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAsB,CAAC;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAE1B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CACrC,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9B,GAAG,WAAW;QACd,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC,EACF,EAAE,CACH,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAyC,EACzC,GAAW;IAEX,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAE3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,kCAAkC,GAAG,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAyC,EACzC,GAAW;IAEX,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAE3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC"}

package/src/lib/delegation/delegation-rule.entity.d.ts

@@ -0,0 +1,19 @@
+import { DelegationRuleStatusEnum, DelegationScopeTypeEnum } from './delegation.enums';
+export declare class DelegationRuleEntity {
+    id: string;
+    principalMemberId: string;
+    agentMemberId: string;
+    scopeType: DelegationScopeTypeEnum;
+    scopeTemplateIds: readonly string[];
+    scopeConditionCel: string | null;
+    priority: number;
+    startAt: Date;
+    endAt: Date | null;
+    requiresConfirmation: boolean;
+    status: DelegationRuleStatusEnum;
+    createdByMemberId: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+    revokedAt: Date | null;
+    revokedByMemberId: string | null;
+}

package/src/lib/delegation/delegation-rule.entity.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationRuleEntity = void 0;
+const tslib_1 = require("tslib");
+const graphql_1 = require("@nestjs/graphql");
+const typeorm_1 = require("typeorm");
+const delegation_enums_1 = require("./delegation.enums");
+let DelegationRuleEntity = class DelegationRuleEntity {
+};
+exports.DelegationRuleEntity = DelegationRuleEntity;
+tslib_1.__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    (0, graphql_1.Field)(() => graphql_1.ID),
+    tslib_1.__metadata("design:type", String)
+], DelegationRuleEntity.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'principal_member_id' }),
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", String)
+], DelegationRuleEntity.prototype, "principalMemberId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'agent_member_id' }),
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", String)
+], DelegationRuleEntity.prototype, "agentMemberId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'scope_type' }),
+    (0, graphql_1.Field)(() => delegation_enums_1.DelegationScopeTypeEnum),
+    tslib_1.__metadata("design:type", String)
+], DelegationRuleEntity.prototype, "scopeType", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('uuid', {
+        array: true,
+        default: () => "'{}'::uuid[]",
+        name: 'scope_template_ids',
+    }),
+    (0, graphql_1.Field)(() => [String]),
+    tslib_1.__metadata("design:type", Array)
+], DelegationRuleEntity.prototype, "scopeTemplateIds", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'scope_condition_cel', nullable: true }),
+    (0, graphql_1.Field)(() => String, { nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], DelegationRuleEntity.prototype, "scopeConditionCel", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('int', { default: 100 }),
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", Number)
+], DelegationRuleEntity.prototype, "priority", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('timestamptz', { name: 'start_at' }),
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", Date)
+], DelegationRuleEntity.prototype, "startAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('timestamptz', { name: 'end_at', nullable: true }),
+    (0, graphql_1.Field)(() => Date, { nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], DelegationRuleEntity.prototype, "endAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('boolean', { default: false, name: 'requires_confirmation' }),
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", Boolean)
+], DelegationRuleEntity.prototype, "requiresConfirmation", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text'),
+    (0, graphql_1.Field)(() => delegation_enums_1.DelegationRuleStatusEnum),
+    tslib_1.__metadata("design:type", String)
+], DelegationRuleEntity.prototype, "status", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'created_by_member_id', nullable: true }),
+    (0, graphql_1.Field)(() => String, { nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], DelegationRuleEntity.prototype, "createdByMemberId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.CreateDateColumn)({ name: 'created_at', type: 'timestamptz' }),
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", Date)
+], DelegationRuleEntity.prototype, "createdAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.UpdateDateColumn)({ name: 'updated_at', type: 'timestamptz' }),
+    (0, graphql_1.Field)(),
+    tslib_1.__metadata("design:type", Date)
+], DelegationRuleEntity.prototype, "updatedAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('timestamptz', { name: 'revoked_at', nullable: true }),
+    (0, graphql_1.Field)(() => Date, { nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], DelegationRuleEntity.prototype, "revokedAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)('text', { name: 'revoked_by_member_id', nullable: true }),
+    (0, graphql_1.Field)(() => String, { nullable: true }),
+    tslib_1.__metadata("design:type", Object)
+], DelegationRuleEntity.prototype, "revokedByMemberId", void 0);
+exports.DelegationRuleEntity = DelegationRuleEntity = tslib_1.__decorate([
+    (0, typeorm_1.Entity)('delegation_rules'),
+    (0, graphql_1.ObjectType)('DelegationRule')
+], DelegationRuleEntity);
+//# sourceMappingURL=delegation-rule.entity.js.map

package/src/lib/delegation/delegation-rule.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-rule.entity.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/delegation/delegation-rule.entity.ts"],"names":[],"mappings":";;;;AAAA,6CAAwD;AACxD,qCAMiB;AACjB,yDAG4B;AAIrB,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;CAoEhC,CAAA;AApEY,oDAAoB;AAG/B;IAFC,IAAA,gCAAsB,EAAC,MAAM,CAAC;IAC9B,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,YAAE,CAAC;;gDACJ;AAIZ;IAFC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;IAC/C,IAAA,eAAK,GAAE;;+DACmB;AAI3B;IAFC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAC3C,IAAA,eAAK,GAAE;;2DACe;AAIvB;IAFC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACtC,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,0CAAuB,CAAC;;uDACD;AAQpC;IANC,IAAA,gBAAM,EAAC,MAAM,EAAE;QACd,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,GAAG,EAAE,CAAC,cAAc;QAC7B,IAAI,EAAE,oBAAoB;KAC3B,CAAC;IACD,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;;8DACe;AAIrC;IAFC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+DACN;AAIlC;IAFC,IAAA,gBAAM,EAAC,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC/B,IAAA,eAAK,GAAE;;sDACU;AAIlB;IAFC,IAAA,gBAAM,EAAC,aAAa,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC3C,IAAA,eAAK,GAAE;sCACE,IAAI;qDAAC;AAIf;IAFC,IAAA,gBAAM,EAAC,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACzD,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDAClB;AAIpB;IAFC,IAAA,gBAAM,EAAC,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;IACpE,IAAA,eAAK,GAAE;;kEACuB;AAI/B;IAFC,IAAA,gBAAM,EAAC,MAAM,CAAC;IACd,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,2CAAwB,CAAC;;oDACJ;AAIlC;IAFC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAChE,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+DACN;AAIlC;IAFC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC7D,IAAA,eAAK,GAAE;sCACI,IAAI;uDAAC;AAIjB;IAFC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAC7D,IAAA,eAAK,GAAE;sCACI,IAAI;uDAAC;AAIjB;IAFC,IAAA,gBAAM,EAAC,aAAa,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7D,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;uDACd;AAIxB;IAFC,IAAA,gBAAM,EAAC,MAAM,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAChE,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;+DACN;+BAnEvB,oBAAoB;IAFhC,IAAA,gBAAM,EAAC,kBAAkB,CAAC;IAC1B,IAAA,oBAAU,EAAC,gBAAgB,CAAC;GAChB,oBAAoB,CAoEhC"}

package/src/lib/delegation/delegation.enums.d.ts

@@ -0,0 +1,10 @@
+export declare enum DelegationRuleStatusEnum {
+    ACTIVE = "ACTIVE",
+    EXPIRED = "EXPIRED",
+    REVOKED = "REVOKED"
+}
+export declare enum DelegationScopeTypeEnum {
+    ALL = "ALL",
+    CONDITION_BASED = "CONDITION_BASED",
+    TEMPLATE_LIST = "TEMPLATE_LIST"
+}

package/src/lib/delegation/delegation.enums.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationScopeTypeEnum = exports.DelegationRuleStatusEnum = void 0;
+const graphql_1 = require("@nestjs/graphql");
+var DelegationRuleStatusEnum;
+(function (DelegationRuleStatusEnum) {
+    DelegationRuleStatusEnum["ACTIVE"] = "ACTIVE";
+    DelegationRuleStatusEnum["EXPIRED"] = "EXPIRED";
+    DelegationRuleStatusEnum["REVOKED"] = "REVOKED";
+})(DelegationRuleStatusEnum || (exports.DelegationRuleStatusEnum = DelegationRuleStatusEnum = {}));
+var DelegationScopeTypeEnum;
+(function (DelegationScopeTypeEnum) {
+    DelegationScopeTypeEnum["ALL"] = "ALL";
+    DelegationScopeTypeEnum["CONDITION_BASED"] = "CONDITION_BASED";
+    DelegationScopeTypeEnum["TEMPLATE_LIST"] = "TEMPLATE_LIST";
+})(DelegationScopeTypeEnum || (exports.DelegationScopeTypeEnum = DelegationScopeTypeEnum = {}));
+(0, graphql_1.registerEnumType)(DelegationRuleStatusEnum, {
+    name: 'DelegationRuleStatus',
+});
+(0, graphql_1.registerEnumType)(DelegationScopeTypeEnum, {
+    name: 'DelegationScopeType',
+});
+//# sourceMappingURL=delegation.enums.js.map

package/src/lib/delegation/delegation.enums.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.enums.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/delegation/delegation.enums.ts"],"names":[],"mappings":";;;AAAA,6CAAmD;AAEnD,IAAY,wBAIX;AAJD,WAAY,wBAAwB;IAClC,6CAAiB,CAAA;IACjB,+CAAmB,CAAA;IACnB,+CAAmB,CAAA;AACrB,CAAC,EAJW,wBAAwB,wCAAxB,wBAAwB,QAInC;AAED,IAAY,uBAIX;AAJD,WAAY,uBAAuB;IACjC,sCAAW,CAAA;IACX,8DAAmC,CAAA;IACnC,0DAA+B,CAAA;AACjC,CAAC,EAJW,uBAAuB,uCAAvB,uBAAuB,QAIlC;AAED,IAAA,0BAAgB,EAAC,wBAAwB,EAAE;IACzC,IAAI,EAAE,sBAAsB;CAC7B,CAAC,CAAC;AAEH,IAAA,0BAAgB,EAAC,uBAAuB,EAAE;IACxC,IAAI,EAAE,qBAAqB;CAC5B,CAAC,CAAC"}

package/src/lib/delegation/delegation.module.d.ts

@@ -0,0 +1,2 @@
+export declare class DelegationModule {
+}

package/src/lib/delegation/delegation.module.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationModule = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const typeorm_1 = require("@nestjs/typeorm");
+const condition_module_1 = require("../condition/condition.module");
+const delegation_rule_entity_1 = require("./delegation-rule.entity");
+const delegation_mutations_1 = require("./delegation.mutations");
+const delegation_queries_1 = require("./delegation.queries");
+const delegation_service_1 = require("./delegation.service");
+let DelegationModule = class DelegationModule {
+};
+exports.DelegationModule = DelegationModule;
+exports.DelegationModule = DelegationModule = tslib_1.__decorate([
+    (0, common_1.Module)({
+        imports: [condition_module_1.ConditionModule, typeorm_1.TypeOrmModule.forFeature([delegation_rule_entity_1.DelegationRuleEntity])],
+        providers: [delegation_mutations_1.DelegationMutations, delegation_queries_1.DelegationQueries, delegation_service_1.DelegationService],
+        exports: [delegation_service_1.DelegationService],
+    })
+], DelegationModule);
+//# sourceMappingURL=delegation.module.js.map

package/src/lib/delegation/delegation.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.module.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/delegation/delegation.module.ts"],"names":[],"mappings":";;;;AAAA,2CAAwC;AACxC,6CAAgD;AAChD,oEAAgE;AAChE,qEAAgE;AAChE,iEAA6D;AAC7D,6DAAyD;AACzD,6DAAyD;AAOlD,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAAG,CAAA;AAAnB,4CAAgB;2BAAhB,gBAAgB;IAL5B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,kCAAe,EAAE,uBAAa,CAAC,UAAU,CAAC,CAAC,6CAAoB,CAAC,CAAC,CAAC;QAC5E,SAAS,EAAE,CAAC,0CAAmB,EAAE,sCAAiB,EAAE,sCAAiB,CAAC;QACtE,OAAO,EAAE,CAAC,sCAAiB,CAAC;KAC7B,CAAC;GACW,gBAAgB,CAAG"}

package/src/lib/delegation/delegation.mutations.d.ts

@@ -0,0 +1,11 @@
+import { BPMAuthContext } from '../bpm-auth';
+import { CreateDelegationRuleInput, UpdateDelegationRuleInput } from './dto/delegation-rule.input';
+import { DelegationRuleEntity } from './delegation-rule.entity';
+import { DelegationService } from './delegation.service';
+export declare class DelegationMutations {
+    private readonly delegationService;
+    constructor(delegationService: DelegationService);
+    createDelegationRule(input: CreateDelegationRuleInput, authContext: BPMAuthContext | null, currentMemberId: string): Promise<DelegationRuleEntity>;
+    updateDelegationRule(input: UpdateDelegationRuleInput, authContext: BPMAuthContext | null): Promise<DelegationRuleEntity>;
+    revokeDelegationRule(id: string, revokedByMemberId?: string | null, authContext?: BPMAuthContext | null, currentMemberId?: string): Promise<DelegationRuleEntity>;
+}

package/src/lib/delegation/delegation.mutations.js

@@ -0,0 +1,87 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationMutations = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const graphql_1 = require("@nestjs/graphql");
+const bpm_auth_1 = require("../bpm-auth");
+const delegation_rule_input_1 = require("./dto/delegation-rule.input");
+const delegation_rule_entity_1 = require("./delegation-rule.entity");
+const delegation_service_1 = require("./delegation.service");
+let DelegationMutations = class DelegationMutations {
+    constructor(delegationService) {
+        this.delegationService = delegationService;
+    }
+    createDelegationRule(input, authContext, currentMemberId) {
+        assertCanWriteDelegationForPrincipal({
+            authContext,
+            principalMemberId: input.principalMemberId,
+        });
+        return this.delegationService.createDelegationRule({
+            ...input,
+            createdByMemberId: currentMemberId,
+        });
+    }
+    async updateDelegationRule(input, authContext) {
+        const rule = await this.delegationService.getDelegationRule(input.id);
+        assertCanWriteDelegationForPrincipal({
+            authContext,
+            principalMemberId: rule.principalMemberId,
+        });
+        return this.delegationService.updateDelegationRule(input);
+    }
+    async revokeDelegationRule(id, revokedByMemberId, authContext, currentMemberId) {
+        const rule = await this.delegationService.getDelegationRule(id);
+        assertCanWriteDelegationForPrincipal({
+            authContext,
+            principalMemberId: rule.principalMemberId,
+        });
+        return this.delegationService.revokeDelegationRule({
+            id,
+            revokedByMemberId: currentMemberId ?? revokedByMemberId,
+        });
+    }
+};
+exports.DelegationMutations = DelegationMutations;
+tslib_1.__decorate([
+    (0, graphql_1.Mutation)(() => delegation_rule_entity_1.DelegationRuleEntity),
+    tslib_1.__param(0, (0, graphql_1.Args)('input')),
+    tslib_1.__param(1, (0, bpm_auth_1.BPMCurrentAuthContext)()),
+    tslib_1.__param(2, (0, bpm_auth_1.BPMCurrentMemberId)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [delegation_rule_input_1.CreateDelegationRuleInput, Object, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], DelegationMutations.prototype, "createDelegationRule", null);
+tslib_1.__decorate([
+    (0, graphql_1.Mutation)(() => delegation_rule_entity_1.DelegationRuleEntity),
+    tslib_1.__param(0, (0, graphql_1.Args)('input')),
+    tslib_1.__param(1, (0, bpm_auth_1.BPMCurrentAuthContext)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [delegation_rule_input_1.UpdateDelegationRuleInput, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], DelegationMutations.prototype, "updateDelegationRule", null);
+tslib_1.__decorate([
+    (0, graphql_1.Mutation)(() => delegation_rule_entity_1.DelegationRuleEntity),
+    tslib_1.__param(0, (0, graphql_1.Args)('id', { type: () => String })),
+    tslib_1.__param(1, (0, graphql_1.Args)('revokedByMemberId', { nullable: true, type: () => String })),
+    tslib_1.__param(2, (0, bpm_auth_1.BPMCurrentAuthContext)()),
+    tslib_1.__param(3, (0, bpm_auth_1.BPMCurrentMemberId)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, Object, Object, String]),
+    tslib_1.__metadata("design:returntype", Promise)
+], DelegationMutations.prototype, "revokeDelegationRule", null);
+exports.DelegationMutations = DelegationMutations = tslib_1.__decorate([
+    (0, graphql_1.Resolver)(() => delegation_rule_entity_1.DelegationRuleEntity),
+    (0, bpm_auth_1.BPMAuthenticated)(),
+    tslib_1.__metadata("design:paramtypes", [delegation_service_1.DelegationService])
+], DelegationMutations);
+function assertCanWriteDelegationForPrincipal({ authContext, principalMemberId, }) {
+    if (!authContext) {
+        throw new common_1.ForbiddenException('BPM member context is required');
+    }
+    if ((0, bpm_auth_1.isBPMAdmin)(authContext) || principalMemberId === authContext.memberId) {
+        return;
+    }
+    throw new common_1.ForbiddenException('BPM admin permission is required');
+}
+//# sourceMappingURL=delegation.mutations.js.map

package/src/lib/delegation/delegation.mutations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.mutations.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/delegation/delegation.mutations.ts"],"names":[],"mappings":";;;;AAAA,2CAAoD;AACpD,6CAA2D;AAC3D,0CAMqB;AACrB,uEAGqC;AACrC,qEAAgE;AAChE,6DAAyD;AAIlD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAA6B,iBAAoC;QAApC,sBAAiB,GAAjB,iBAAiB,CAAmB;IAAG,CAAC;IAGrE,oBAAoB,CACH,KAAgC,EACtB,WAAkC,EACrC,eAAuB;QAE7C,oCAAoC,CAAC;YACnC,WAAW;YACX,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;SAC3C,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC;YACjD,GAAG,KAAK;YACR,iBAAiB,EAAE,eAAe;SACnC,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,oBAAoB,CACT,KAAgC,EACtB,WAAkC;QAE3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAEtE,oCAAoC,CAAC;YACnC,WAAW;YACX,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAGK,AAAN,KAAK,CAAC,oBAAoB,CACY,EAAU,EAE9C,iBAAiC,EACR,WAAmC,EACtC,eAAwB;QAE9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QAEhE,oCAAoC,CAAC;YACnC,WAAW;YACX,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC;YACjD,EAAE;YACF,iBAAiB,EAAE,eAAe,IAAI,iBAAiB;SACxD,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAvDY,kDAAmB;AAI9B;IADC,IAAA,kBAAQ,EAAC,GAAG,EAAE,CAAC,6CAAoB,CAAC;IAElC,mBAAA,IAAA,cAAI,EAAC,OAAO,CAAC,CAAA;IACb,mBAAA,IAAA,gCAAqB,GAAE,CAAA;IACvB,mBAAA,IAAA,6BAAkB,GAAE,CAAA;;6CAFC,iDAAyB;;+DAahD;AAGK;IADL,IAAA,kBAAQ,EAAC,GAAG,EAAE,CAAC,6CAAoB,CAAC;IAElC,mBAAA,IAAA,cAAI,EAAC,OAAO,CAAC,CAAA;IACb,mBAAA,IAAA,gCAAqB,GAAE,CAAA;;6CADF,iDAAyB;;+DAWhD;AAGK;IADL,IAAA,kBAAQ,EAAC,GAAG,EAAE,CAAC,6CAAoB,CAAC;IAElC,mBAAA,IAAA,cAAI,EAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAClC,mBAAA,IAAA,cAAI,EAAC,mBAAmB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAEjE,mBAAA,IAAA,gCAAqB,GAAE,CAAA;IACvB,mBAAA,IAAA,6BAAkB,GAAE,CAAA;;;;+DAatB;8BAtDU,mBAAmB;IAF/B,IAAA,kBAAQ,EAAC,GAAG,EAAE,CAAC,6CAAoB,CAAC;IACpC,IAAA,2BAAgB,GAAE;6CAE+B,sCAAiB;GADtD,mBAAmB,CAuD/B;AAED,SAAS,oCAAoC,CAAC,EAC5C,WAAW,EACX,iBAAiB,GAIlB;IACC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,2BAAkB,CAAC,gCAAgC,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,IAAA,qBAAU,EAAC,WAAW,CAAC,IAAI,iBAAiB,KAAK,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC1E,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,kCAAkC,CAAC,CAAC;AACnE,CAAC"}

package/src/lib/delegation/delegation.queries.d.ts

@@ -0,0 +1,10 @@
+import { BPMAuthContext } from '../bpm-auth';
+import { DelegationRuleEntity } from './delegation-rule.entity';
+import { DelegationRuleStatusEnum, DelegationScopeTypeEnum } from './delegation.enums';
+import { DelegationService } from './delegation.service';
+export declare class DelegationQueries {
+    private readonly delegationService;
+    constructor(delegationService: DelegationService);
+    delegationRules(principalMemberId?: string | null, agentMemberId?: string | null, includeInactive?: boolean | null, page?: number | null, pageSize?: number | null, status?: DelegationRuleStatusEnum | null, scopeType?: DelegationScopeTypeEnum | null, authContext?: BPMAuthContext | null): Promise<readonly DelegationRuleEntity[]>;
+    delegationRuleCount(principalMemberId?: string | null, agentMemberId?: string | null, includeInactive?: boolean | null, status?: DelegationRuleStatusEnum | null, scopeType?: DelegationScopeTypeEnum | null, authContext?: BPMAuthContext | null): Promise<number>;
+}

package/src/lib/delegation/delegation.queries.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DelegationQueries = void 0;
+const tslib_1 = require("tslib");
+const common_1 = require("@nestjs/common");
+const graphql_1 = require("@nestjs/graphql");
+const bpm_auth_1 = require("../bpm-auth");
+const delegation_rule_entity_1 = require("./delegation-rule.entity");
+const delegation_enums_1 = require("./delegation.enums");
+const delegation_service_1 = require("./delegation.service");
+let DelegationQueries = class DelegationQueries {
+    constructor(delegationService) {
+        this.delegationService = delegationService;
+    }
+    delegationRules(principalMemberId, agentMemberId, includeInactive, page, pageSize, status, scopeType, authContext) {
+        assertDelegationRuleQueryAllowed({
+            agentMemberId,
+            authContext,
+            principalMemberId,
+        });
+        return this.delegationService.listDelegationRules({
+            agentMemberId,
+            includeInactive: includeInactive ?? false,
+            page: page ?? undefined,
+            pageSize: pageSize ?? undefined,
+            principalMemberId,
+            scopeType,
+            status: status ?? undefined,
+        });
+    }
+    delegationRuleCount(principalMemberId, agentMemberId, includeInactive, status, scopeType, authContext) {
+        assertDelegationRuleQueryAllowed({
+            agentMemberId,
+            authContext,
+            principalMemberId,
+        });
+        return this.delegationService.countDelegationRules({
+            agentMemberId,
+            includeInactive: includeInactive ?? false,
+            principalMemberId,
+            scopeType,
+            status: status ?? undefined,
+        });
+    }
+};
+exports.DelegationQueries = DelegationQueries;
+tslib_1.__decorate([
+    (0, graphql_1.Query)(() => [delegation_rule_entity_1.DelegationRuleEntity]),
+    tslib_1.__param(0, (0, graphql_1.Args)('principalMemberId', { nullable: true, type: () => String })),
+    tslib_1.__param(1, (0, graphql_1.Args)('agentMemberId', { nullable: true, type: () => String })),
+    tslib_1.__param(2, (0, graphql_1.Args)('includeInactive', { nullable: true, type: () => Boolean })),
+    tslib_1.__param(3, (0, graphql_1.Args)('page', { nullable: true, type: () => graphql_1.Int })),
+    tslib_1.__param(4, (0, graphql_1.Args)('pageSize', { nullable: true, type: () => graphql_1.Int })),
+    tslib_1.__param(5, (0, graphql_1.Args)('status', { nullable: true, type: () => delegation_enums_1.DelegationRuleStatusEnum })),
+    tslib_1.__param(6, (0, graphql_1.Args)('scopeType', { nullable: true, type: () => delegation_enums_1.DelegationScopeTypeEnum })),
+    tslib_1.__param(7, (0, bpm_auth_1.BPMCurrentAuthContext)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object, Object, Object, Object, Object, Object, Object, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], DelegationQueries.prototype, "delegationRules", null);
+tslib_1.__decorate([
+    (0, graphql_1.Query)(() => graphql_1.Int),
+    tslib_1.__param(0, (0, graphql_1.Args)('principalMemberId', { nullable: true, type: () => String })),
+    tslib_1.__param(1, (0, graphql_1.Args)('agentMemberId', { nullable: true, type: () => String })),
+    tslib_1.__param(2, (0, graphql_1.Args)('includeInactive', { nullable: true, type: () => Boolean })),
+    tslib_1.__param(3, (0, graphql_1.Args)('status', { nullable: true, type: () => delegation_enums_1.DelegationRuleStatusEnum })),
+    tslib_1.__param(4, (0, graphql_1.Args)('scopeType', { nullable: true, type: () => delegation_enums_1.DelegationScopeTypeEnum })),
+    tslib_1.__param(5, (0, bpm_auth_1.BPMCurrentAuthContext)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object, Object, Object, Object, Object, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], DelegationQueries.prototype, "delegationRuleCount", null);
+exports.DelegationQueries = DelegationQueries = tslib_1.__decorate([
+    (0, graphql_1.Resolver)(() => delegation_rule_entity_1.DelegationRuleEntity),
+    (0, bpm_auth_1.BPMAuthenticated)(),
+    tslib_1.__metadata("design:paramtypes", [delegation_service_1.DelegationService])
+], DelegationQueries);
+function assertDelegationRuleQueryAllowed({ agentMemberId, authContext, principalMemberId, }) {
+    if (!authContext) {
+        throw new common_1.ForbiddenException('BPM member context is required');
+    }
+    if ((0, bpm_auth_1.isBPMAdmin)(authContext)) {
+        return;
+    }
+    if (principalMemberId === authContext.memberId ||
+        agentMemberId === authContext.memberId) {
+        return;
+    }
+    throw new common_1.ForbiddenException('BPM admin permission is required');
+}
+//# sourceMappingURL=delegation.queries.js.map

package/src/lib/delegation/delegation.queries.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation.queries.js","sourceRoot":"","sources":["../../../../../../libs/bpm-core/src/lib/delegation/delegation.queries.ts"],"names":[],"mappings":";;;;AAAA,2CAAoD;AACpD,6CAA6D;AAC7D,0CAKqB;AACrB,qEAAgE;AAChE,yDAG4B;AAC5B,6DAAyD;AAIlD,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YAA6B,iBAAoC;QAApC,sBAAiB,GAAjB,iBAAiB,CAAmB;IAAG,CAAC;IAGrE,eAAe,CAEb,iBAAiC,EAEjC,aAA6B,EAE7B,eAAgC,EAEhC,IAAoB,EAEpB,QAAwB,EAExB,MAAwC,EAExC,SAA0C,EACjB,WAAmC;QAE5D,gCAAgC,CAAC;YAC/B,aAAa;YACb,WAAW;YACX,iBAAiB;SAClB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,iBAAiB,CAAC,mBAAmB,CAAC;YAChD,aAAa;YACb,eAAe,EAAE,eAAe,IAAI,KAAK;YACzC,IAAI,EAAE,IAAI,IAAI,SAAS;YACvB,QAAQ,EAAE,QAAQ,IAAI,SAAS;YAC/B,iBAAiB;YACjB,SAAS;YACT,MAAM,EAAE,MAAM,IAAI,SAAS;SAC5B,CAAC,CAAC;IACL,CAAC;IAGD,mBAAmB,CAEjB,iBAAiC,EAEjC,aAA6B,EAE7B,eAAgC,EAEhC,MAAwC,EAExC,SAA0C,EACjB,WAAmC;QAE5D,gCAAgC,CAAC;YAC/B,aAAa;YACb,WAAW;YACX,iBAAiB;SAClB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC;YACjD,aAAa;YACb,eAAe,EAAE,eAAe,IAAI,KAAK;YACzC,iBAAiB;YACjB,SAAS;YACT,MAAM,EAAE,MAAM,IAAI,SAAS;SAC5B,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAlEY,8CAAiB;AAI5B;IADC,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,CAAC,6CAAoB,CAAC,CAAC;IAEjC,mBAAA,IAAA,cAAI,EAAC,mBAAmB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAEjE,mBAAA,IAAA,cAAI,EAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAE7D,mBAAA,IAAA,cAAI,EAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAEhE,mBAAA,IAAA,cAAI,EAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,aAAG,EAAE,CAAC,CAAA;IAEjD,mBAAA,IAAA,cAAI,EAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,aAAG,EAAE,CAAC,CAAA;IAErD,mBAAA,IAAA,cAAI,EAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,2CAAwB,EAAE,CAAC,CAAA;IAExE,mBAAA,IAAA,cAAI,EAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,0CAAuB,EAAE,CAAC,CAAA;IAE1E,mBAAA,IAAA,gCAAqB,GAAE,CAAA;;;;wDAiBzB;AAGD;IADC,IAAA,eAAK,EAAC,GAAG,EAAE,CAAC,aAAG,CAAC;IAEd,mBAAA,IAAA,cAAI,EAAC,mBAAmB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAEjE,mBAAA,IAAA,cAAI,EAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAE7D,mBAAA,IAAA,cAAI,EAAC,iBAAiB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAEhE,mBAAA,IAAA,cAAI,EAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,2CAAwB,EAAE,CAAC,CAAA;IAExE,mBAAA,IAAA,cAAI,EAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,0CAAuB,EAAE,CAAC,CAAA;IAE1E,mBAAA,IAAA,gCAAqB,GAAE,CAAA;;;;4DAezB;4BAjEU,iBAAiB;IAF7B,IAAA,kBAAQ,EAAC,GAAG,EAAE,CAAC,6CAAoB,CAAC;IACpC,IAAA,2BAAgB,GAAE;6CAE+B,sCAAiB;GADtD,iBAAiB,CAkE7B;AAED,SAAS,gCAAgC,CAAC,EACxC,aAAa,EACb,WAAW,EACX,iBAAiB,GAKlB;IACC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,2BAAkB,CAAC,gCAAgC,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,IAAA,qBAAU,EAAC,WAAW,CAAC,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,IACE,iBAAiB,KAAK,WAAW,CAAC,QAAQ;QAC1C,aAAa,KAAK,WAAW,CAAC,QAAQ,EACtC,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,kCAAkC,CAAC,CAAC;AACnE,CAAC"}

package/src/lib/delegation/delegation.service.d.ts

@@ -0,0 +1,56 @@
+import { Repository } from 'typeorm';
+import { ConditionService } from '../condition/condition.service';
+import { CreateDelegationRuleInput, UpdateDelegationRuleInput } from './dto/delegation-rule.input';
+import { DelegationRuleEntity } from './delegation-rule.entity';
+import { DelegationRuleStatusEnum, DelegationScopeTypeEnum } from './delegation.enums';
+export interface DelegationResolutionContext {
+    readonly formData: Readonly<Record<string, unknown>>;
+    readonly initiatorMemberId: string;
+    readonly initiatorMetadataSnapshot: Readonly<Record<string, unknown>>;
+    readonly instanceId: string;
+    readonly nodeId: string;
+    readonly state: string;
+    readonly templateId: string;
+    readonly templateVersionId: string;
+    readonly title: string;
+}
+export interface DelegationResolution {
+    readonly delegationChain: readonly DelegationStep[];
+    readonly finalAssigneeMemberId: string;
+}
+export interface DelegationStep extends Readonly<Record<string, unknown>> {
+    readonly from: string;
+    readonly reason: string;
+    readonly ruleId: string | null;
+    readonly to: string;
+}
+interface ListDelegationRulesOptions {
+    readonly agentMemberId?: string | null;
+    readonly includeInactive?: boolean;
+    readonly page?: number;
+    readonly pageSize?: number;
+    readonly principalMemberId?: string | null;
+    readonly scopeType?: DelegationScopeTypeEnum | null;
+    readonly status?: DelegationRuleStatusEnum;
+}
+export declare class DelegationService {
+    private readonly delegationRuleRepository;
+    private readonly conditionService;
+    constructor(delegationRuleRepository: Repository<DelegationRuleEntity>, conditionService: ConditionService);
+    listDelegationRules(options?: ListDelegationRulesOptions): Promise<readonly DelegationRuleEntity[]>;
+    countDelegationRules(options?: Pick<ListDelegationRulesOptions, 'agentMemberId' | 'includeInactive' | 'principalMemberId' | 'scopeType' | 'status'>): Promise<number>;
+    createDelegationRule(input: CreateDelegationRuleInput): Promise<DelegationRuleEntity>;
+    updateDelegationRule(input: UpdateDelegationRuleInput): Promise<DelegationRuleEntity>;
+    getDelegationRule(id: string): Promise<DelegationRuleEntity>;
+    revokeDelegationRule({ id, revokedByMemberId, }: {
+        readonly id: string;
+        readonly revokedByMemberId?: string | null;
+    }): Promise<DelegationRuleEntity>;
+    resolveAssignee(originalAssigneeMemberId: string, context: DelegationResolutionContext, at?: Date): Promise<DelegationResolution>;
+    private walkDelegationChain;
+    private matchesRuleScope;
+    private assertNoActiveCycle;
+    private readRuleOrThrow;
+    private normalizeRuleInput;
+}
+export {};