@selvajs/selva 4.6.21-beta.0 → 4.7.0-beta.2

package/build/server/chunks/entries/endpoints/admin/api/users/_id_/{_server.ts.js-BEGaGEwg.js.map → _server.ts.js-7Efk1xkU.js.map}

@@ -1 +1 @@
-{"version":3,"file":"_server.ts.js-BEGaGEwg.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/admin/api/users/_id_/_server.ts.js"],"sourcesContent":["import { z } from \"zod\";\nimport { n as getPermissionStore, a as getAuthProvider, o as getDataProvider, d as getOrganizationProvider } from \"../../../../../../chunks/providers.server.js\";\nimport { e as requireManageInstanceUsers } from \"../../../../../../chunks/access.server.js\";\nimport { a as apiError, t as throwZodError, A as ApiErrorCode } from \"../../../../../../chunks/api-errors.js\";\nimport { P as PlatformPermissionSchema, a as OrgPermissionSchema, S as SYSTEM_CONTEXT, h as hasPermission, D as DEFAULT_ORG_PERMISSIONS, M as MEMBER_ASSIGNABLE_PERMISSIONS } from \"../../../../../../chunks/context.js\";\nimport { s as splitFlatPermissions } from \"../../../../../../chunks/permissions-compat.server.js\";\nimport { s as setUserPlatformPermissions } from \"../../../../../../chunks/permissions.server.js\";\nconst FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);\nconst UpdatePermissionsBody = z.object({\n  permissions: z.array(FlatPermissionSchema)\n});\nconst PATCH = async ({ params, request, locals }) => {\n  requireManageInstanceUsers(locals);\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing user ID\");\n  const body = await request.json().catch(() => null);\n  const parsed = UpdatePermissionsBody.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  const { platform, org } = splitFlatPermissions(parsed.data.permissions);\n  const existingPlatform = await getPermissionStore().getFor(locals.ctx, id);\n  const platformChanged = platform.length !== existingPlatform.length || platform.some((p) => !existingPlatform.includes(p)) || existingPlatform.some((p) => !platform.includes(p));\n  if (platformChanged && !hasPermission(locals.ctx, \"instance_admin\")) {\n    apiError(\n      403,\n      ApiErrorCode.FORBIDDEN,\n      \"Only a platform admin can change platform-scope permissions\"\n    );\n  }\n  const platformResult = await setUserPlatformPermissions(locals.ctx, id, platform);\n  if (platformResult === \"not_found\") apiError(404, ApiErrorCode.NOT_FOUND, \"User not found\");\n  if (platformResult === \"not_supported\")\n    apiError(\n      501,\n      ApiErrorCode.INTERNAL,\n      \"Platform permission updates not supported by this auth provider\"\n    );\n  if (platformResult === \"last_admin\")\n    apiError(\n      409,\n      ApiErrorCode.CONFLICT,\n      \"Cannot remove the last instance admin. Promote another user to instance admin first.\"\n    );\n  const orgId = locals.ctx?.actingOrgId;\n  if (orgId) {\n    const orgs = getOrganizationProvider();\n    const existing = await orgs.getOrgMember(SYSTEM_CONTEXT, orgId, id);\n    const resolvedPermissions = (role) => role === \"member\" ? org.filter((p) => MEMBER_ASSIGNABLE_PERMISSIONS.includes(p)) : [...DEFAULT_ORG_PERMISSIONS[role]];\n    if (existing) {\n      await orgs.updateOrgMemberPermissions(\n        SYSTEM_CONTEXT,\n        orgId,\n        id,\n        resolvedPermissions(existing.role)\n      );\n    } else {\n      const joinedAt = (/* @__PURE__ */ new Date()).toISOString();\n      await orgs.addOrgMember(SYSTEM_CONTEXT, {\n        orgId,\n        userId: id,\n        role: \"member\",\n        permissions: resolvedPermissions(\"member\"),\n        joinedAt,\n        updatedAt: joinedAt,\n        updatedBy: locals.user?.id ?? id,\n        deletedAt: null\n      });\n    }\n  }\n  return new Response(null, { status: 204 });\n};\nconst DELETE = async ({ params, locals }) => {\n  requireManageInstanceUsers(locals);\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing user ID\");\n  const targetPerms = await getPermissionStore().getFor(locals.ctx, id);\n  if (targetPerms.includes(\"instance_admin\")) {\n    const others = await getPermissionStore().countInstanceAdminsExcluding(locals.ctx, id);\n    if (others === 0) {\n      apiError(\n        409,\n        ApiErrorCode.CONFLICT,\n        \"Cannot delete the last instance admin. Promote another user to instance admin first.\"\n      );\n    }\n  }\n  const result = await getAuthProvider().deleteUser(id);\n  if (result === \"not_found\") apiError(404, ApiErrorCode.NOT_FOUND, \"User not found\");\n  if (result === \"not_supported\")\n    apiError(501, ApiErrorCode.INTERNAL, \"User deletion not supported by this auth provider\");\n  await getDataProvider().onUserDeleted(SYSTEM_CONTEXT, id);\n  return new Response(null, { status: 204 });\n};\nexport {\n  DELETE,\n  PATCH\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAOA,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;AACrF,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB;AAC3C,CAAC,CAAC;AACG,MAAC,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACrD,EAAE,0BAA0B,CAAC,MAAM,CAAC;AACpC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;AAC3E,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC;AACtD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;AACzE,EAAE,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AAC5E,EAAE,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACnL,EAAE,IAAI,eAAe,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE;AACvE,IAAI,QAAQ;AACZ,MAAM,GAAG;AACT,MAAM,YAAY,CAAC,SAAS;AAC5B,MAAM;AACN,KAAK;AACL,EAAE;AACF,EAAE,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,QAAQ,CAAC;AACnF,EAAE,IAAI,cAAc,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AAC7F,EAAE,IAAI,cAAc,KAAK,eAAe;AACxC,IAAI,QAAQ;AACZ,MAAM,GAAG;AACT,MAAM,YAAY,CAAC,QAAQ;AAC3B,MAAM;AACN,KAAK;AACL,EAAE,IAAI,cAAc,KAAK,YAAY;AACrC,IAAI,QAAQ;AACZ,MAAM,GAAG;AACT,MAAM,YAAY,CAAC,QAAQ;AAC3B,MAAM;AACN,KAAK;AACL,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,WAAW;AACvC,EAAE,IAAI,KAAK,EAAE;AACb,IAAI,MAAM,IAAI,GAAG,uBAAuB,EAAE;AAC1C,IAAI,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,CAAC;AACvE,IAAI,MAAM,mBAAmB,GAAG,CAAC,IAAI,KAAK,IAAI,KAAK,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;AAC/J,IAAI,IAAI,QAAQ,EAAE;AAClB,MAAM,MAAM,IAAI,CAAC,0BAA0B;AAC3C,QAAQ,cAAc;AACtB,QAAQ,KAAK;AACb,QAAQ,EAAE;AACV,QAAQ,mBAAmB,CAAC,QAAQ,CAAC,IAAI;AACzC,OAAO;AACP,IAAI,CAAC,MAAM;AACX,MAAM,MAAM,QAAQ,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACjE,MAAM,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE;AAC9C,QAAQ,KAAK;AACb,QAAQ,MAAM,EAAE,EAAE;AAClB,QAAQ,IAAI,EAAE,QAAQ;AACtB,QAAQ,WAAW,EAAE,mBAAmB,CAAC,QAAQ,CAAC;AAClD,QAAQ,QAAQ;AAChB,QAAQ,SAAS,EAAE,QAAQ;AAC3B,QAAQ,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE;AACxC,QAAQ,SAAS,EAAE;AACnB,OAAO,CAAC;AACR,IAAI;AACJ,EAAE;AACF,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C;AACK,MAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC7C,EAAE,0BAA0B,CAAC,MAAM,CAAC;AACpC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;AAC3E,EAAE,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AACvE,EAAE,IAAI,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AAC9C,IAAI,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AAC1F,IAAI,IAAI,MAAM,KAAK,CAAC,EAAE;AACtB,MAAM,QAAQ;AACd,QAAQ,GAAG;AACX,QAAQ,YAAY,CAAC,QAAQ;AAC7B,QAAQ;AACR,OAAO;AACP,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;AACvD,EAAE,IAAI,MAAM,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACrF,EAAE,IAAI,MAAM,KAAK,eAAe;AAChC,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,mDAAmD,CAAC;AAC7F,EAAE,MAAM,eAAe,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,EAAE,CAAC;AAC3D,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C;;;;"}
+{"version":3,"file":"_server.ts.js-7Efk1xkU.js","sources":["../../../../../../../../../.svelte-kit/output/server/entries/endpoints/admin/api/users/_id_/_server.ts.js"],"sourcesContent":["import { z } from \"zod\";\nimport { q as getPermissionStore, b as getAuthProvider, r as getDataProvider, e as getOrganizationProvider } from \"../../../../../../chunks/providers.server.js\";\nimport { e as requireManageInstanceUsers } from \"../../../../../../chunks/access.server.js\";\nimport { a as apiError, t as throwZodError, A as ApiErrorCode } from \"../../../../../../chunks/api-errors.js\";\nimport { P as PlatformPermissionSchema, a as OrgPermissionSchema, S as SYSTEM_CONTEXT, h as hasPermission, D as DEFAULT_ORG_PERMISSIONS, M as MEMBER_ASSIGNABLE_PERMISSIONS } from \"../../../../../../chunks/context.js\";\nimport { s as splitFlatPermissions } from \"../../../../../../chunks/permissions-compat.server.js\";\nimport { s as setUserPlatformPermissions } from \"../../../../../../chunks/permissions.server.js\";\nconst FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);\nconst UpdatePermissionsBody = z.object({\n  permissions: z.array(FlatPermissionSchema)\n});\nconst PATCH = async ({ params, request, locals }) => {\n  requireManageInstanceUsers(locals);\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing user ID\");\n  const body = await request.json().catch(() => null);\n  const parsed = UpdatePermissionsBody.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  const { platform, org } = splitFlatPermissions(parsed.data.permissions);\n  const existingPlatform = await getPermissionStore().getFor(locals.ctx, id);\n  const platformChanged = platform.length !== existingPlatform.length || platform.some((p) => !existingPlatform.includes(p)) || existingPlatform.some((p) => !platform.includes(p));\n  if (platformChanged && !hasPermission(locals.ctx, \"instance_admin\")) {\n    apiError(\n      403,\n      ApiErrorCode.FORBIDDEN,\n      \"Only a platform admin can change platform-scope permissions\"\n    );\n  }\n  const platformResult = await setUserPlatformPermissions(locals.ctx, id, platform);\n  if (platformResult === \"not_found\") apiError(404, ApiErrorCode.NOT_FOUND, \"User not found\");\n  if (platformResult === \"not_supported\")\n    apiError(\n      501,\n      ApiErrorCode.INTERNAL,\n      \"Platform permission updates not supported by this auth provider\"\n    );\n  if (platformResult === \"last_admin\")\n    apiError(\n      409,\n      ApiErrorCode.CONFLICT,\n      \"Cannot remove the last instance admin. Promote another user to instance admin first.\"\n    );\n  const orgId = locals.ctx?.actingOrgId;\n  if (orgId) {\n    const orgs = getOrganizationProvider();\n    const existing = await orgs.getOrgMember(SYSTEM_CONTEXT, orgId, id);\n    const resolvedPermissions = (role) => role === \"member\" ? org.filter((p) => MEMBER_ASSIGNABLE_PERMISSIONS.includes(p)) : [...DEFAULT_ORG_PERMISSIONS[role]];\n    if (existing) {\n      await orgs.updateOrgMemberPermissions(\n        SYSTEM_CONTEXT,\n        orgId,\n        id,\n        resolvedPermissions(existing.role)\n      );\n    } else {\n      const joinedAt = (/* @__PURE__ */ new Date()).toISOString();\n      await orgs.addOrgMember(SYSTEM_CONTEXT, {\n        orgId,\n        userId: id,\n        role: \"member\",\n        permissions: resolvedPermissions(\"member\"),\n        joinedAt,\n        updatedAt: joinedAt,\n        updatedBy: locals.user?.id ?? id,\n        deletedAt: null\n      });\n    }\n  }\n  return new Response(null, { status: 204 });\n};\nconst DELETE = async ({ params, locals }) => {\n  requireManageInstanceUsers(locals);\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing user ID\");\n  const targetPerms = await getPermissionStore().getFor(locals.ctx, id);\n  if (targetPerms.includes(\"instance_admin\")) {\n    const others = await getPermissionStore().countInstanceAdminsExcluding(locals.ctx, id);\n    if (others === 0) {\n      apiError(\n        409,\n        ApiErrorCode.CONFLICT,\n        \"Cannot delete the last instance admin. Promote another user to instance admin first.\"\n      );\n    }\n  }\n  const result = await getAuthProvider().deleteUser(id);\n  if (result === \"not_found\") apiError(404, ApiErrorCode.NOT_FOUND, \"User not found\");\n  if (result === \"not_supported\")\n    apiError(501, ApiErrorCode.INTERNAL, \"User deletion not supported by this auth provider\");\n  await getDataProvider().onUserDeleted(SYSTEM_CONTEXT, id);\n  return new Response(null, { status: 204 });\n};\nexport {\n  DELETE,\n  PATCH\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;AAOA,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;AACrF,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;AACvC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB;AAC3C,CAAC,CAAC;AACG,MAAC,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AACrD,EAAE,0BAA0B,CAAC,MAAM,CAAC;AACpC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;AAC3E,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC;AACtD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC;AACzE,EAAE,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AAC5E,EAAE,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACnL,EAAE,IAAI,eAAe,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE;AACvE,IAAI,QAAQ;AACZ,MAAM,GAAG;AACT,MAAM,YAAY,CAAC,SAAS;AAC5B,MAAM;AACN,KAAK;AACL,EAAE;AACF,EAAE,MAAM,cAAc,GAAG,MAAM,0BAA0B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,EAAE,QAAQ,CAAC;AACnF,EAAE,IAAI,cAAc,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AAC7F,EAAE,IAAI,cAAc,KAAK,eAAe;AACxC,IAAI,QAAQ;AACZ,MAAM,GAAG;AACT,MAAM,YAAY,CAAC,QAAQ;AAC3B,MAAM;AACN,KAAK;AACL,EAAE,IAAI,cAAc,KAAK,YAAY;AACrC,IAAI,QAAQ;AACZ,MAAM,GAAG;AACT,MAAM,YAAY,CAAC,QAAQ;AAC3B,MAAM;AACN,KAAK;AACL,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,WAAW;AACvC,EAAE,IAAI,KAAK,EAAE;AACb,IAAI,MAAM,IAAI,GAAG,uBAAuB,EAAE;AAC1C,IAAI,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,CAAC;AACvE,IAAI,MAAM,mBAAmB,GAAG,CAAC,IAAI,KAAK,IAAI,KAAK,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;AAC/J,IAAI,IAAI,QAAQ,EAAE;AAClB,MAAM,MAAM,IAAI,CAAC,0BAA0B;AAC3C,QAAQ,cAAc;AACtB,QAAQ,KAAK;AACb,QAAQ,EAAE;AACV,QAAQ,mBAAmB,CAAC,QAAQ,CAAC,IAAI;AACzC,OAAO;AACP,IAAI,CAAC,MAAM;AACX,MAAM,MAAM,QAAQ,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACjE,MAAM,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE;AAC9C,QAAQ,KAAK;AACb,QAAQ,MAAM,EAAE,EAAE;AAClB,QAAQ,IAAI,EAAE,QAAQ;AACtB,QAAQ,WAAW,EAAE,mBAAmB,CAAC,QAAQ,CAAC;AAClD,QAAQ,QAAQ;AAChB,QAAQ,SAAS,EAAE,QAAQ;AAC3B,QAAQ,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE;AACxC,QAAQ,SAAS,EAAE;AACnB,OAAO,CAAC;AACR,IAAI;AACJ,EAAE;AACF,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C;AACK,MAAC,MAAM,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC7C,EAAE,0BAA0B,CAAC,MAAM,CAAC;AACpC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;AAC3E,EAAE,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AACvE,EAAE,IAAI,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AAC9C,IAAI,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AAC1F,IAAI,IAAI,MAAM,KAAK,CAAC,EAAE;AACtB,MAAM,QAAQ;AACd,QAAQ,GAAG;AACX,QAAQ,YAAY,CAAC,QAAQ;AAC7B,QAAQ;AACR,OAAO;AACP,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;AACvD,EAAE,IAAI,MAAM,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACrF,EAAE,IAAI,MAAM,KAAK,eAAe;AAChC,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,mDAAmD,CAAC;AAC7F,EAAE,MAAM,eAAe,EAAE,CAAC,aAAa,CAAC,cAAc,EAAE,EAAE,CAAC;AAC3D,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C;;;;"}

package/build/server/chunks/entries/endpoints/admin/api/users/_id_/disable/{_server.ts.js-CGwcR-7k.js → _server.ts.js-4UrDw7Q3.js}

@@ -1,12 +1,12 @@
-import { a as apiError, A as ApiErrorCode } from '../../../../../../../chunks/api-errors.js-yRMzxqNi.js';
-import { a as getPermissionStore, g as getAuthProvider } from '../../../../../../../chunks/providers.server.js-D0hpk-aq.js';
-import { e as requireManageInstanceUsers } from '../../../../../../../chunks/access.server.js-D99g5hZd.js';
+import { a as apiError, A as ApiErrorCode } from '../../../../../../../chunks/api-errors.js-DlfcfPJs.js';
+import { a as getPermissionStore, g as getAuthProvider } from '../../../../../../../chunks/providers.server.js-CIHOepKv.js';
+import { e as requireManageInstanceUsers } from '../../../../../../../chunks/access.server.js-_nJWuQcN.js';
 import '@sveltejs/kit';
-import '../../../../../../../chunks/context.js-D8E0GFTw.js';
+import '../../../../../../../chunks/context.js-DsQGiS2x.js';
 import 'zod';
 import '@selvajs/compute/core';
 import '../../../../../../../chunks/schema.js-j3D3emog.js';
-import '../../../../../../../chunks/utils4.js-BRotGwxx.js';
+import '../../../../../../../chunks/utils4.js-8SHxuGTr.js';
 import '../../../../../../../chunks/shared-server.js-DaWdgxVh.js';
 import 'node:url';
 import 'node:path';
@@ -38,4 +38,4 @@ const POST = async ({ params, locals }) => {
 };
 
 export { POST };
-//# sourceMappingURL=_server.ts.js-CGwcR-7k.js.map
+//# sourceMappingURL=_server.ts.js-4UrDw7Q3.js.map

package/build/server/chunks/entries/endpoints/admin/api/users/_id_/disable/{_server.ts.js-CGwcR-7k.js.map → _server.ts.js-4UrDw7Q3.js.map}

@@ -1 +1 @@
-{"version":3,"file":"_server.ts.js-CGwcR-7k.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/admin/api/users/_id_/disable/_server.ts.js"],"sourcesContent":["import { a as apiError, A as ApiErrorCode } from \"../../../../../../../chunks/api-errors.js\";\nimport { n as getPermissionStore, a as getAuthProvider } from \"../../../../../../../chunks/providers.server.js\";\nimport { e as requireManageInstanceUsers } from \"../../../../../../../chunks/access.server.js\";\nconst POST = async ({ params, locals }) => {\n  requireManageInstanceUsers(locals);\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing user ID\");\n  const targetPerms = await getPermissionStore().getFor(locals.ctx, id);\n  if (targetPerms.includes(\"instance_admin\")) {\n    const others = await getPermissionStore().countInstanceAdminsExcluding(locals.ctx, id);\n    if (others === 0) {\n      apiError(\n        409,\n        ApiErrorCode.CONFLICT,\n        \"Cannot disable the last instance admin. Promote another user to instance admin first.\"\n      );\n    }\n  }\n  const result = await getAuthProvider().disableUser(id);\n  if (result === \"not_found\") apiError(404, ApiErrorCode.NOT_FOUND, \"User not found\");\n  if (result === \"not_supported\")\n    apiError(501, ApiErrorCode.INTERNAL, \"Disabling users is not supported by this auth provider\");\n  return new Response(null, { status: 204 });\n};\nexport {\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAGK,MAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC3C,EAAE,0BAA0B,CAAC,MAAM,CAAC;AACpC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;AAC3E,EAAE,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AACvE,EAAE,IAAI,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AAC9C,IAAI,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AAC1F,IAAI,IAAI,MAAM,KAAK,CAAC,EAAE;AACtB,MAAM,QAAQ;AACd,QAAQ,GAAG;AACX,QAAQ,YAAY,CAAC,QAAQ;AAC7B,QAAQ;AACR,OAAO;AACP,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;AACxD,EAAE,IAAI,MAAM,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACrF,EAAE,IAAI,MAAM,KAAK,eAAe;AAChC,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,wDAAwD,CAAC;AAClG,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C;;;;"}
+{"version":3,"file":"_server.ts.js-4UrDw7Q3.js","sources":["../../../../../../../../../../.svelte-kit/output/server/entries/endpoints/admin/api/users/_id_/disable/_server.ts.js"],"sourcesContent":["import { a as apiError, A as ApiErrorCode } from \"../../../../../../../chunks/api-errors.js\";\nimport { q as getPermissionStore, b as getAuthProvider } from \"../../../../../../../chunks/providers.server.js\";\nimport { e as requireManageInstanceUsers } from \"../../../../../../../chunks/access.server.js\";\nconst POST = async ({ params, locals }) => {\n  requireManageInstanceUsers(locals);\n  const { id } = params;\n  if (!id) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Missing user ID\");\n  const targetPerms = await getPermissionStore().getFor(locals.ctx, id);\n  if (targetPerms.includes(\"instance_admin\")) {\n    const others = await getPermissionStore().countInstanceAdminsExcluding(locals.ctx, id);\n    if (others === 0) {\n      apiError(\n        409,\n        ApiErrorCode.CONFLICT,\n        \"Cannot disable the last instance admin. Promote another user to instance admin first.\"\n      );\n    }\n  }\n  const result = await getAuthProvider().disableUser(id);\n  if (result === \"not_found\") apiError(404, ApiErrorCode.NOT_FOUND, \"User not found\");\n  if (result === \"not_supported\")\n    apiError(501, ApiErrorCode.INTERNAL, \"Disabling users is not supported by this auth provider\");\n  return new Response(null, { status: 204 });\n};\nexport {\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAGK,MAAC,IAAI,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK;AAC3C,EAAE,0BAA0B,CAAC,MAAM,CAAC;AACpC,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM;AACvB,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;AAC3E,EAAE,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AACvE,EAAE,IAAI,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;AAC9C,IAAI,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC,4BAA4B,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;AAC1F,IAAI,IAAI,MAAM,KAAK,CAAC,EAAE;AACtB,MAAM,QAAQ;AACd,QAAQ,GAAG;AACX,QAAQ,YAAY,CAAC,QAAQ;AAC7B,QAAQ;AACR,OAAO;AACP,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;AACxD,EAAE,IAAI,MAAM,KAAK,WAAW,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,SAAS,EAAE,gBAAgB,CAAC;AACrF,EAAE,IAAI,MAAM,KAAK,eAAe;AAChC,IAAI,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,wDAAwD,CAAC;AAClG,EAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC5C;;;;"}

package/build/server/chunks/entries/endpoints/admin/api/users/{_server.ts.js-D-z-Kl_c.js → _server.ts.js-B9ZWJoST.js}

@@ -1,12 +1,12 @@
 import { json } from '@sveltejs/kit';
 import { z } from 'zod';
-import { g as getAuthProvider, d as getOrganizationProvider, a as getPermissionStore } from '../../../../../chunks/providers.server.js-D0hpk-aq.js';
-import { e as requireManageInstanceUsers } from '../../../../../chunks/access.server.js-D99g5hZd.js';
-import { l as listAllOrgMembers } from '../../../../../chunks/org-members.server.js-HahiM88D.js';
-import { s as setUserPlatformPermissions } from '../../../../../chunks/permissions.server.js-B9lpLFEj.js';
-import { a as apiError, t as throwZodError, A as ApiErrorCode, h as handleApiError } from '../../../../../chunks/api-errors.js-yRMzxqNi.js';
-import { h as hasPermission, S as SYSTEM_CONTEXT, M as MEMBER_ASSIGNABLE_PERMISSIONS, P as PlatformPermissionSchema, b as OrgPermissionSchema } from '../../../../../chunks/context.js-D8E0GFTw.js';
-import { f as flattenPermissions, s as splitFlatPermissions } from '../../../../../chunks/permissions-compat.server.js-BfoBZYSH.js';
+import { g as getAuthProvider, d as getOrganizationProvider, a as getPermissionStore } from '../../../../../chunks/providers.server.js-CIHOepKv.js';
+import { e as requireManageInstanceUsers } from '../../../../../chunks/access.server.js-_nJWuQcN.js';
+import { l as listAllOrgMembers } from '../../../../../chunks/org-members.server.js-DskaqUJo.js';
+import { s as setUserPlatformPermissions } from '../../../../../chunks/permissions.server.js-C3_SFjUh.js';
+import { a as apiError, t as throwZodError, A as ApiErrorCode, h as handleApiError } from '../../../../../chunks/api-errors.js-DlfcfPJs.js';
+import { h as hasPermission, S as SYSTEM_CONTEXT, M as MEMBER_ASSIGNABLE_PERMISSIONS, P as PlatformPermissionSchema, b as OrgPermissionSchema } from '../../../../../chunks/context.js-DsQGiS2x.js';
+import { f as flattenPermissions, s as splitFlatPermissions } from '../../../../../chunks/permissions-compat.server.js-DNsLyriU.js';
 import '../../../../../chunks/shared-server.js-DaWdgxVh.js';
 import 'node:url';
 import 'node:path';
@@ -16,7 +16,7 @@ import 'node:fs/promises';
 import '@supabase/supabase-js';
 import '@selvajs/compute/core';
 import '../../../../../chunks/schema.js-j3D3emog.js';
-import '../../../../../chunks/utils4.js-BRotGwxx.js';
+import '../../../../../chunks/utils4.js-8SHxuGTr.js';
 
 const FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);
 const BaseUserBody = z.object({
@@ -111,4 +111,4 @@ const POST = async ({ request, locals }) => {
 };
 
 export { GET, POST };
-//# sourceMappingURL=_server.ts.js-D-z-Kl_c.js.map
+//# sourceMappingURL=_server.ts.js-B9ZWJoST.js.map

package/build/server/chunks/entries/endpoints/admin/api/users/{_server.ts.js-D-z-Kl_c.js.map → _server.ts.js-B9ZWJoST.js.map}

@@ -1 +1 @@
-{"version":3,"file":"_server.ts.js-D-z-Kl_c.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/admin/api/users/_server.ts.js"],"sourcesContent":["import { json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\nimport { a as getAuthProvider, d as getOrganizationProvider, n as getPermissionStore } from \"../../../../../chunks/providers.server.js\";\nimport { e as requireManageInstanceUsers } from \"../../../../../chunks/access.server.js\";\nimport { l as listAllOrgMembers } from \"../../../../../chunks/org-members.server.js\";\nimport { s as setUserPlatformPermissions } from \"../../../../../chunks/permissions.server.js\";\nimport { a as apiError, t as throwZodError, A as ApiErrorCode, h as handleApiError } from \"../../../../../chunks/api-errors.js\";\nimport { P as PlatformPermissionSchema, a as OrgPermissionSchema, h as hasPermission, S as SYSTEM_CONTEXT, M as MEMBER_ASSIGNABLE_PERMISSIONS } from \"../../../../../chunks/context.js\";\nimport { f as flattenPermissions, s as splitFlatPermissions } from \"../../../../../chunks/permissions-compat.server.js\";\nconst FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);\nconst BaseUserBody = z.object({\n  email: z.string().email(\"Valid email is required\"),\n  permissions: z.array(FlatPermissionSchema)\n});\nconst PasswordUserBody = BaseUserBody.extend({\n  password: z.string().min(8, \"Password must be at least 8 characters\").optional()\n});\nconst GET = async ({ locals }) => {\n  requireManageInstanceUsers(locals);\n  const page = await getAuthProvider().listUsers({ limit: 200 });\n  if (page === null) {\n    apiError(\n      501,\n      ApiErrorCode.INTERNAL,\n      \"User management is not supported by the current auth provider. Configure DATA_PATH (local provider) or check your provider wiring.\"\n    );\n  }\n  const orgId = locals.ctx?.actingOrgId;\n  const orgs = getOrganizationProvider();\n  const userIds = page.items.map((u) => u.id);\n  const platformByUser = await getPermissionStore().getForBatch(locals.ctx, userIds);\n  const memberByUserId = /* @__PURE__ */ new Map();\n  if (orgId) {\n    for (const m of await listAllOrgMembers(orgs, orgId)) memberByUserId.set(m.userId, m);\n  }\n  const flattened = page.items.map((u) => {\n    const orgPerms = memberByUserId.get(u.id)?.permissions ?? [];\n    const platformPerms = platformByUser.get(u.id) ?? [];\n    return {\n      ...u,\n      platformPermissions: platformPerms,\n      permissions: flattenPermissions(\n        platformPerms,\n        orgPerms\n      )\n    };\n  });\n  return json({ users: flattened });\n};\nconst POST = async ({ request, locals }) => {\n  requireManageInstanceUsers(locals);\n  const auth = getAuthProvider();\n  const body = await request.json().catch(() => null);\n  const parsed = PasswordUserBody.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  const { email, password, permissions } = parsed.data;\n  const { platform, org } = splitFlatPermissions(permissions);\n  if (platform.length > 0 && !hasPermission(locals.ctx, \"instance_admin\")) {\n    apiError(\n      403,\n      ApiErrorCode.FORBIDDEN,\n      \"Only a platform admin can grant platform-scope permissions\"\n    );\n  }\n  try {\n    let user;\n    if (auth.passwordAuth) {\n      if (!password) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Password is required\");\n      user = await auth.passwordAuth.createUserWithPassword(email, password);\n    } else if (auth.createUser) {\n      user = await auth.createUser(email);\n    } else {\n      apiError(\n        501,\n        ApiErrorCode.INTERNAL,\n        `User creation is not supported by ${auth.name}. Users are managed externally.`\n      );\n    }\n    if (platform.length > 0) {\n      await setUserPlatformPermissions(locals.ctx, user.id, platform);\n    }\n    const orgId = locals.ctx?.actingOrgId;\n    if (orgId) {\n      const joinedAt = (/* @__PURE__ */ new Date()).toISOString();\n      await getOrganizationProvider().addOrgMember(SYSTEM_CONTEXT, {\n        orgId,\n        userId: user.id,\n        role: \"member\",\n        permissions: org.filter((p) => MEMBER_ASSIGNABLE_PERMISSIONS.includes(p)),\n        joinedAt,\n        updatedAt: joinedAt,\n        updatedBy: locals.user?.id ?? user.id,\n        deletedAt: null\n      });\n    }\n    return json(user, { status: 201 });\n  } catch (err) {\n    handleApiError(err, \"Failed to create user\");\n  }\n};\nexport {\n  GET,\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AASA,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;AACrF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9B,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;AACpD,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB;AAC3C,CAAC,CAAC;AACF,MAAM,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC;AAC7C,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAC,QAAQ;AAChF,CAAC,CAAC;AACG,MAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AAClC,EAAE,0BAA0B,CAAC,MAAM,CAAC;AACpC,EAAE,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAChE,EAAE,IAAI,IAAI,KAAK,IAAI,EAAE;AACrB,IAAI,QAAQ;AACZ,MAAM,GAAG;AACT,MAAM,YAAY,CAAC,QAAQ;AAC3B,MAAM;AACN,KAAK;AACL,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,WAAW;AACvC,EAAE,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACxC,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC7C,EAAE,MAAM,cAAc,GAAG,MAAM,kBAAkB,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;AACpF,EAAE,MAAM,cAAc,mBAAmB,IAAI,GAAG,EAAE;AAClD,EAAE,IAAI,KAAK,EAAE;AACb,IAAI,KAAK,MAAM,CAAC,IAAI,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACzF,EAAE;AACF,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK;AAC1C,IAAI,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,IAAI,EAAE;AAChE,IAAI,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE;AACxD,IAAI,OAAO;AACX,MAAM,GAAG,CAAC;AACV,MAAM,mBAAmB,EAAE,aAAa;AACxC,MAAM,WAAW,EAAE,kBAAkB;AACrC,QAAQ,aAAa;AACrB,QAAQ;AACR;AACA,KAAK;AACL,EAAE,CAAC,CAAC;AACJ,EAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACnC;AACK,MAAC,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAC5C,EAAE,0BAA0B,CAAC,MAAM,CAAC;AACpC,EAAE,MAAM,IAAI,GAAG,eAAe,EAAE;AAChC,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC;AACjD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI;AACtD,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,oBAAoB,CAAC,WAAW,CAAC;AAC7D,EAAE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE;AAC3E,IAAI,QAAQ;AACZ,MAAM,GAAG;AACT,MAAM,YAAY,CAAC,SAAS;AAC5B,MAAM;AACN,KAAK;AACL,EAAE;AACF,EAAE,IAAI;AACN,IAAI,IAAI,IAAI;AACZ,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE;AAC3B,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;AAC1F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC;AAC5E,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE;AAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,MAAM;AACX,MAAM,QAAQ;AACd,QAAQ,GAAG;AACX,QAAQ,YAAY,CAAC,QAAQ;AAC7B,QAAQ,CAAC,kCAAkC,EAAE,IAAI,CAAC,IAAI,CAAC,+BAA+B;AACtF,OAAO;AACP,IAAI;AACJ,IAAI,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;AAC7B,MAAM,MAAM,0BAA0B,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC;AACrE,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,WAAW;AACzC,IAAI,IAAI,KAAK,EAAE;AACf,MAAM,MAAM,QAAQ,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACjE,MAAM,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE;AACnE,QAAQ,KAAK;AACb,QAAQ,MAAM,EAAE,IAAI,CAAC,EAAE;AACvB,QAAQ,IAAI,EAAE,QAAQ;AACtB,QAAQ,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACjF,QAAQ,QAAQ;AAChB,QAAQ,SAAS,EAAE,QAAQ;AAC3B,QAAQ,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE;AAC7C,QAAQ,SAAS,EAAE;AACnB,OAAO,CAAC;AACR,IAAI;AACJ,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACtC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,uBAAuB,CAAC;AAChD,EAAE;AACF;;;;"}
+{"version":3,"file":"_server.ts.js-B9ZWJoST.js","sources":["../../../../../../../../.svelte-kit/output/server/entries/endpoints/admin/api/users/_server.ts.js"],"sourcesContent":["import { json } from \"@sveltejs/kit\";\nimport { z } from \"zod\";\nimport { b as getAuthProvider, e as getOrganizationProvider, q as getPermissionStore } from \"../../../../../chunks/providers.server.js\";\nimport { e as requireManageInstanceUsers } from \"../../../../../chunks/access.server.js\";\nimport { l as listAllOrgMembers } from \"../../../../../chunks/org-members.server.js\";\nimport { s as setUserPlatformPermissions } from \"../../../../../chunks/permissions.server.js\";\nimport { a as apiError, t as throwZodError, A as ApiErrorCode, h as handleApiError } from \"../../../../../chunks/api-errors.js\";\nimport { P as PlatformPermissionSchema, a as OrgPermissionSchema, h as hasPermission, S as SYSTEM_CONTEXT, M as MEMBER_ASSIGNABLE_PERMISSIONS } from \"../../../../../chunks/context.js\";\nimport { f as flattenPermissions, s as splitFlatPermissions } from \"../../../../../chunks/permissions-compat.server.js\";\nconst FlatPermissionSchema = z.union([PlatformPermissionSchema, OrgPermissionSchema]);\nconst BaseUserBody = z.object({\n  email: z.string().email(\"Valid email is required\"),\n  permissions: z.array(FlatPermissionSchema)\n});\nconst PasswordUserBody = BaseUserBody.extend({\n  password: z.string().min(8, \"Password must be at least 8 characters\").optional()\n});\nconst GET = async ({ locals }) => {\n  requireManageInstanceUsers(locals);\n  const page = await getAuthProvider().listUsers({ limit: 200 });\n  if (page === null) {\n    apiError(\n      501,\n      ApiErrorCode.INTERNAL,\n      \"User management is not supported by the current auth provider. Configure DATA_PATH (local provider) or check your provider wiring.\"\n    );\n  }\n  const orgId = locals.ctx?.actingOrgId;\n  const orgs = getOrganizationProvider();\n  const userIds = page.items.map((u) => u.id);\n  const platformByUser = await getPermissionStore().getForBatch(locals.ctx, userIds);\n  const memberByUserId = /* @__PURE__ */ new Map();\n  if (orgId) {\n    for (const m of await listAllOrgMembers(orgs, orgId)) memberByUserId.set(m.userId, m);\n  }\n  const flattened = page.items.map((u) => {\n    const orgPerms = memberByUserId.get(u.id)?.permissions ?? [];\n    const platformPerms = platformByUser.get(u.id) ?? [];\n    return {\n      ...u,\n      platformPermissions: platformPerms,\n      permissions: flattenPermissions(\n        platformPerms,\n        orgPerms\n      )\n    };\n  });\n  return json({ users: flattened });\n};\nconst POST = async ({ request, locals }) => {\n  requireManageInstanceUsers(locals);\n  const auth = getAuthProvider();\n  const body = await request.json().catch(() => null);\n  const parsed = PasswordUserBody.safeParse(body);\n  if (!parsed.success) throwZodError(parsed.error);\n  const { email, password, permissions } = parsed.data;\n  const { platform, org } = splitFlatPermissions(permissions);\n  if (platform.length > 0 && !hasPermission(locals.ctx, \"instance_admin\")) {\n    apiError(\n      403,\n      ApiErrorCode.FORBIDDEN,\n      \"Only a platform admin can grant platform-scope permissions\"\n    );\n  }\n  try {\n    let user;\n    if (auth.passwordAuth) {\n      if (!password) apiError(400, ApiErrorCode.VALIDATION_FAILED, \"Password is required\");\n      user = await auth.passwordAuth.createUserWithPassword(email, password);\n    } else if (auth.createUser) {\n      user = await auth.createUser(email);\n    } else {\n      apiError(\n        501,\n        ApiErrorCode.INTERNAL,\n        `User creation is not supported by ${auth.name}. Users are managed externally.`\n      );\n    }\n    if (platform.length > 0) {\n      await setUserPlatformPermissions(locals.ctx, user.id, platform);\n    }\n    const orgId = locals.ctx?.actingOrgId;\n    if (orgId) {\n      const joinedAt = (/* @__PURE__ */ new Date()).toISOString();\n      await getOrganizationProvider().addOrgMember(SYSTEM_CONTEXT, {\n        orgId,\n        userId: user.id,\n        role: \"member\",\n        permissions: org.filter((p) => MEMBER_ASSIGNABLE_PERMISSIONS.includes(p)),\n        joinedAt,\n        updatedAt: joinedAt,\n        updatedBy: locals.user?.id ?? user.id,\n        deletedAt: null\n      });\n    }\n    return json(user, { status: 201 });\n  } catch (err) {\n    handleApiError(err, \"Failed to create user\");\n  }\n};\nexport {\n  GET,\n  POST\n};\n"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;AASA,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;AACrF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;AAC9B,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,yBAAyB,CAAC;AACpD,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB;AAC3C,CAAC,CAAC;AACF,MAAM,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC;AAC7C,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wCAAwC,CAAC,CAAC,QAAQ;AAChF,CAAC,CAAC;AACG,MAAC,GAAG,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK;AAClC,EAAE,0BAA0B,CAAC,MAAM,CAAC;AACpC,EAAE,MAAM,IAAI,GAAG,MAAM,eAAe,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AAChE,EAAE,IAAI,IAAI,KAAK,IAAI,EAAE;AACrB,IAAI,QAAQ;AACZ,MAAM,GAAG;AACT,MAAM,YAAY,CAAC,QAAQ;AAC3B,MAAM;AACN,KAAK;AACL,EAAE;AACF,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,WAAW;AACvC,EAAE,MAAM,IAAI,GAAG,uBAAuB,EAAE;AACxC,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC7C,EAAE,MAAM,cAAc,GAAG,MAAM,kBAAkB,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC;AACpF,EAAE,MAAM,cAAc,mBAAmB,IAAI,GAAG,EAAE;AAClD,EAAE,IAAI,KAAK,EAAE;AACb,IAAI,KAAK,MAAM,CAAC,IAAI,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACzF,EAAE;AACF,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK;AAC1C,IAAI,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,IAAI,EAAE;AAChE,IAAI,MAAM,aAAa,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE;AACxD,IAAI,OAAO;AACX,MAAM,GAAG,CAAC;AACV,MAAM,mBAAmB,EAAE,aAAa;AACxC,MAAM,WAAW,EAAE,kBAAkB;AACrC,QAAQ,aAAa;AACrB,QAAQ;AACR;AACA,KAAK;AACL,EAAE,CAAC,CAAC;AACJ,EAAE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACnC;AACK,MAAC,IAAI,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK;AAC5C,EAAE,0BAA0B,CAAC,MAAM,CAAC;AACpC,EAAE,MAAM,IAAI,GAAG,eAAe,EAAE;AAChC,EAAE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC;AACrD,EAAE,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC;AACjD,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC;AAClD,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC,IAAI;AACtD,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,oBAAoB,CAAC,WAAW,CAAC;AAC7D,EAAE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,EAAE;AAC3E,IAAI,QAAQ;AACZ,MAAM,GAAG;AACT,MAAM,YAAY,CAAC,SAAS;AAC5B,MAAM;AACN,KAAK;AACL,EAAE;AACF,EAAE,IAAI;AACN,IAAI,IAAI,IAAI;AACZ,IAAI,IAAI,IAAI,CAAC,YAAY,EAAE;AAC3B,MAAM,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;AAC1F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,KAAK,EAAE,QAAQ,CAAC;AAC5E,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE;AAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;AACzC,IAAI,CAAC,MAAM;AACX,MAAM,QAAQ;AACd,QAAQ,GAAG;AACX,QAAQ,YAAY,CAAC,QAAQ;AAC7B,QAAQ,CAAC,kCAAkC,EAAE,IAAI,CAAC,IAAI,CAAC,+BAA+B;AACtF,OAAO;AACP,IAAI;AACJ,IAAI,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE;AAC7B,MAAM,MAAM,0BAA0B,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,CAAC;AACrE,IAAI;AACJ,IAAI,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,WAAW;AACzC,IAAI,IAAI,KAAK,EAAE;AACf,MAAM,MAAM,QAAQ,GAAG,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE;AACjE,MAAM,MAAM,uBAAuB,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE;AACnE,QAAQ,KAAK;AACb,QAAQ,MAAM,EAAE,IAAI,CAAC,EAAE;AACvB,QAAQ,IAAI,EAAE,QAAQ;AACtB,QAAQ,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACjF,QAAQ,QAAQ;AAChB,QAAQ,SAAS,EAAE,QAAQ;AAC3B,QAAQ,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC,EAAE;AAC7C,QAAQ,SAAS,EAAE;AACnB,OAAO,CAAC;AACR,IAAI;AACJ,IAAI,OAAO,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACtC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,IAAI,cAAc,CAAC,GAAG,EAAE,uBAAuB,CAAC;AAChD,EAAE;AACF;;;;"}