@shipfox/api-auth 9.1.0 → 9.2.0

package/dist/db/db.d.ts

@@ -1,5 +1,114 @@
 import { type NodePgDatabase } from '@shipfox/node-drizzle';
 export declare const schema: {
+    adminGrants: import("drizzle-orm/pg-core").PgTableWithColumns<{
+        name: "admin_grants";
+        schema: undefined;
+        columns: {
+            id: import("drizzle-orm/pg-core").PgColumn<{
+                name: "id";
+                tableName: "admin_grants";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: true;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            userId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "user_id";
+                tableName: "admin_grants";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            role: import("drizzle-orm/pg-core").PgColumn<{
+                name: "role";
+                tableName: "admin_grants";
+                dataType: "string";
+                columnType: "PgEnumColumn";
+                data: "admin-observer" | "admin-operator" | "admin-owner";
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: ["admin-observer", "admin-operator", "admin-owner"];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "revoked_at";
+                tableName: "admin_grants";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            createdAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "created_at";
+                tableName: "admin_grants";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "updated_at";
+                tableName: "admin_grants";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+        };
+        dialect: "pg";
+    }>;
     users: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "users";
         schema: undefined;
@@ -768,6 +877,115 @@ export declare const schema: {
     }>;
 };
 export declare function db(): NodePgDatabase<{
+    adminGrants: import("drizzle-orm/pg-core").PgTableWithColumns<{
+        name: "admin_grants";
+        schema: undefined;
+        columns: {
+            id: import("drizzle-orm/pg-core").PgColumn<{
+                name: "id";
+                tableName: "admin_grants";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: true;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            userId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "user_id";
+                tableName: "admin_grants";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            role: import("drizzle-orm/pg-core").PgColumn<{
+                name: "role";
+                tableName: "admin_grants";
+                dataType: "string";
+                columnType: "PgEnumColumn";
+                data: "admin-observer" | "admin-operator" | "admin-owner";
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: ["admin-observer", "admin-operator", "admin-owner"];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "revoked_at";
+                tableName: "admin_grants";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            createdAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "created_at";
+                tableName: "admin_grants";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "updated_at";
+                tableName: "admin_grants";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+        };
+        dialect: "pg";
+    }>;
     users: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "users";
         schema: undefined;

package/dist/db/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAQnE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMlB,CAAC;AAIF,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AASnE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOlB,CAAC;AAIF,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B"}

package/dist/db/db.js

@@ -1,11 +1,13 @@
 import { drizzle } from '@shipfox/node-drizzle';
 import { pgClient } from '@shipfox/node-postgres';
+import { adminGrants } from './schema/admin-grants.js';
 import { authOutbox } from './schema/outbox.js';
 import { passwordResets } from './schema/password-resets.js';
 import { authRateLimits } from './schema/rate-limits.js';
 import { refreshTokens } from './schema/refresh-tokens.js';
 import { users } from './schema/users.js';
 export const schema = {
+    adminGrants,
     users,
     passwordResets,
     refreshTokens,

package/dist/db/db.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/db.ts"],"sourcesContent":["import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';\nimport {pgClient} from '@shipfox/node-postgres';\nimport {authOutbox} from './schema/outbox.js';\nimport {passwordResets} from './schema/password-resets.js';\nimport {authRateLimits} from './schema/rate-limits.js';\nimport {refreshTokens} from './schema/refresh-tokens.js';\nimport {users} from './schema/users.js';\n\nexport const schema = {\n  users,\n  passwordResets,\n  refreshTokens,\n  authOutbox,\n  authRateLimits,\n};\n\nlet _db: NodePgDatabase<typeof schema> | undefined;\n\nexport function db() {\n  if (!_db) _db = drizzle(pgClient(), {schema});\n  return _db;\n}\n\nexport function closeDb(): void {\n  _db = undefined;\n}\n"],"names":["drizzle","pgClient","authOutbox","passwordResets","authRateLimits","refreshTokens","users","schema","_db","db","closeDb","undefined"],"mappings":"AAAA,SAAQA,OAAO,QAA4B,wBAAwB;AACnE,SAAQC,QAAQ,QAAO,yBAAyB;AAChD,SAAQC,UAAU,QAAO,qBAAqB;AAC9C,SAAQC,cAAc,QAAO,8BAA8B;AAC3D,SAAQC,cAAc,QAAO,0BAA0B;AACvD,SAAQC,aAAa,QAAO,6BAA6B;AACzD,SAAQC,KAAK,QAAO,oBAAoB;AAExC,OAAO,MAAMC,SAAS;IACpBD;IACAH;IACAE;IACAH;IACAE;AACF,EAAE;AAEF,IAAII;AAEJ,OAAO,SAASC;IACd,IAAI,CAACD,KAAKA,MAAMR,QAAQC,YAAY;QAACM;IAAM;IAC3C,OAAOC;AACT;AAEA,OAAO,SAASE;IACdF,MAAMG;AACR"}
+{"version":3,"sources":["../../src/db/db.ts"],"sourcesContent":["import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';\nimport {pgClient} from '@shipfox/node-postgres';\nimport {adminGrants} from './schema/admin-grants.js';\nimport {authOutbox} from './schema/outbox.js';\nimport {passwordResets} from './schema/password-resets.js';\nimport {authRateLimits} from './schema/rate-limits.js';\nimport {refreshTokens} from './schema/refresh-tokens.js';\nimport {users} from './schema/users.js';\n\nexport const schema = {\n  adminGrants,\n  users,\n  passwordResets,\n  refreshTokens,\n  authOutbox,\n  authRateLimits,\n};\n\nlet _db: NodePgDatabase<typeof schema> | undefined;\n\nexport function db() {\n  if (!_db) _db = drizzle(pgClient(), {schema});\n  return _db;\n}\n\nexport function closeDb(): void {\n  _db = undefined;\n}\n"],"names":["drizzle","pgClient","adminGrants","authOutbox","passwordResets","authRateLimits","refreshTokens","users","schema","_db","db","closeDb","undefined"],"mappings":"AAAA,SAAQA,OAAO,QAA4B,wBAAwB;AACnE,SAAQC,QAAQ,QAAO,yBAAyB;AAChD,SAAQC,WAAW,QAAO,2BAA2B;AACrD,SAAQC,UAAU,QAAO,qBAAqB;AAC9C,SAAQC,cAAc,QAAO,8BAA8B;AAC3D,SAAQC,cAAc,QAAO,0BAA0B;AACvD,SAAQC,aAAa,QAAO,6BAA6B;AACzD,SAAQC,KAAK,QAAO,oBAAoB;AAExC,OAAO,MAAMC,SAAS;IACpBN;IACAK;IACAH;IACAE;IACAH;IACAE;AACF,EAAE;AAEF,IAAII;AAEJ,OAAO,SAASC;IACd,IAAI,CAACD,KAAKA,MAAMT,QAAQC,YAAY;QAACO;IAAM;IAC3C,OAAOC;AACT;AAEA,OAAO,SAASE;IACdF,MAAMG;AACR"}

package/dist/db/schema/admin-grants.d.ts

@@ -0,0 +1,115 @@
+import type { AdminGrant } from '#core/entities/admin-grant.js';
+export declare const adminRoleEnum: import("drizzle-orm/pg-core").PgEnum<["admin-observer", "admin-operator", "admin-owner"]>;
+export declare const adminGrants: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "admin_grants";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "admin_grants";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "admin_grants";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        role: import("drizzle-orm/pg-core").PgColumn<{
+            name: "role";
+            tableName: "admin_grants";
+            dataType: "string";
+            columnType: "PgEnumColumn";
+            data: "admin-observer" | "admin-operator" | "admin-owner";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["admin-observer", "admin-operator", "admin-owner"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "revoked_at";
+            tableName: "admin_grants";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "admin_grants";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "admin_grants";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export type AdminGrantDb = typeof adminGrants.$inferSelect;
+export type AdminGrantCreateDb = typeof adminGrants.$inferInsert;
+export declare function toAdminGrant(row: AdminGrantDb): AdminGrant;
+//# sourceMappingURL=admin-grants.d.ts.map

package/dist/db/schema/admin-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-grants.d.ts","sourceRoot":"","sources":["../../../src/db/schema/admin-grants.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,+BAA+B,CAAC;AAI9D,eAAO,MAAM,aAAa,2FAIxB,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBvB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,OAAO,WAAW,CAAC,YAAY,CAAC;AAC3D,MAAM,MAAM,kBAAkB,GAAG,OAAO,WAAW,CAAC,YAAY,CAAC;AAEjE,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,GAAG,UAAU,CAS1D"}

package/dist/db/schema/admin-grants.js

@@ -0,0 +1,42 @@
+import { uuidv7PrimaryKey } from '@shipfox/node-drizzle';
+import { sql } from 'drizzle-orm';
+import { index, pgEnum, timestamp, uniqueIndex, uuid } from 'drizzle-orm/pg-core';
+import { pgTable } from './common.js';
+import { users } from './users.js';
+export const adminRoleEnum = pgEnum('auth_admin_role', [
+    'admin-observer',
+    'admin-operator',
+    'admin-owner'
+]);
+export const adminGrants = pgTable('admin_grants', {
+    id: uuidv7PrimaryKey(),
+    userId: uuid('user_id').notNull().references(()=>users.id, {
+        onDelete: 'cascade'
+    }),
+    role: adminRoleEnum('role').notNull(),
+    revokedAt: timestamp('revoked_at', {
+        withTimezone: true
+    }),
+    createdAt: timestamp('created_at', {
+        withTimezone: true
+    }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {
+        withTimezone: true
+    }).notNull().defaultNow()
+}, (table)=>[
+        index('auth_admin_grants_user_id_idx').on(table.userId),
+        index('auth_admin_grants_active_owners_idx').on(table.userId).where(sql`${table.role} = 'admin-owner' AND ${table.revokedAt} IS NULL`),
+        uniqueIndex('auth_admin_grants_active_user_role_unique').on(table.userId, table.role).where(sql`${table.revokedAt} IS NULL`)
+    ]);
+export function toAdminGrant(row) {
+    return {
+        id: row.id,
+        userId: row.userId,
+        role: row.role,
+        revokedAt: row.revokedAt,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt
+    };
+}
+
+//# sourceMappingURL=admin-grants.js.map

package/dist/db/schema/admin-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/db/schema/admin-grants.ts"],"sourcesContent":["import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';\nimport {sql} from 'drizzle-orm';\nimport {index, pgEnum, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';\nimport type {AdminGrant} from '#core/entities/admin-grant.js';\nimport {pgTable} from './common.js';\nimport {users} from './users.js';\n\nexport const adminRoleEnum = pgEnum('auth_admin_role', [\n  'admin-observer',\n  'admin-operator',\n  'admin-owner',\n]);\n\nexport const adminGrants = pgTable(\n  'admin_grants',\n  {\n    id: uuidv7PrimaryKey(),\n    userId: uuid('user_id')\n      .notNull()\n      .references(() => users.id, {onDelete: 'cascade'}),\n    role: adminRoleEnum('role').notNull(),\n    revokedAt: timestamp('revoked_at', {withTimezone: true}),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [\n    index('auth_admin_grants_user_id_idx').on(table.userId),\n    index('auth_admin_grants_active_owners_idx')\n      .on(table.userId)\n      .where(sql`${table.role} = 'admin-owner' AND ${table.revokedAt} IS NULL`),\n    uniqueIndex('auth_admin_grants_active_user_role_unique')\n      .on(table.userId, table.role)\n      .where(sql`${table.revokedAt} IS NULL`),\n  ],\n);\n\nexport type AdminGrantDb = typeof adminGrants.$inferSelect;\nexport type AdminGrantCreateDb = typeof adminGrants.$inferInsert;\n\nexport function toAdminGrant(row: AdminGrantDb): AdminGrant {\n  return {\n    id: row.id,\n    userId: row.userId,\n    role: row.role,\n    revokedAt: row.revokedAt,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n"],"names":["uuidv7PrimaryKey","sql","index","pgEnum","timestamp","uniqueIndex","uuid","pgTable","users","adminRoleEnum","adminGrants","id","userId","notNull","references","onDelete","role","revokedAt","withTimezone","createdAt","defaultNow","updatedAt","table","on","where","toAdminGrant","row"],"mappings":"AAAA,SAAQA,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,GAAG,QAAO,cAAc;AAChC,SAAQC,KAAK,EAAEC,MAAM,EAAEC,SAAS,EAAEC,WAAW,EAAEC,IAAI,QAAO,sBAAsB;AAEhF,SAAQC,OAAO,QAAO,cAAc;AACpC,SAAQC,KAAK,QAAO,aAAa;AAEjC,OAAO,MAAMC,gBAAgBN,OAAO,mBAAmB;IACrD;IACA;IACA;CACD,EAAE;AAEH,OAAO,MAAMO,cAAcH,QACzB,gBACA;IACEI,IAAIX;IACJY,QAAQN,KAAK,WACVO,OAAO,GACPC,UAAU,CAAC,IAAMN,MAAMG,EAAE,EAAE;QAACI,UAAU;IAAS;IAClDC,MAAMP,cAAc,QAAQI,OAAO;IACnCI,WAAWb,UAAU,cAAc;QAACc,cAAc;IAAI;IACtDC,WAAWf,UAAU,cAAc;QAACc,cAAc;IAAI,GAAGL,OAAO,GAAGO,UAAU;IAC7EC,WAAWjB,UAAU,cAAc;QAACc,cAAc;IAAI,GAAGL,OAAO,GAAGO,UAAU;AAC/E,GACA,CAACE,QAAU;QACTpB,MAAM,iCAAiCqB,EAAE,CAACD,MAAMV,MAAM;QACtDV,MAAM,uCACHqB,EAAE,CAACD,MAAMV,MAAM,EACfY,KAAK,CAACvB,GAAG,CAAC,EAAEqB,MAAMN,IAAI,CAAC,qBAAqB,EAAEM,MAAML,SAAS,CAAC,QAAQ,CAAC;QAC1EZ,YAAY,6CACTkB,EAAE,CAACD,MAAMV,MAAM,EAAEU,MAAMN,IAAI,EAC3BQ,KAAK,CAACvB,GAAG,CAAC,EAAEqB,MAAML,SAAS,CAAC,QAAQ,CAAC;KACzC,EACD;AAKF,OAAO,SAASQ,aAAaC,GAAiB;IAC5C,OAAO;QACLf,IAAIe,IAAIf,EAAE;QACVC,QAAQc,IAAId,MAAM;QAClBI,MAAMU,IAAIV,IAAI;QACdC,WAAWS,IAAIT,SAAS;QACxBE,WAAWO,IAAIP,SAAS;QACxBE,WAAWK,IAAIL,SAAS;IAC1B;AACF"}

package/dist/index.d.ts

@@ -1,18 +1,25 @@
 import type { ShipfoxModule } from '@shipfox/node-module';
-export type { JobLeaseTokenClaims, RunnerSessionTokenClaims } from '@shipfox/api-auth-dto';
+import type { SignupPolicy } from '#core/ports.js';
+export type { AdminRole, JobLeaseTokenClaims, RunnerSessionTokenClaims } from '@shipfox/api-auth-dto';
+export { ADMIN_ROLES, getCurrentAdminRole, hasMinimumAdminRole, highestAdminRole, requireAdminRole, revokeAdminGrant, } from '#core/admin-role.js';
 export type { CreateSessionForUserError, CreateSessionForUserParams, CreateSessionForUserResult, ProvisionUserParams, } from '#core/auth.js';
 export { createSessionForUser, provisionUser } from '#core/auth.js';
 export type { EmailOwner, FindUserByEmailParams } from '#core/email-owner.js';
 export { findUserByEmail } from '#core/email-owner.js';
+export type { AdminGrant } from '#core/entities/admin-grant.js';
 export type { User, UserStatus } from '#core/entities/user.js';
-export { AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidCredentialsError, UserNotFoundError, } from '#core/errors.js';
+export { AdminRoleRequiredError, AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidCredentialsError, LastAdminOwnerError, SignupNotAllowedError, UserNotFoundError, } from '#core/errors.js';
 export { issueJobLeaseToken, jobLeaseParamsFrom, verifyJobLeaseToken, } from '#core/job-lease-token.js';
+export type { SignupPolicy } from '#core/ports.js';
 export { issueRunnerSessionToken, verifyRunnerSessionToken, } from '#core/runner-session-token.js';
+export { createEnvironmentSignupPolicy, DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE, } from '#core/signup-policy.js';
 export { type AuthenticatedSessionContext, createJwtAuthMethod, getAuthenticatedSessionContext, type RefreshSessionId, type UserId, } from '#presentation/auth/jwt-auth.js';
 export { createLeaseTokenAuthMethod } from '#presentation/auth/lease-token-auth.js';
 export { authCookiePlugin, clearRefreshTokenCookie, getRefreshTokenCookie, setRefreshTokenCookie, } from '#presentation/auth/refresh-cookie.js';
 export { createRunnerSessionAuthMethod } from '#presentation/auth/runner-session-auth.js';
-export declare function createAuthModule({ workspaces, }: {
+export interface CreateAuthModuleOptions {
     workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;
-}): ShipfoxModule;
+    signupPolicy?: SignupPolicy;
+}
+export declare function createAuthModule({ workspaces, signupPolicy, }: CreateAuthModuleOptions): ShipfoxModule;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AAexD,YAAY,EAAC,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACzF,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,oBAAoB,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AAClE,YAAY,EAAC,UAAU,EAAE,qBAAqB,EAAC,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAC,IAAI,EAAE,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,KAAK,2BAA2B,EAChC,mBAAmB,EACnB,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,KAAK,MAAM,GACZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAC,0BAA0B,EAAC,MAAM,wCAAwC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAC,6BAA6B,EAAC,MAAM,2CAA2C,CAAC;AAIxF,wBAAgB,gBAAgB,CAAC,EAC/B,UAAU,GACX,EAAE;IACD,UAAU,EAAE,OAAO,0CAA0C,EAAE,2BAA2B,CAAC;CAC5F,GAAG,aAAa,CAYhB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AAGxD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAcjD,YAAY,EAAC,SAAS,EAAE,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACpG,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,oBAAoB,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AAClE,YAAY,EAAC,UAAU,EAAE,qBAAqB,EAAC,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAC,UAAU,EAAC,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAC,IAAI,EAAE,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,2BAA2B,EAChC,mBAAmB,EACnB,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,KAAK,MAAM,GACZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAC,0BAA0B,EAAC,MAAM,wCAAwC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAC,6BAA6B,EAAC,MAAM,2CAA2C,CAAC;AAIxF,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,OAAO,0CAA0C,EAAE,2BAA2B,CAAC;IAC3F,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,CAAC,EAC/B,UAAU,EACV,YAA8C,GAC/C,EAAE,uBAAuB,GAAG,aAAa,CAYzC"}

package/dist/index.js

@@ -1,6 +1,7 @@
 import { AUTH_PASSWORD_RESET_SEND_REQUESTED, authEventSchemas } from '@shipfox/api-auth-dto';
 import { subscriberFactory } from '@shipfox/node-module';
 import { config } from '#config.js';
+import { createEnvironmentSignupPolicy } from '#core/signup-policy.js';
 import { db } from '#db/db.js';
 import { migrationsPath } from '#db/migrations.js';
 import { authOutbox } from '#db/schema/outbox.js';
@@ -12,17 +13,19 @@ import { createAuthInterModulePresentation } from '#presentation/inter-module.js
 import { buildAuthRoutes } from '#presentation/routes/index.js';
 import { onPasswordResetSendRequested } from '#presentation/subscribers/index.js';
 import { passwordLoginMethods } from './login-methods.js';
+export { ADMIN_ROLES, getCurrentAdminRole, hasMinimumAdminRole, highestAdminRole, requireAdminRole, revokeAdminGrant } from '#core/admin-role.js';
 export { createSessionForUser, provisionUser } from '#core/auth.js';
 export { findUserByEmail } from '#core/email-owner.js';
-export { AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidCredentialsError, UserNotFoundError } from '#core/errors.js';
+export { AdminRoleRequiredError, AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidCredentialsError, LastAdminOwnerError, SignupNotAllowedError, UserNotFoundError } from '#core/errors.js';
 export { issueJobLeaseToken, jobLeaseParamsFrom, verifyJobLeaseToken } from '#core/job-lease-token.js';
 export { issueRunnerSessionToken, verifyRunnerSessionToken } from '#core/runner-session-token.js';
+export { createEnvironmentSignupPolicy, DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE } from '#core/signup-policy.js';
 export { createJwtAuthMethod, getAuthenticatedSessionContext } from '#presentation/auth/jwt-auth.js';
 export { createLeaseTokenAuthMethod } from '#presentation/auth/lease-token-auth.js';
 export { authCookiePlugin, clearRefreshTokenCookie, getRefreshTokenCookie, setRefreshTokenCookie } from '#presentation/auth/refresh-cookie.js';
 export { createRunnerSessionAuthMethod } from '#presentation/auth/runner-session-auth.js';
 const subscriber = subscriberFactory();
-export function createAuthModule({ workspaces }) {
+export function createAuthModule({ workspaces, signupPolicy = createEnvironmentSignupPolicy() }) {
     return {
         name: 'auth',
         database: {
@@ -37,7 +40,7 @@ export function createAuthModule({ workspaces }) {
         ],
         loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),
         routes: [
-            buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces)
+            buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces, signupPolicy)
         ],
         e2eRoutes: [
             createAuthE2eRoutes(workspaces)

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\n  AUTH_PASSWORD_RESET_SEND_REQUESTED,\n  type AuthEventMap,\n  authEventSchemas,\n} from '@shipfox/api-auth-dto';\nimport type {ShipfoxModule} from '@shipfox/node-module';\nimport {subscriberFactory} from '@shipfox/node-module';\nimport {config} from '#config.js';\nimport {db} from '#db/db.js';\nimport {migrationsPath} from '#db/migrations.js';\nimport {authOutbox} from '#db/schema/outbox.js';\nimport {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';\nimport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nimport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\nimport {createAuthE2eRoutes} from '#presentation/e2eRoutes/index.js';\nimport {createAuthInterModulePresentation} from '#presentation/inter-module.js';\nimport {buildAuthRoutes} from '#presentation/routes/index.js';\nimport {onPasswordResetSendRequested} from '#presentation/subscribers/index.js';\nimport {passwordLoginMethods} from './login-methods.js';\n\nexport type {JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';\nexport type {\n  CreateSessionForUserError,\n  CreateSessionForUserParams,\n  CreateSessionForUserResult,\n  ProvisionUserParams,\n} from '#core/auth.js';\nexport {createSessionForUser, provisionUser} from '#core/auth.js';\nexport type {EmailOwner, FindUserByEmailParams} from '#core/email-owner.js';\nexport {findUserByEmail} from '#core/email-owner.js';\nexport type {User, UserStatus} from '#core/entities/user.js';\nexport {\n  AuthDependencyUnavailableError,\n  EmailNotVerifiedError,\n  InvalidCredentialsError,\n  UserNotFoundError,\n} from '#core/errors.js';\nexport {\n  issueJobLeaseToken,\n  jobLeaseParamsFrom,\n  verifyJobLeaseToken,\n} from '#core/job-lease-token.js';\nexport {\n  issueRunnerSessionToken,\n  verifyRunnerSessionToken,\n} from '#core/runner-session-token.js';\nexport {\n  type AuthenticatedSessionContext,\n  createJwtAuthMethod,\n  getAuthenticatedSessionContext,\n  type RefreshSessionId,\n  type UserId,\n} from '#presentation/auth/jwt-auth.js';\nexport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nexport {\n  authCookiePlugin,\n  clearRefreshTokenCookie,\n  getRefreshTokenCookie,\n  setRefreshTokenCookie,\n} from '#presentation/auth/refresh-cookie.js';\nexport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\n\nconst subscriber = subscriberFactory<AuthEventMap>();\n\nexport function createAuthModule({\n  workspaces,\n}: {\n  workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;\n}): ShipfoxModule {\n  return {\n    name: 'auth',\n    database: {db, migrationsPath, databaseNamespace: 'auth'},\n    auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],\n    loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),\n    routes: [buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces)],\n    e2eRoutes: [createAuthE2eRoutes(workspaces)],\n    publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authEventSchemas}],\n    subscribers: [subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested)],\n    interModulePresentations: [createAuthInterModulePresentation()],\n  };\n}\n"],"names":["AUTH_PASSWORD_RESET_SEND_REQUESTED","authEventSchemas","subscriberFactory","config","db","migrationsPath","authOutbox","createJwtAuthMethod","createLeaseTokenAuthMethod","createRunnerSessionAuthMethod","createAuthE2eRoutes","createAuthInterModulePresentation","buildAuthRoutes","onPasswordResetSendRequested","passwordLoginMethods","createSessionForUser","provisionUser","findUserByEmail","AuthDependencyUnavailableError","EmailNotVerifiedError","InvalidCredentialsError","UserNotFoundError","issueJobLeaseToken","jobLeaseParamsFrom","verifyJobLeaseToken","issueRunnerSessionToken","verifyRunnerSessionToken","getAuthenticatedSessionContext","authCookiePlugin","clearRefreshTokenCookie","getRefreshTokenCookie","setRefreshTokenCookie","subscriber","createAuthModule","workspaces","name","database","databaseNamespace","auth","loginMethods","AUTH_PASSWORD_ENABLED","routes","e2eRoutes","publishers","table","eventSchemas","subscribers","interModulePresentations"],"mappings":"AAAA,SACEA,kCAAkC,EAElCC,gBAAgB,QACX,wBAAwB;AAE/B,SAAQC,iBAAiB,QAAO,uBAAuB;AACvD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,EAAE,QAAO,YAAY;AAC7B,SAAQC,cAAc,QAAO,oBAAoB;AACjD,SAAQC,UAAU,QAAO,uBAAuB;AAChD,SAAQC,mBAAmB,QAAO,iCAAiC;AACnE,SAAQC,0BAA0B,QAAO,yCAAyC;AAClF,SAAQC,6BAA6B,QAAO,4CAA4C;AACxF,SAAQC,mBAAmB,QAAO,mCAAmC;AACrE,SAAQC,iCAAiC,QAAO,gCAAgC;AAChF,SAAQC,eAAe,QAAO,gCAAgC;AAC9D,SAAQC,4BAA4B,QAAO,qCAAqC;AAChF,SAAQC,oBAAoB,QAAO,qBAAqB;AASxD,SAAQC,oBAAoB,EAAEC,aAAa,QAAO,gBAAgB;AAElE,SAAQC,eAAe,QAAO,uBAAuB;AAErD,SACEC,8BAA8B,EAC9BC,qBAAqB,EACrBC,uBAAuB,EACvBC,iBAAiB,QACZ,kBAAkB;AACzB,SACEC,kBAAkB,EAClBC,kBAAkB,EAClBC,mBAAmB,QACd,2BAA2B;AAClC,SACEC,uBAAuB,EACvBC,wBAAwB,QACnB,gCAAgC;AACvC,SAEEnB,mBAAmB,EACnBoB,8BAA8B,QAGzB,iCAAiC;AACxC,SAAQnB,0BAA0B,QAAO,yCAAyC;AAClF,SACEoB,gBAAgB,EAChBC,uBAAuB,EACvBC,qBAAqB,EACrBC,qBAAqB,QAChB,uCAAuC;AAC9C,SAAQtB,6BAA6B,QAAO,4CAA4C;AAExF,MAAMuB,aAAa9B;AAEnB,OAAO,SAAS+B,iBAAiB,EAC/BC,UAAU,EAGX;IACC,OAAO;QACLC,MAAM;QACNC,UAAU;YAAChC;YAAIC;YAAgBgC,mBAAmB;QAAM;QACxDC,MAAM;YAAC/B;YAAuBC;YAA8BC;SAAgC;QAC5F8B,cAAczB,qBAAqBX,OAAOqC,qBAAqB;QAC/DC,QAAQ;YAAC7B,gBAAgBT,OAAOqC,qBAAqB,EAAEN;SAAY;QACnEQ,WAAW;YAAChC,oBAAoBwB;SAAY;QAC5CS,YAAY;YAAC;gBAACR,MAAM;gBAAQS,OAAOtC;gBAAYF;gBAAIyC,cAAc5C;YAAgB;SAAE;QACnF6C,aAAa;YAACd,WAAWhC,oCAAoCa;SAA8B;QAC3FkC,0BAA0B;YAACpC;SAAoC;IACjE;AACF"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\n  AUTH_PASSWORD_RESET_SEND_REQUESTED,\n  type AuthEventMap,\n  authEventSchemas,\n} from '@shipfox/api-auth-dto';\nimport type {ShipfoxModule} from '@shipfox/node-module';\nimport {subscriberFactory} from '@shipfox/node-module';\nimport {config} from '#config.js';\nimport type {SignupPolicy} from '#core/ports.js';\nimport {createEnvironmentSignupPolicy} from '#core/signup-policy.js';\nimport {db} from '#db/db.js';\nimport {migrationsPath} from '#db/migrations.js';\nimport {authOutbox} from '#db/schema/outbox.js';\nimport {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';\nimport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nimport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\nimport {createAuthE2eRoutes} from '#presentation/e2eRoutes/index.js';\nimport {createAuthInterModulePresentation} from '#presentation/inter-module.js';\nimport {buildAuthRoutes} from '#presentation/routes/index.js';\nimport {onPasswordResetSendRequested} from '#presentation/subscribers/index.js';\nimport {passwordLoginMethods} from './login-methods.js';\n\nexport type {AdminRole, JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';\nexport {\n  ADMIN_ROLES,\n  getCurrentAdminRole,\n  hasMinimumAdminRole,\n  highestAdminRole,\n  requireAdminRole,\n  revokeAdminGrant,\n} from '#core/admin-role.js';\nexport type {\n  CreateSessionForUserError,\n  CreateSessionForUserParams,\n  CreateSessionForUserResult,\n  ProvisionUserParams,\n} from '#core/auth.js';\nexport {createSessionForUser, provisionUser} from '#core/auth.js';\nexport type {EmailOwner, FindUserByEmailParams} from '#core/email-owner.js';\nexport {findUserByEmail} from '#core/email-owner.js';\nexport type {AdminGrant} from '#core/entities/admin-grant.js';\nexport type {User, UserStatus} from '#core/entities/user.js';\nexport {\n  AdminRoleRequiredError,\n  AuthDependencyUnavailableError,\n  EmailNotVerifiedError,\n  InvalidCredentialsError,\n  LastAdminOwnerError,\n  SignupNotAllowedError,\n  UserNotFoundError,\n} from '#core/errors.js';\nexport {\n  issueJobLeaseToken,\n  jobLeaseParamsFrom,\n  verifyJobLeaseToken,\n} from '#core/job-lease-token.js';\nexport type {SignupPolicy} from '#core/ports.js';\nexport {\n  issueRunnerSessionToken,\n  verifyRunnerSessionToken,\n} from '#core/runner-session-token.js';\nexport {\n  createEnvironmentSignupPolicy,\n  DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE,\n} from '#core/signup-policy.js';\nexport {\n  type AuthenticatedSessionContext,\n  createJwtAuthMethod,\n  getAuthenticatedSessionContext,\n  type RefreshSessionId,\n  type UserId,\n} from '#presentation/auth/jwt-auth.js';\nexport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nexport {\n  authCookiePlugin,\n  clearRefreshTokenCookie,\n  getRefreshTokenCookie,\n  setRefreshTokenCookie,\n} from '#presentation/auth/refresh-cookie.js';\nexport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\n\nconst subscriber = subscriberFactory<AuthEventMap>();\n\nexport interface CreateAuthModuleOptions {\n  workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;\n  signupPolicy?: SignupPolicy;\n}\n\nexport function createAuthModule({\n  workspaces,\n  signupPolicy = createEnvironmentSignupPolicy(),\n}: CreateAuthModuleOptions): ShipfoxModule {\n  return {\n    name: 'auth',\n    database: {db, migrationsPath, databaseNamespace: 'auth'},\n    auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],\n    loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),\n    routes: [buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces, signupPolicy)],\n    e2eRoutes: [createAuthE2eRoutes(workspaces)],\n    publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authEventSchemas}],\n    subscribers: [subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested)],\n    interModulePresentations: [createAuthInterModulePresentation()],\n  };\n}\n"],"names":["AUTH_PASSWORD_RESET_SEND_REQUESTED","authEventSchemas","subscriberFactory","config","createEnvironmentSignupPolicy","db","migrationsPath","authOutbox","createJwtAuthMethod","createLeaseTokenAuthMethod","createRunnerSessionAuthMethod","createAuthE2eRoutes","createAuthInterModulePresentation","buildAuthRoutes","onPasswordResetSendRequested","passwordLoginMethods","ADMIN_ROLES","getCurrentAdminRole","hasMinimumAdminRole","highestAdminRole","requireAdminRole","revokeAdminGrant","createSessionForUser","provisionUser","findUserByEmail","AdminRoleRequiredError","AuthDependencyUnavailableError","EmailNotVerifiedError","InvalidCredentialsError","LastAdminOwnerError","SignupNotAllowedError","UserNotFoundError","issueJobLeaseToken","jobLeaseParamsFrom","verifyJobLeaseToken","issueRunnerSessionToken","verifyRunnerSessionToken","DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE","getAuthenticatedSessionContext","authCookiePlugin","clearRefreshTokenCookie","getRefreshTokenCookie","setRefreshTokenCookie","subscriber","createAuthModule","workspaces","signupPolicy","name","database","databaseNamespace","auth","loginMethods","AUTH_PASSWORD_ENABLED","routes","e2eRoutes","publishers","table","eventSchemas","subscribers","interModulePresentations"],"mappings":"AAAA,SACEA,kCAAkC,EAElCC,gBAAgB,QACX,wBAAwB;AAE/B,SAAQC,iBAAiB,QAAO,uBAAuB;AACvD,SAAQC,MAAM,QAAO,aAAa;AAElC,SAAQC,6BAA6B,QAAO,yBAAyB;AACrE,SAAQC,EAAE,QAAO,YAAY;AAC7B,SAAQC,cAAc,QAAO,oBAAoB;AACjD,SAAQC,UAAU,QAAO,uBAAuB;AAChD,SAAQC,mBAAmB,QAAO,iCAAiC;AACnE,SAAQC,0BAA0B,QAAO,yCAAyC;AAClF,SAAQC,6BAA6B,QAAO,4CAA4C;AACxF,SAAQC,mBAAmB,QAAO,mCAAmC;AACrE,SAAQC,iCAAiC,QAAO,gCAAgC;AAChF,SAAQC,eAAe,QAAO,gCAAgC;AAC9D,SAAQC,4BAA4B,QAAO,qCAAqC;AAChF,SAAQC,oBAAoB,QAAO,qBAAqB;AAGxD,SACEC,WAAW,EACXC,mBAAmB,EACnBC,mBAAmB,EACnBC,gBAAgB,EAChBC,gBAAgB,EAChBC,gBAAgB,QACX,sBAAsB;AAO7B,SAAQC,oBAAoB,EAAEC,aAAa,QAAO,gBAAgB;AAElE,SAAQC,eAAe,QAAO,uBAAuB;AAGrD,SACEC,sBAAsB,EACtBC,8BAA8B,EAC9BC,qBAAqB,EACrBC,uBAAuB,EACvBC,mBAAmB,EACnBC,qBAAqB,EACrBC,iBAAiB,QACZ,kBAAkB;AACzB,SACEC,kBAAkB,EAClBC,kBAAkB,EAClBC,mBAAmB,QACd,2BAA2B;AAElC,SACEC,uBAAuB,EACvBC,wBAAwB,QACnB,gCAAgC;AACvC,SACEhC,6BAA6B,EAC7BiC,kCAAkC,QAC7B,yBAAyB;AAChC,SAEE7B,mBAAmB,EACnB8B,8BAA8B,QAGzB,iCAAiC;AACxC,SAAQ7B,0BAA0B,QAAO,yCAAyC;AAClF,SACE8B,gBAAgB,EAChBC,uBAAuB,EACvBC,qBAAqB,EACrBC,qBAAqB,QAChB,uCAAuC;AAC9C,SAAQhC,6BAA6B,QAAO,4CAA4C;AAExF,MAAMiC,aAAazC;AAOnB,OAAO,SAAS0C,iBAAiB,EAC/BC,UAAU,EACVC,eAAe1C,+BAA+B,EACtB;IACxB,OAAO;QACL2C,MAAM;QACNC,UAAU;YAAC3C;YAAIC;YAAgB2C,mBAAmB;QAAM;QACxDC,MAAM;YAAC1C;YAAuBC;YAA8BC;SAAgC;QAC5FyC,cAAcpC,qBAAqBZ,OAAOiD,qBAAqB;QAC/DC,QAAQ;YAACxC,gBAAgBV,OAAOiD,qBAAqB,EAAEP,YAAYC;SAAc;QACjFQ,WAAW;YAAC3C,oBAAoBkC;SAAY;QAC5CU,YAAY;YAAC;gBAACR,MAAM;gBAAQS,OAAOjD;gBAAYF;gBAAIoD,cAAcxD;YAAgB;SAAE;QACnFyD,aAAa;YAACf,WAAW3C,oCAAoCc;SAA8B;QAC3F6C,0BAA0B;YAAC/C;SAAoC;IACjE;AACF"}

package/dist/presentation/dto/user.d.ts

@@ -1,8 +1,9 @@
-import type { LoginResponseDto, UserDto } from '@shipfox/api-auth-dto';
+import type { AdminRole, LoginResponseDto, UserDto } from '@shipfox/api-auth-dto';
 import type { User } from '#core/entities/user.js';
 export declare function toUserDto(user: User): UserDto;
 export declare function toAuthSessionDto(result: {
     token: string;
     user: User;
+    adminRole?: AdminRole | null;
 }): LoginResponseDto;
 //# sourceMappingURL=user.d.ts.map

package/dist/presentation/dto/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../src/presentation/dto/user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,gBAAgB,EAAE,OAAO,EAAC,MAAM,uBAAuB,CAAC;AACrE,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAEjD,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAU7C;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAC,GAAG,gBAAgB,CAKtF"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../src/presentation/dto/user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAE,gBAAgB,EAAE,OAAO,EAAC,MAAM,uBAAuB,CAAC;AAChF,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAEjD,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAU7C;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;CAC9B,GAAG,gBAAgB,CAMnB"}

package/dist/presentation/dto/user.js

@@ -12,7 +12,8 @@ export function toUserDto(user) {
 export function toAuthSessionDto(result) {
     return {
         token: result.token,
-        user: toUserDto(result.user)
+        user: toUserDto(result.user),
+        admin_role: result.adminRole ?? null
     };
 }
 

package/dist/presentation/dto/user.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/dto/user.ts"],"sourcesContent":["import type {LoginResponseDto, UserDto} from '@shipfox/api-auth-dto';\nimport type {User} from '#core/entities/user.js';\n\nexport function toUserDto(user: User): UserDto {\n  return {\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    email_verified_at: user.emailVerifiedAt ? user.emailVerifiedAt.toISOString() : null,\n    status: user.status,\n    created_at: user.createdAt.toISOString(),\n    updated_at: user.updatedAt.toISOString(),\n  };\n}\n\nexport function toAuthSessionDto(result: {token: string; user: User}): LoginResponseDto {\n  return {\n    token: result.token,\n    user: toUserDto(result.user),\n  };\n}\n"],"names":["toUserDto","user","id","email","name","email_verified_at","emailVerifiedAt","toISOString","status","created_at","createdAt","updated_at","updatedAt","toAuthSessionDto","result","token"],"mappings":"AAGA,OAAO,SAASA,UAAUC,IAAU;IAClC,OAAO;QACLC,IAAID,KAAKC,EAAE;QACXC,OAAOF,KAAKE,KAAK;QACjBC,MAAMH,KAAKG,IAAI;QACfC,mBAAmBJ,KAAKK,eAAe,GAAGL,KAAKK,eAAe,CAACC,WAAW,KAAK;QAC/EC,QAAQP,KAAKO,MAAM;QACnBC,YAAYR,KAAKS,SAAS,CAACH,WAAW;QACtCI,YAAYV,KAAKW,SAAS,CAACL,WAAW;IACxC;AACF;AAEA,OAAO,SAASM,iBAAiBC,MAAmC;IAClE,OAAO;QACLC,OAAOD,OAAOC,KAAK;QACnBd,MAAMD,UAAUc,OAAOb,IAAI;IAC7B;AACF"}
+{"version":3,"sources":["../../../src/presentation/dto/user.ts"],"sourcesContent":["import type {AdminRole, LoginResponseDto, UserDto} from '@shipfox/api-auth-dto';\nimport type {User} from '#core/entities/user.js';\n\nexport function toUserDto(user: User): UserDto {\n  return {\n    id: user.id,\n    email: user.email,\n    name: user.name,\n    email_verified_at: user.emailVerifiedAt ? user.emailVerifiedAt.toISOString() : null,\n    status: user.status,\n    created_at: user.createdAt.toISOString(),\n    updated_at: user.updatedAt.toISOString(),\n  };\n}\n\nexport function toAuthSessionDto(result: {\n  token: string;\n  user: User;\n  adminRole?: AdminRole | null;\n}): LoginResponseDto {\n  return {\n    token: result.token,\n    user: toUserDto(result.user),\n    admin_role: result.adminRole ?? null,\n  };\n}\n"],"names":["toUserDto","user","id","email","name","email_verified_at","emailVerifiedAt","toISOString","status","created_at","createdAt","updated_at","updatedAt","toAuthSessionDto","result","token","admin_role","adminRole"],"mappings":"AAGA,OAAO,SAASA,UAAUC,IAAU;IAClC,OAAO;QACLC,IAAID,KAAKC,EAAE;QACXC,OAAOF,KAAKE,KAAK;QACjBC,MAAMH,KAAKG,IAAI;QACfC,mBAAmBJ,KAAKK,eAAe,GAAGL,KAAKK,eAAe,CAACC,WAAW,KAAK;QAC/EC,QAAQP,KAAKO,MAAM;QACnBC,YAAYR,KAAKS,SAAS,CAACH,WAAW;QACtCI,YAAYV,KAAKW,SAAS,CAACL,WAAW;IACxC;AACF;AAEA,OAAO,SAASM,iBAAiBC,MAIhC;IACC,OAAO;QACLC,OAAOD,OAAOC,KAAK;QACnBd,MAAMD,UAAUc,OAAOb,IAAI;QAC3Be,YAAYF,OAAOG,SAAS,IAAI;IAClC;AACF"}

package/dist/presentation/inter-module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inter-module.d.ts","sourceRoot":"","sources":["../../src/presentation/inter-module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,uBAAuB,EAAC,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAgC,KAAK,uBAAuB,EAAC,MAAM,uBAAuB,CAAC;AAIlG,wBAAgB,iCAAiC,IAAI,uBAAuB,CAC1E,OAAO,uBAAuB,CAC/B,CAKA"}
+{"version":3,"file":"inter-module.d.ts","sourceRoot":"","sources":["../../src/presentation/inter-module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,uBAAuB,EAAC,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAGL,KAAK,uBAAuB,EAC7B,MAAM,uBAAuB,CAAC;AAM/B,wBAAgB,iCAAiC,IAAI,uBAAuB,CAC1E,OAAO,uBAAuB,CAC/B,CAoBA"}

package/dist/presentation/inter-module.js

@@ -1,5 +1,7 @@
 import { authInterModuleContract } from '@shipfox/api-auth-dto/inter-module';
-import { defineInterModulePresentation } from '@shipfox/inter-module';
+import { createInterModuleKnownError, defineInterModulePresentation } from '@shipfox/inter-module';
+import { getCurrentAdminRole, requireAdminRole } from '#core/admin-role.js';
+import { AdminRoleRequiredError } from '#core/errors.js';
 import { issueJobLeaseToken } from '#core/job-lease-token.js';
 import { issueRunnerSessionToken } from '#core/runner-session-token.js';
 export function createAuthInterModulePresentation() {
@@ -9,7 +11,29 @@ export function createAuthInterModulePresentation() {
             }),
         mintJobLeaseToken: async (claims)=>({
                 token: await issueJobLeaseToken(claims)
-            })
+            }),
+        getCurrentAdminRole: async ({ userId })=>({
+                role: await getCurrentAdminRole({
+                    userId
+                })
+            }),
+        requireAdminRole: async ({ userId, minimumRole })=>{
+            try {
+                return {
+                    role: await requireAdminRole({
+                        userId,
+                        minimumRole
+                    })
+                };
+            } catch (error) {
+                if (error instanceof AdminRoleRequiredError) {
+                    throw createInterModuleKnownError(authInterModuleContract.methods.requireAdminRole, 'admin-role-required', {
+                        requiredRole: error.minimumRole
+                    });
+                }
+                throw error;
+            }
+        }
     });
 }