@stndrds/schema 1.0.0-alpha.71 → 1.0.0-alpha.73

package/dist/chunk-6P3NPTYV.mjs

@@ -0,0 +1,58 @@
+// src/constants/default-roles.ts
+var SYSTEM_RESOURCES = {
+  /** User profiles, invitations, roles and permissions management */
+  PEOPLE: "people",
+  /** Object definitions, attributes, tenant settings and audit logs */
+  WORKSPACE: "workspace"
+};
+var ALL_SYSTEM_RESOURCES = [
+  SYSTEM_RESOURCES.PEOPLE,
+  SYSTEM_RESOURCES.WORKSPACE
+];
+var SYSTEM_RESOURCE_LABELS = {
+  people: "People",
+  workspace: "Workspace"
+};
+var DEFAULT_ROLES = {
+  /** Full platform access - can manage everything */
+  OWNER: "owner",
+  /** Standard user - can work with business data and view people */
+  MEMBER: "member"
+};
+var DEFAULT_ROLE_LABELS = {
+  owner: "Owner",
+  member: "Member"
+};
+var DEFAULT_ROLE_DESCRIPTIONS = {
+  owner: "Full access to all platform features and data",
+  member: "Can view, create, edit and delete business data"
+};
+var ALL_ACTIONS = ["read", "create", "update", "delete"];
+var DEFAULT_ROLE_PERMISSIONS = {
+  owner: {
+    system: [{ target: "*", actions: ALL_ACTIONS }],
+    object: [{ target: "*", actions: ALL_ACTIONS }]
+  },
+  member: {
+    system: [{ target: "people", actions: ["read"] }],
+    object: [{ target: "*", actions: ALL_ACTIONS }]
+  }
+};
+function isDefaultRole(roleName) {
+  return Object.values(DEFAULT_ROLES).includes(roleName);
+}
+function isAdminRole(roleName) {
+  return roleName === DEFAULT_ROLES.OWNER;
+}
+
+export {
+  SYSTEM_RESOURCES,
+  ALL_SYSTEM_RESOURCES,
+  SYSTEM_RESOURCE_LABELS,
+  DEFAULT_ROLES,
+  DEFAULT_ROLE_LABELS,
+  DEFAULT_ROLE_DESCRIPTIONS,
+  DEFAULT_ROLE_PERMISSIONS,
+  isDefaultRole,
+  isAdminRole
+};

package/dist/{chunk-INXFKM4S.mjs → chunk-ABOLTRIR.mjs}

@@ -13,6 +13,9 @@ import {
   validateObject,
   validateObjectOrThrow
 } from "./chunk-5SZ5OISG.mjs";
+import {
+  isAdminRole
+} from "./chunk-6P3NPTYV.mjs";
 import {
   __require
 } from "./chunk-Y6FXYEAI.mjs";
@@ -3700,13 +3703,24 @@ function parsePipeExpression(pipeExpr) {
 }
 function renderLabelExpression(template, values, fallback = DEFAULT_LABEL_FALLBACK) {
   const result = template.replace(/\{\{\s*([^}]+)\s*\}\}/g, (_, expr) => {
-    const parts = expr.split("|").map((s) => s.trim());
-    const path = parts[0];
-    let value = getValue(values, path);
+    const orParts = expr.split("||").map((s) => s.trim());
+    const lastPart = orParts[orParts.length - 1];
+    const pipeSplit = lastPart.split("|").map((s) => s.trim());
+    orParts[orParts.length - 1] = pipeSplit[0];
+    const pipes = pipeSplit.slice(1).filter(Boolean);
+    const alternatives = orParts.filter(Boolean);
+    let value = "";
+    for (const alt of alternatives) {
+      const v = getValue(values, alt);
+      if (v != null && v !== "") {
+        value = v;
+        break;
+      }
+    }
     const isEmpty3 = value == null || value === "";
-    if (isEmpty3 && parts.length === 1) return "";
-    for (let i = 1; i < parts.length; i++) {
-      const { name: pipeName, args } = parsePipeExpression(parts[i]);
+    if (isEmpty3 && pipes.length === 0) return "";
+    for (const pipeExpr of pipes) {
+      const { name: pipeName, args } = parsePipeExpression(pipeExpr);
       const simpleFn = simplePipes[pipeName];
       if (simpleFn) {
         if (value != null && value !== "") {
@@ -3728,13 +3742,19 @@ function isLabelExpression(value) {
 }
 function extractAttributeNames(template) {
   const names = [];
-  const regex = /\{\{\s*([^|}]+)/g;
+  const regex = /\{\{\s*([^}]+)\s*\}\}/g;
   let match;
   while ((match = regex.exec(template)) !== null) {
-    const path = match[1].trim();
-    const rootName = path.split(".")[0];
-    if (rootName && !names.includes(rootName)) {
-      names.push(rootName);
+    const expr = match[1].trim();
+    const orParts = expr.split("||").map((s) => s.trim());
+    const lastPart = orParts[orParts.length - 1];
+    orParts[orParts.length - 1] = lastPart.split("|")[0].trim();
+    for (const part of orParts) {
+      if (!part) continue;
+      const rootName = part.split(".")[0];
+      if (rootName && !names.includes(rootName)) {
+        names.push(rootName);
+      }
     }
   }
   return names;
@@ -4303,7 +4323,6 @@ function createMockUserProfilesRepository(stores) {
         firstName: data.firstName,
         lastName: data.lastName,
         avatarUrl: data.avatarUrl,
-        role: data.role ?? "member",
         status: data.status ?? "active",
         createdAt: /* @__PURE__ */ new Date(),
         updatedAt: /* @__PURE__ */ new Date()
@@ -4336,12 +4355,23 @@ function createMockUserProfilesRepository(stores) {
       }
       return Promise.resolve(results);
     },
-    countByRole(role) {
+    getUsersWithRoles(filters) {
       const tenantId = getTenantId();
-      const count = Array.from(stores.userProfiles.values()).filter(
-        (profile) => profile.tenantId === tenantId && profile.role === role
-      ).length;
-      return Promise.resolve(count);
+      const profiles = Array.from(stores.userProfiles.values()).filter(
+        (p) => p.tenantId === tenantId
+      );
+      const results = [];
+      for (const profile of profiles) {
+        const roleIds = Array.from(stores.userRoles.values()).filter((ur) => ur.userProfileId === profile.id && ur.tenantId === tenantId).map((ur) => ur.roleId);
+        const roles = Array.from(stores.roles.values()).filter((r) => roleIds.includes(r.id));
+        if (filters?.allowedRoles && filters.allowedRoles.length > 0) {
+          const allowed = filters.allowedRoles;
+          const hasMatchingRole = roles.some((r) => allowed.includes(r.name));
+          if (!hasMatchingRole) continue;
+        }
+        results.push({ ...profile, roles });
+      }
+      return Promise.resolve(results);
     },
     updateLastLogin(id) {
       const profile = stores.userProfiles.get(id);
@@ -4360,7 +4390,6 @@ function createMockUserProfilesRepository(stores) {
         email: data.email,
         firstName: data.firstName,
         lastName: data.lastName,
-        role: data.role ?? "member",
         status: "pending",
         createdAt: /* @__PURE__ */ new Date(),
         updatedAt: /* @__PURE__ */ new Date()
@@ -4452,7 +4481,6 @@ function createMockPermissionsRepository(stores) {
           scope: input.scope,
           target: input.target,
           actions: input.actions,
-          filter: input.filter,
           createdAt: /* @__PURE__ */ new Date()
         };
         stores.permissions.set(perm.id, perm);
@@ -4497,7 +4525,7 @@ function createMockPermissionsRepository(stores) {
       const tenantId = getTenantId();
       const userRoleIds = Array.from(stores.userRoles.values()).filter((ur) => ur.userProfileId === userProfileId && ur.tenantId === tenantId).map((ur) => ur.roleId);
       const userRoles = Array.from(stores.roles.values()).filter((r) => userRoleIds.includes(r.id));
-      const isAdmin = userRoles.some((r) => r.name === "admin");
+      const hasAdmin = userRoles.some((r) => isAdminRole(r.name));
       const userPermissions = Array.from(stores.permissions.values()).filter(
         (p) => userRoleIds.includes(p.roleId)
       );
@@ -4524,7 +4552,18 @@ function createMockPermissionsRepository(stores) {
           }
         }
       }
-      return Promise.resolve({ isAdmin, objectPermissions, systemPermissions });
+      return Promise.resolve({ isAdmin: hasAdmin, objectPermissions, systemPermissions });
+    },
+    countUsersWithRole(roleName) {
+      const tenantId = getTenantId();
+      const role = Array.from(stores.roles.values()).find(
+        (r) => r.tenantId === tenantId && r.name === roleName
+      );
+      if (!role) return Promise.resolve(0);
+      const userIds = new Set(
+        Array.from(stores.userRoles.values()).filter((ur) => ur.roleId === role.id && ur.tenantId === tenantId).map((ur) => ur.userProfileId)
+      );
+      return Promise.resolve(userIds.size);
     }
   };
 }
@@ -10072,6 +10111,21 @@ var UserService = class extends BaseService {
     }
     const users = await this.adapter.userProfiles.findByIds([...allIds]);
     const userMap = new Map(users.map((u) => [u.id, u]));
+    const allAllowedRoles = /* @__PURE__ */ new Set();
+    for (const [, { attr }] of attrIdMap) {
+      if (attr.allowedRoles && attr.allowedRoles.length > 0) {
+        for (const role of attr.allowedRoles) {
+          allAllowedRoles.add(role);
+        }
+      }
+    }
+    let userRolesMap;
+    if (allAllowedRoles.size > 0) {
+      const usersWithRoles = await this.adapter.userProfiles.getUsersWithRoles({
+        allowedRoles: [...allAllowedRoles]
+      });
+      userRolesMap = new Map(usersWithRoles.map((u) => [u.id, u.roles.map((r) => r.name)]));
+    }
     for (const [attrName, { attr, ids }] of attrIdMap) {
       const invalidIds = [];
       const roleErrors = [];
@@ -10085,8 +10139,10 @@ var UserService = class extends BaseService {
           invalidIds.push(id);
           continue;
         }
-        if (attr.allowedRoles && attr.allowedRoles.length > 0) {
-          if (!attr.allowedRoles.includes(user2.role)) {
+        if (attr.allowedRoles && attr.allowedRoles.length > 0 && userRolesMap) {
+          const userRoleNames = userRolesMap.get(id) ?? [];
+          const hasAllowedRole = attr.allowedRoles.some((role) => userRoleNames.includes(role));
+          if (!hasAllowedRole) {
             roleErrors.push(id);
           }
         }
@@ -14877,7 +14933,6 @@ var UserProfileService = class extends BaseService {
    *   email: authUser.email,
    *   firstName: authUser.user_metadata.first_name,
    *   lastName: authUser.user_metadata.last_name,
-   *   role: "member",
    *   status: "active"
    * });
    * ```
@@ -14956,7 +15011,6 @@ var UserProfileService = class extends BaseService {
    *   {
    *     authId: authUser.id,
    *     email: authUser.email,
-   *     role: "member",
    *     status: "active"
    *   }
    * );
@@ -14981,7 +15035,6 @@ var UserProfileService = class extends BaseService {
       const changes = buildAuditChanges(existing, data, [
         "firstName",
         "lastName",
-        "role",
         "status"
       ]);
       if (changes.length > 0) {
@@ -15005,11 +15058,13 @@ var UserProfileService = class extends BaseService {
    */
   async deleteProfile(profileId, options) {
     const profile = await this.getProfileOrThrow(profileId);
-    if (options?.checkAdmin) {
-      if (profile.role === "admin") {
-        const adminCount = await this.adapter.userProfiles.countByRole("admin");
-        if (adminCount <= 1) {
-          throw new Error("Cannot delete the last admin user");
+    if (options?.checkAdmin && this.adapter.permissions) {
+      const ownerCount = await this.adapter.permissions.countUsersWithRole("owner");
+      if (ownerCount <= 1) {
+        const userRoles = await this.adapter.permissions.getUserRoles(profileId);
+        const isOwner = userRoles.some((r) => r.name === "owner");
+        if (isOwner) {
+          throw new Error("Cannot delete the last owner user");
         }
       }
     }
@@ -15045,15 +15100,6 @@ var UserProfileService = class extends BaseService {
   async updateLastLogin(profileId) {
     await this.adapter.userProfiles.updateLastLogin(profileId);
   }
-  /**
-   * Change user role
-   *
-   * @param profileId - Profile UUID
-   * @param newRole - New role
-   */
-  async changeRole(profileId, newRole) {
-    return await this.updateProfile(profileId, { role: newRole });
-  }
   /**
    * Change user status
    *
@@ -15075,19 +15121,6 @@ var UserProfileService = class extends BaseService {
       () => this.adapter.userProfiles.findByEmail(email)
     );
   }
-  /**
-   * Check if user has role
-   */
-  async hasRole(profileId, role) {
-    const profile = await this.getProfile(profileId);
-    return profile?.role === role;
-  }
-  /**
-   * Check if user is admin
-   */
-  async isAdmin(profileId) {
-    return await this.hasRole(profileId, "admin");
-  }
   /**
    * Invite a new user by email.
    *
@@ -15108,7 +15141,6 @@ var UserProfileService = class extends BaseService {
    *   email: "john@example.com",
    *   firstName: "John",
    *   lastName: "Doe",
-   *   role: "member",
    *   redirectTo: "https://app.example.com/welcome",
    * });
    * // Email sent automatically, profile.status === "pending"
@@ -17348,7 +17380,7 @@ var PermissionService = class extends BaseService {
       DEFAULT_ROLE_LABELS,
       DEFAULT_ROLE_DESCRIPTIONS,
       DEFAULT_ROLE_PERMISSIONS
-    } = await import("./default-roles-42X3TJI5.mjs");
+    } = await import("./default-roles-OAMHLOCS.mjs");
     const existingRoles = await this.getRoles();
     const existingRoleNames = existingRoles.reduce((set, r) => set.add(r.name), /* @__PURE__ */ new Set());
     for (const roleName of Object.values(DEFAULT_ROLES)) {