@tailor-platform/erp-kit 0.1.1 → 0.2.0

package/src/modules/user-management/command/deactivateUser.ts

@@ -1,7 +1,6 @@
-import { defineCommand } from "../../shared/internal";
+import { ok, err, type CommandContext } from "../../shared/internal";
 import { DB } from "../generated/kysely-tailordb";
-import { InvalidStatusTransitionError, UserNotFoundError } from "../lib/errors";
-import { permissions } from "../permissions";
+import { InvalidStatusTransitionError, UserNotFoundError } from "../lib/errors.generated";
 
 export interface DeactivateUserInput {
   userId: string;
@@ -15,53 +14,46 @@ export interface DeactivateUserInput {
  * Transitions a user from ACTIVE to INACTIVE status.
  * Role assignments are preserved for audit purposes.
  */
-export const deactivateUser = defineCommand(
-  permissions.deactivateUser,
-  async (db: DB, input: DeactivateUserInput) => {
-    // 1. Find user by ID
-    const user = await db
-      .selectFrom("User")
-      .selectAll()
-      .where("id", "=", input.userId)
-      .executeTakeFirst();
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+export async function run(db: DB, input: DeactivateUserInput, _ctx: CommandContext) {
+  const user = await db
+    .selectFrom("User")
+    .selectAll()
+    .where("id", "=", input.userId)
+    .executeTakeFirst();
 
-    // 2. If not found, throw error
-    if (!user) {
-      throw new UserNotFoundError(input.userId);
-    }
+  if (!user) {
+    return err(new UserNotFoundError(input.userId));
+  }
 
-    // 3. Validate status transition
-    const validFromStatuses = input.from ?? ["ACTIVE"];
-    if (!validFromStatuses.includes(user.status)) {
-      throw new InvalidStatusTransitionError(user.status, "INACTIVE");
-    }
+  const validFromStatuses = input.from ?? ["ACTIVE"];
+  if (!validFromStatuses.includes(user.status)) {
+    return err(new InvalidStatusTransitionError(`${user.status} to INACTIVE`));
+  }
 
-    // 4. Update status to INACTIVE
-    const updatedUser = await db
-      .updateTable("User")
-      .set({
-        status: "INACTIVE",
-        updatedAt: new Date(),
-      })
-      .where("id", "=", input.userId)
-      .returningAll()
-      .executeTakeFirst();
+  const updatedUser = await db
+    .updateTable("User")
+    .set({
+      status: "INACTIVE",
+      updatedAt: new Date(),
+    })
+    .where("id", "=", input.userId)
+    .returningAll()
+    .executeTakeFirst();
 
-    // 5. Log USER_DEACTIVATED audit event
-    const auditEvent = await db
-      .insertInto("AuditEvent")
-      .values({
-        eventType: "USER_DEACTIVATED",
-        actorId: input.actorId,
-        targetId: input.userId,
-        targetType: "User",
-        payload: JSON.stringify({ previousStatus: user.status }),
-        createdAt: new Date(),
-        updatedAt: null,
-      })
-      .returningAll()
-      .executeTakeFirst();
+  const auditEvent = await db
+    .insertInto("AuditEvent")
+    .values({
+      eventType: "USER_DEACTIVATED",
+      actorId: input.actorId,
+      targetId: input.userId,
+      targetType: "User",
+      payload: JSON.stringify({ previousStatus: user.status }),
+      createdAt: new Date(),
+      updatedAt: null,
+    })
+    .returningAll()
+    .executeTakeFirst();
 
-    return { user: updatedUser!, auditEvent: auditEvent! };
-  },
-);
+  return ok({ user: updatedUser!, auditEvent: auditEvent! });
+}

package/src/modules/user-management/command/logAuditEvent.generated.ts

@@ -0,0 +1,6 @@
+// @generated — do not edit
+import { defineCommand } from "../../shared/internal";
+import { permissions } from "../lib/permissions.generated";
+import { run } from "./logAuditEvent";
+
+export const logAuditEvent = defineCommand(permissions.logAuditEvent, run);

package/src/modules/user-management/command/logAuditEvent.test.ts

@@ -1,10 +1,10 @@
 import { describe, expect, it } from "vitest";
-import { InsufficientPermissionError, type CommandContext } from "../../shared/internal";
+import { type CommandContext } from "../../shared/internal";
 import { createMockDb } from "../../testing/index";
 import { DB } from "../generated/kysely-tailordb";
-import { InvalidEventTypeError, MissingRequiredFieldError } from "../lib/errors";
+import { InvalidEventTypeError, MissingRequiredFieldError } from "../lib/errors.generated";
 import { baseAuditEvent } from "../testing/fixtures";
-import { logAuditEvent } from "./logAuditEvent";
+import { run } from "./logAuditEvent";
 
 describe("logAuditEvent", () => {
   const ctx: CommandContext = {
@@ -15,31 +15,35 @@ describe("logAuditEvent", () => {
   it("throws when actorId is empty", async () => {
     const { db } = createMockDb<DB>();
 
-    await expect(
-      logAuditEvent(
-        db,
-        {
-          eventType: "USER_CREATED",
-          actorId: "",
-        },
-        ctx,
-      ),
-    ).rejects.toBeInstanceOf(MissingRequiredFieldError);
+    const result = await run(
+      db,
+      {
+        eventType: "USER_CREATED",
+        actorId: "",
+      },
+      ctx,
+    );
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(MissingRequiredFieldError);
+    }
   });
 
   it("throws when eventType is invalid", async () => {
     const { db } = createMockDb<DB>();
 
-    await expect(
-      logAuditEvent(
-        db,
-        {
-          eventType: "INVALID_EVENT" as "USER_CREATED",
-          actorId: "user-1",
-        },
-        ctx,
-      ),
-    ).rejects.toBeInstanceOf(InvalidEventTypeError);
+    const result = await run(
+      db,
+      {
+        eventType: "INVALID_EVENT" as "USER_CREATED",
+        actorId: "user-1",
+      },
+      ctx,
+    );
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(InvalidEventTypeError);
+    }
   });
 
   it("creates audit event with minimal fields", async () => {
@@ -56,7 +60,7 @@ describe("logAuditEvent", () => {
 
     spies.insert.mockReturnValue(createdEvent);
 
-    const result = await logAuditEvent(
+    const result = await run(
       db,
       {
         eventType: "USER_CREATED",
@@ -65,8 +69,11 @@ describe("logAuditEvent", () => {
       ctx,
     );
 
-    expect(result.auditEvent.eventType).toBe("USER_CREATED");
-    expect(result.auditEvent.actorId).toBe("user-1");
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.auditEvent.eventType).toBe("USER_CREATED");
+      expect(result.value.auditEvent.actorId).toBe("user-1");
+    }
     expect(spies.insert).toHaveBeenCalled();
   });
 
@@ -84,7 +91,7 @@ describe("logAuditEvent", () => {
 
     spies.insert.mockReturnValue(createdEvent);
 
-    const result = await logAuditEvent(
+    const result = await run(
       db,
       {
         eventType: "ROLE_ASSIGNED",
@@ -95,9 +102,12 @@ describe("logAuditEvent", () => {
       ctx,
     );
 
-    expect(result.auditEvent.eventType).toBe("ROLE_ASSIGNED");
-    expect(result.auditEvent.targetId).toBe("user-2");
-    expect(result.auditEvent.targetType).toBe("User");
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.auditEvent.eventType).toBe("ROLE_ASSIGNED");
+      expect(result.value.auditEvent.targetId).toBe("user-2");
+      expect(result.value.auditEvent.targetType).toBe("User");
+    }
   });
 
   it("creates audit event with payload", async () => {
@@ -115,7 +125,7 @@ describe("logAuditEvent", () => {
 
     spies.insert.mockReturnValue(createdEvent);
 
-    const result = await logAuditEvent(
+    const result = await run(
       db,
       {
         eventType: "ROLE_ASSIGNED",
@@ -127,7 +137,10 @@ describe("logAuditEvent", () => {
       ctx,
     );
 
-    expect(result.auditEvent.payload).toBe(payload);
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.auditEvent.payload).toBe(payload);
+    }
   });
 
   it("creates audit event for each valid event type", async () => {
@@ -156,7 +169,7 @@ describe("logAuditEvent", () => {
 
       spies.insert.mockReturnValue(createdEvent);
 
-      const result = await logAuditEvent(
+      const result = await run(
         db,
         {
           eventType,
@@ -165,15 +178,10 @@ describe("logAuditEvent", () => {
         ctx,
       );
 
-      expect(result.auditEvent.eventType).toBe(eventType);
+      expect(result.ok).toBe(true);
+      if (result.ok) {
+        expect(result.value.auditEvent.eventType).toBe(eventType);
+      }
     }
   });
-
-  it("throws when permission is missing", async () => {
-    const { db } = createMockDb<DB>();
-    const denied: CommandContext = { actorId: "test-actor", permissions: [] };
-    await expect(
-      logAuditEvent(db, { eventType: "USER_CREATED", actorId: "user-1" }, denied),
-    ).rejects.toBeInstanceOf(InsufficientPermissionError);
-  });
 });

package/src/modules/user-management/command/logAuditEvent.ts

@@ -1,8 +1,7 @@
-import { defineCommand } from "../../shared/internal";
+import { ok, err, type CommandContext } from "../../shared/internal";
 import { DB } from "../generated/kysely-tailordb";
 import { AuditEventEventType } from "../generated/enums";
-import { InvalidEventTypeError, MissingRequiredFieldError } from "../lib/errors";
-import { permissions } from "../permissions";
+import { InvalidEventTypeError, MissingRequiredFieldError } from "../lib/errors.generated";
 
 export interface LogAuditEventInput {
   eventType: AuditEventEventType;
@@ -29,31 +28,29 @@ const VALID_EVENT_TYPES = new Set<string>([
  * Creates an immutable audit record of a security-relevant event.
  * Records are created with timestamp and cannot be modified or deleted.
  */
-export const logAuditEvent = defineCommand(
-  permissions.logAuditEvent,
-  async (db: DB, input: LogAuditEventInput) => {
-    if (!input.actorId || input.actorId.trim() === "") {
-      throw new MissingRequiredFieldError("actorId");
-    }
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+export async function run(db: DB, input: LogAuditEventInput, _ctx: CommandContext) {
+  if (!input.actorId || input.actorId.trim() === "") {
+    return err(new MissingRequiredFieldError("actorId"));
+  }
 
-    if (!VALID_EVENT_TYPES.has(input.eventType)) {
-      throw new InvalidEventTypeError(input.eventType);
-    }
+  if (!VALID_EVENT_TYPES.has(input.eventType)) {
+    return err(new InvalidEventTypeError(input.eventType));
+  }
 
-    const auditEvent = await db
-      .insertInto("AuditEvent")
-      .values({
-        eventType: input.eventType,
-        actorId: input.actorId,
-        targetId: input.targetId ?? null,
-        targetType: input.targetType ?? null,
-        payload: input.payload ?? null,
-        createdAt: new Date(),
-        updatedAt: null,
-      })
-      .returningAll()
-      .executeTakeFirst();
+  const auditEvent = await db
+    .insertInto("AuditEvent")
+    .values({
+      eventType: input.eventType,
+      actorId: input.actorId,
+      targetId: input.targetId ?? null,
+      targetType: input.targetType ?? null,
+      payload: input.payload ?? null,
+      createdAt: new Date(),
+      updatedAt: null,
+    })
+    .returningAll()
+    .executeTakeFirst();
 
-    return { auditEvent: auditEvent! };
-  },
-);
+  return ok({ auditEvent: auditEvent! });
+}

package/src/modules/user-management/command/reactivateUser.generated.ts

@@ -0,0 +1,6 @@
+// @generated — do not edit
+import { defineCommand } from "../../shared/internal";
+import { permissions } from "../lib/permissions.generated";
+import { run } from "./reactivateUser";
+
+export const reactivateUser = defineCommand(permissions.reactivateUser, run);

package/src/modules/user-management/command/reactivateUser.test.ts

@@ -1,10 +1,10 @@
 import { describe, expect, it } from "vitest";
-import { InsufficientPermissionError, type CommandContext } from "../../shared/internal";
+import { type CommandContext } from "../../shared/internal";
 import { createMockDb } from "../../testing/index";
 import { DB } from "../generated/kysely-tailordb";
-import { InvalidStatusTransitionError, UserNotFoundError } from "../lib/errors";
+import { InvalidStatusTransitionError, UserNotFoundError } from "../lib/errors.generated";
 import { activeUser, baseAuditEvent, inactiveUser, pendingUser } from "../testing/fixtures";
-import { reactivateUser } from "./reactivateUser";
+import { run } from "./reactivateUser";
 
 describe("reactivateUser", () => {
   const ctx: CommandContext = {
@@ -17,27 +17,33 @@ describe("reactivateUser", () => {
     const { db, spies } = createMockDb<DB>();
     spies.select.mockReturnValue(undefined);
 
-    await expect(
-      reactivateUser(db, { userId: "nonexistent-user", actorId: "actor-1" }, ctx),
-    ).rejects.toBeInstanceOf(UserNotFoundError);
+    const result = await run(db, { userId: "nonexistent-user", actorId: "actor-1" }, ctx);
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(UserNotFoundError);
+    }
   });
 
   it("throws when user is PENDING", async () => {
     const { db, spies } = createMockDb<DB>();
     spies.select.mockReturnValue(pendingUser);
 
-    await expect(
-      reactivateUser(db, { userId: pendingUser.id, actorId: "actor-1" }, ctx),
-    ).rejects.toBeInstanceOf(InvalidStatusTransitionError);
+    const result = await run(db, { userId: pendingUser.id, actorId: "actor-1" }, ctx);
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(InvalidStatusTransitionError);
+    }
   });
 
   it("throws when user is already ACTIVE", async () => {
     const { db, spies } = createMockDb<DB>();
     spies.select.mockReturnValue(activeUser);
 
-    await expect(
-      reactivateUser(db, { userId: activeUser.id, actorId: "actor-1" }, ctx),
-    ).rejects.toBeInstanceOf(InvalidStatusTransitionError);
+    const result = await run(db, { userId: activeUser.id, actorId: "actor-1" }, ctx);
+    expect(result.ok).toBe(false);
+    if (!result.ok) {
+      expect(result.error).toBeInstanceOf(InvalidStatusTransitionError);
+    }
   });
 
   // Success cases
@@ -59,7 +65,7 @@ describe("reactivateUser", () => {
     spies.update.mockReturnValue(reactivatedUser);
     spies.insert.mockReturnValue(createdAuditEvent);
 
-    const result = await reactivateUser(
+    const result = await run(
       db,
       {
         userId: inactiveUser.id,
@@ -68,8 +74,11 @@ describe("reactivateUser", () => {
       ctx,
     );
 
-    expect(result.user.status).toBe("ACTIVE");
-    expect(result.user.updatedAt).not.toBeNull();
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.user.status).toBe("ACTIVE");
+      expect(result.value.user.updatedAt).not.toBeNull();
+    }
     expect(spies.update).toHaveBeenCalled();
   });
 
@@ -91,7 +100,7 @@ describe("reactivateUser", () => {
     spies.update.mockReturnValue(reactivatedUser);
     spies.insert.mockReturnValue(createdAuditEvent);
 
-    const result = await reactivateUser(
+    const result = await run(
       db,
       {
         userId: inactiveUser.id,
@@ -100,16 +109,11 @@ describe("reactivateUser", () => {
       ctx,
     );
 
-    expect(result.auditEvent.eventType).toBe("USER_REACTIVATED");
-    expect(result.auditEvent.actorId).toBe("actor-1");
-    expect(result.auditEvent.targetId).toBe(inactiveUser.id);
-  });
-
-  it("throws when permission is missing", async () => {
-    const { db } = createMockDb<DB>();
-    const denied: CommandContext = { actorId: "test-actor", permissions: [] };
-    await expect(
-      reactivateUser(db, { userId: "some-user", actorId: "actor-1" }, denied),
-    ).rejects.toBeInstanceOf(InsufficientPermissionError);
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.value.auditEvent.eventType).toBe("USER_REACTIVATED");
+      expect(result.value.auditEvent.actorId).toBe("actor-1");
+      expect(result.value.auditEvent.targetId).toBe(inactiveUser.id);
+    }
   });
 });

package/src/modules/user-management/command/reactivateUser.ts

@@ -1,7 +1,6 @@
-import { defineCommand } from "../../shared/internal";
+import { ok, err, type CommandContext } from "../../shared/internal";
 import { DB } from "../generated/kysely-tailordb";
-import { InvalidStatusTransitionError, UserNotFoundError } from "../lib/errors";
-import { permissions } from "../permissions";
+import { InvalidStatusTransitionError, UserNotFoundError } from "../lib/errors.generated";
 
 export interface ReactivateUserInput {
   userId: string;
@@ -15,53 +14,46 @@ export interface ReactivateUserInput {
  * Transitions a user from INACTIVE back to ACTIVE status.
  * Restores access for previously deactivated users.
  */
-export const reactivateUser = defineCommand(
-  permissions.reactivateUser,
-  async (db: DB, input: ReactivateUserInput) => {
-    // 1. Find user by ID
-    const user = await db
-      .selectFrom("User")
-      .selectAll()
-      .where("id", "=", input.userId)
-      .executeTakeFirst();
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+export async function run(db: DB, input: ReactivateUserInput, _ctx: CommandContext) {
+  const user = await db
+    .selectFrom("User")
+    .selectAll()
+    .where("id", "=", input.userId)
+    .executeTakeFirst();
 
-    // 2. If not found, throw error
-    if (!user) {
-      throw new UserNotFoundError(input.userId);
-    }
+  if (!user) {
+    return err(new UserNotFoundError(input.userId));
+  }
 
-    // 3. Validate status transition
-    const validFromStatuses = input.from ?? ["INACTIVE"];
-    if (!validFromStatuses.includes(user.status)) {
-      throw new InvalidStatusTransitionError(user.status, "ACTIVE");
-    }
+  const validFromStatuses = input.from ?? ["INACTIVE"];
+  if (!validFromStatuses.includes(user.status)) {
+    return err(new InvalidStatusTransitionError(`${user.status} to ACTIVE`));
+  }
 
-    // 4. Update status to ACTIVE
-    const updatedUser = await db
-      .updateTable("User")
-      .set({
-        status: "ACTIVE",
-        updatedAt: new Date(),
-      })
-      .where("id", "=", input.userId)
-      .returningAll()
-      .executeTakeFirst();
+  const updatedUser = await db
+    .updateTable("User")
+    .set({
+      status: "ACTIVE",
+      updatedAt: new Date(),
+    })
+    .where("id", "=", input.userId)
+    .returningAll()
+    .executeTakeFirst();
 
-    // 5. Log USER_REACTIVATED audit event
-    const auditEvent = await db
-      .insertInto("AuditEvent")
-      .values({
-        eventType: "USER_REACTIVATED",
-        actorId: input.actorId,
-        targetId: input.userId,
-        targetType: "User",
-        payload: JSON.stringify({ previousStatus: user.status }),
-        createdAt: new Date(),
-        updatedAt: null,
-      })
-      .returningAll()
-      .executeTakeFirst();
+  const auditEvent = await db
+    .insertInto("AuditEvent")
+    .values({
+      eventType: "USER_REACTIVATED",
+      actorId: input.actorId,
+      targetId: input.userId,
+      targetType: "User",
+      payload: JSON.stringify({ previousStatus: user.status }),
+      createdAt: new Date(),
+      updatedAt: null,
+    })
+    .returningAll()
+    .executeTakeFirst();
 
-    return { user: updatedUser!, auditEvent: auditEvent! };
-  },
-);
+  return ok({ user: updatedUser!, auditEvent: auditEvent! });
+}

package/src/modules/user-management/command/revokePermissionFromRole.generated.ts

@@ -0,0 +1,6 @@
+// @generated — do not edit
+import { defineCommand } from "../../shared/internal";
+import { permissions } from "../lib/permissions.generated";
+import { run } from "./revokePermissionFromRole";
+
+export const revokePermissionFromRole = defineCommand(permissions.revokePermissionFromRole, run);