@tailor-platform/erp-kit 0.6.0 → 0.8.0

package/templates/scaffold/app/backend/seed/data/RolePermission.jsonl

@@ -0,0 +1,13 @@
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000001"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000002"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000003"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000004"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000005"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000006"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000007"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000008"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000009"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-00000000000a"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-00000000000b"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-00000000000c"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-00000000000d"}

package/templates/scaffold/app/backend/seed/data/RolePermission.schema.ts

@@ -1,7 +1,7 @@
 import { t } from "@tailor-platform/sdk";
 import { defineSchema } from "@tailor-platform/sdk/seed";
 import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
-import { rolePermission } from "../../src/modules";
+import { rolePermission } from "../../src/modules-db";
 
 const schemaType = t.object({
   ...rolePermission.pickFields(["id","createdAt"], { optional: true }),

package/templates/scaffold/app/backend/seed/data/User.jsonl

@@ -1 +1 @@
-{"email":"test@example.com","name":"Demo User","status":"ACTIVE","permissions":["user-management:createUser"]}
+{"id":"00000000-0000-0000-0002-000000000001","email":"admin@example.com","name":"Admin User","status":"ACTIVE","permissions":["user-management:createUser","user-management:activateUser","user-management:deactivateUser","user-management:reactivateUser","user-management:createRole","user-management:assignPermissionToRole","user-management:revokePermissionFromRole","user-management:assignRoleToUser","user-management:revokeRoleFromUser","user-management:createPermission","audit:logAuditEvent"]}

package/templates/scaffold/app/backend/seed/data/User.schema.ts

@@ -1,7 +1,7 @@
 import { t } from "@tailor-platform/sdk";
 import { defineSchema } from "@tailor-platform/sdk/seed";
 import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
-import { user } from "../../src/modules";
+import { user } from "../../src/modules-db";
 
 const schemaType = t.object({
   ...user.pickFields(["id","createdAt"], { optional: true }),

package/templates/scaffold/app/backend/seed/data/UserRole.jsonl

@@ -0,0 +1 @@
+{"userId":"00000000-0000-0000-0002-000000000001","roleId":"00000000-0000-0000-0001-000000000001"}

package/templates/scaffold/app/backend/seed/data/UserRole.schema.ts

@@ -1,7 +1,7 @@
 import { t } from "@tailor-platform/sdk";
 import { defineSchema } from "@tailor-platform/sdk/seed";
 import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
-import { userRole } from "../../src/modules";
+import { userRole } from "../../src/modules-db";
 
 const schemaType = t.object({
   ...userRole.pickFields(["id","createdAt"], { optional: true }),

package/templates/scaffold/app/backend/seed/data/_User.jsonl

@@ -1 +1 @@
-{"name":"test@example.com","password":"password"}
+{"name":"admin@example.com","password":"Passw0rd!"}

package/templates/scaffold/app/backend/seed/exec.mjs

@@ -141,7 +141,13 @@ if (!machineUserName) {
 // Entity configuration
 const namespaceEntities = {
   "main-db": [
+    "AuditEntry",
+    "AuditPolicy",
+    "AuditableEntity",
+    "ChangeDetail",
+    "Company",
     "Permission",
+    "PolicyFieldRule",
     "Role",
     "RolePermission",
     "User",
@@ -150,7 +156,13 @@ const namespaceEntities = {
 };
 const namespaceDeps = {
   "main-db": {
+    "AuditEntry": ["Company"],
+    "AuditPolicy": ["Company"],
+    "AuditableEntity": [],
+    "ChangeDetail": ["AuditEntry"],
+    "Company": [],
     "Permission": [],
+    "PolicyFieldRule": ["AuditPolicy"],
     "Role": [],
     "RolePermission": ["Role", "Permission"],
     "User": [],

package/templates/scaffold/app/backend/src/executors/permissionCreated.ts

@@ -1,3 +1,3 @@
-import { rolePermissionCreated } from "@/modules";
+import { umModules } from "@/modules";
 
-export default rolePermissionCreated;
+export default umModules.executors.rolePermissionCreated;

package/templates/scaffold/app/backend/src/executors/permissionDeleted.ts

@@ -1,3 +1,3 @@
-import { rolePermissionDeleted } from "@/modules";
+import { umModules } from "@/modules";
 
-export default rolePermissionDeleted;
+export default umModules.executors.rolePermissionDeleted;

package/templates/scaffold/app/backend/src/generated/kysely-tailordb.ts

@@ -13,6 +13,59 @@ import {
 
 export interface Namespace {
   "main-db": {
+    AuditEntry: {
+      id: Generated<string>;
+      eventId: string;
+      actorType: string;
+      actorId: string;
+      entityType: string;
+      entityId: string;
+      operationType: string;
+      companyId: string | null;
+      correlationId: string | null;
+      ipAddress: string | null;
+      userAgent: string | null;
+      sessionId: string | null;
+      requestId: string | null;
+      onBehalfOf: string | null;
+      timestamp: Timestamp;
+      createdAt: Generated<Timestamp>;
+      updatedAt: Timestamp | null;
+    }
+
+    AuditPolicy: {
+      id: Generated<string>;
+      entityName: string;
+      companyId: string | null;
+      operationType: string;
+      status: string;
+      createdAt: Generated<Timestamp>;
+      updatedAt: Timestamp | null;
+    }
+
+    AuditableEntity: {
+      id: Generated<string>;
+      entityName: string;
+      entityScope: string;
+      auditableFields: string;
+      createdAt: Generated<Timestamp>;
+      updatedAt: Timestamp | null;
+    }
+
+    ChangeDetail: {
+      id: Generated<string>;
+      auditEntryId: string;
+      fieldName: string;
+      oldValue: string | null;
+      newValue: string | null;
+      createdAt: Generated<Timestamp>;
+      updatedAt: Timestamp | null;
+    }
+
+    Company: {
+      id: Generated<string>;
+    }
+
     Permission: {
       id: Generated<string>;
       key: string;
@@ -21,6 +74,15 @@ export interface Namespace {
       updatedAt: Timestamp | null;
     }
 
+    PolicyFieldRule: {
+      id: Generated<string>;
+      auditPolicyId: string;
+      fieldName: string;
+      sensitivityMode: string;
+      createdAt: Generated<Timestamp>;
+      updatedAt: Timestamp | null;
+    }
+
     Role: {
       id: Generated<string>;
       name: string;

package/templates/scaffold/app/backend/src/modules-db.ts

@@ -0,0 +1,13 @@
+import { auditCompanyStub } from "@tailor-platform/erp-kit/module";
+import { umModules, auditModules } from "./modules";
+
+// Destructured for DB scanner (tailor.config.ts db.files).
+// This file must NOT be imported by resolvers — property access prevents tree-shaking.
+
+// user-management
+export const { user, permission, role, userRole, rolePermission } = umModules.db;
+
+// audit
+export const { auditableEntity, auditPolicy, policyFieldRule, auditEntry, changeDetail } =
+  auditModules.db;
+export { auditCompanyStub as company };

package/templates/scaffold/app/backend/src/modules.ts

@@ -1,9 +1,7 @@
-import { defineUserManagementModule } from "@tailor-platform/erp-kit/module";
+import { defineUserManagementModule, defineAuditModule } from "@tailor-platform/erp-kit/module";
 
-const umModules = defineUserManagementModule({
+export const umModules = defineUserManagementModule({
   dbNamespace: "main-db",
 });
 
-export const { db: umDb, executors: umExecutors, commands: umCommands } = umModules;
-export const { user, permission, role, userRole, rolePermission } = umDb;
-export const { rolePermissionCreated, rolePermissionDeleted } = umExecutors;
+export const auditModules = defineAuditModule();

package/templates/scaffold/app/backend/src/resolvers/assignPermissionToRole.ts

@@ -0,0 +1,70 @@
+import { createResolver, t } from "@tailor-platform/sdk";
+import { createContext } from "@tailor-platform/erp-kit/app";
+import { getDB } from "@/generated/kysely-tailordb";
+import { umModules, auditModules } from "@/modules";
+
+export default createResolver({
+  name: "assignPermissionToRole",
+  operation: "mutation",
+  input: {
+    roleId: t.string().description("Role ID"),
+    permissionId: t.string().description("Permission ID to assign"),
+  },
+  body: async (context) => {
+    const db = getDB("main-db");
+    const result = await db.transaction().execute(async (trx) => {
+      const cmdResult = await umModules.commands.assignPermissionToRole(
+        trx,
+        {
+          roleId: context.input.roleId,
+          permissionId: context.input.permissionId,
+        },
+        createContext(context),
+      );
+      if (!cmdResult.ok) {
+        switch (cmdResult.error.code) {
+          case "USER_MANAGEMENT_ROLE_NOT_FOUND":
+            throw new Error(`Role ${context.input.roleId} does not exist`);
+          case "USER_MANAGEMENT_PERMISSION_NOT_FOUND":
+            throw new Error(`Permission ${context.input.permissionId} does not exist`);
+          case "INSUFFICIENT_PERMISSION":
+            throw cmdResult.error;
+        }
+      }
+      return {
+        roleId: context.input.roleId,
+        permissionId: context.input.permissionId,
+      };
+    });
+
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "RolePermission",
+            entityId: `${result.roleId}:${result.permissionId}`,
+            operationType: "CREATE",
+            changes: [
+              { fieldName: "roleId", newValue: result.roleId },
+              { fieldName: "permissionId", newValue: result.permissionId },
+            ],
+          },
+          createContext(context),
+        );
+      })
+      .catch(() => undefined);
+
+    return result;
+  },
+  output: t
+    .object({
+      roleId: t.string().description("Role ID"),
+      permissionId: t.string().description("Assigned permission ID"),
+    })
+    .description("Permission assignment result"),
+});

package/templates/scaffold/app/backend/src/resolvers/assignRoleToUser.ts

@@ -0,0 +1,72 @@
+import { createResolver, t } from "@tailor-platform/sdk";
+import { createContext } from "@tailor-platform/erp-kit/app";
+import { getDB } from "@/generated/kysely-tailordb";
+import { umModules, auditModules } from "@/modules";
+
+export default createResolver({
+  name: "assignRoleToUser",
+  operation: "mutation",
+  input: {
+    userId: t.string().description("User ID"),
+    roleId: t.string().description("Role ID to assign"),
+  },
+  body: async (context) => {
+    const db = getDB("main-db");
+    const result = await db.transaction().execute(async (trx) => {
+      const cmdResult = await umModules.commands.assignRoleToUser(
+        trx,
+        {
+          userId: context.input.userId,
+          roleId: context.input.roleId,
+        },
+        createContext(context),
+      );
+      if (!cmdResult.ok) {
+        switch (cmdResult.error.code) {
+          case "USER_MANAGEMENT_USER_NOT_FOUND":
+            throw new Error(`User ${context.input.userId} does not exist`);
+          case "USER_MANAGEMENT_ROLE_NOT_FOUND":
+            throw new Error(`Role ${context.input.roleId} does not exist`);
+          case "USER_MANAGEMENT_USER_NOT_ACTIVE":
+            throw new Error("User is not in ACTIVE status");
+          case "INSUFFICIENT_PERMISSION":
+            throw cmdResult.error;
+        }
+      }
+      return {
+        userId: cmdResult.value.user.id,
+        roleId: context.input.roleId,
+      };
+    });
+
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "UserRole",
+            entityId: `${result.userId}:${result.roleId}`,
+            operationType: "CREATE",
+            changes: [
+              { fieldName: "userId", newValue: result.userId },
+              { fieldName: "roleId", newValue: result.roleId },
+            ],
+          },
+          createContext(context),
+        );
+      })
+      .catch(() => undefined);
+
+    return result;
+  },
+  output: t
+    .object({
+      userId: t.string().description("User ID"),
+      roleId: t.string().description("Assigned role ID"),
+    })
+    .description("Role assignment result"),
+});

package/templates/scaffold/app/backend/src/resolvers/createRole.ts

@@ -0,0 +1,92 @@
+import { createResolver, t } from "@tailor-platform/sdk";
+import { createContext } from "@tailor-platform/erp-kit/app";
+import { getDB } from "@/generated/kysely-tailordb";
+import { umModules, auditModules } from "@/modules";
+
+export default createResolver({
+  name: "createRole",
+  operation: "mutation",
+  input: {
+    name: t.string().description("Role name"),
+    description: t.string({ optional: true }).description("Role description"),
+  },
+  body: async (context) => {
+    const db = getDB("main-db");
+    const result = await db.transaction().execute(async (trx) => {
+      const cmdResult = await umModules.commands.createRole(
+        trx,
+        {
+          name: context.input.name,
+          description: context.input.description ?? undefined,
+        },
+        createContext(context),
+      );
+      if (!cmdResult.ok) {
+        switch (cmdResult.error.code) {
+          case "USER_MANAGEMENT_DUPLICATE_ROLE_NAME":
+            throw new Error(`A role with name "${context.input.name}" already exists`);
+          case "USER_MANAGEMENT_MISSING_REQUIRED_FIELD":
+            throw new Error("Role name is required");
+          case "INSUFFICIENT_PERMISSION":
+            throw cmdResult.error;
+        }
+      }
+
+      // Auto-assign permissions that every role needs
+      const autoAssignKeys = ["audit:logAuditEvent", "user-management:updateOwnProfile"];
+      const autoAssignPerms = await trx
+        .selectFrom("Permission")
+        .select("id")
+        .where("key", "in", autoAssignKeys)
+        .execute();
+
+      for (const perm of autoAssignPerms) {
+        await umModules.commands.assignPermissionToRole(
+          trx,
+          {
+            roleId: cmdResult.value.role.id,
+            permissionId: perm.id,
+          },
+          createContext(context),
+        );
+      }
+
+      return {
+        id: cmdResult.value.role.id,
+        name: cmdResult.value.role.name,
+        description: cmdResult.value.role.description ?? "",
+      };
+    });
+
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "Role",
+            entityId: result.id,
+            operationType: "CREATE",
+            changes: [
+              { fieldName: "name", newValue: result.name },
+              { fieldName: "description", newValue: result.description },
+            ],
+          },
+          createContext(context),
+        );
+      })
+      .catch(() => undefined);
+
+    return result;
+  },
+  output: t
+    .object({
+      id: t.string().description("Role ID"),
+      name: t.string().description("Role name"),
+      description: t.string().description("Role description"),
+    })
+    .description("Created role"),
+});

package/templates/scaffold/app/backend/src/resolvers/createUser.ts

@@ -1,7 +1,16 @@
 import { createResolver, t } from "@tailor-platform/sdk";
 import { createContext } from "@tailor-platform/erp-kit/app";
 import { getDB } from "@/generated/kysely-tailordb";
-import { umCommands } from "@/modules";
+import { umModules, auditModules } from "@/modules";
+
+const PASSWORD_LENGTH = 16;
+const PASSWORD_CHARS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%&*";
+
+function generatePassword(): string {
+  const bytes = new Uint8Array(PASSWORD_LENGTH);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => PASSWORD_CHARS[b % PASSWORD_CHARS.length]).join("");
+}
 
 export default createResolver({
   name: "createUser",
@@ -9,11 +18,14 @@ export default createResolver({
   input: {
     name: t.string().description("User name"),
     email: t.string().description("User email"),
+    roleIds: t.string({ array: true, optional: true }).description("Role IDs to assign"),
   },
   body: async (context) => {
     const db = getDB("main-db");
-    return db.transaction().execute(async (trx) => {
-      const result = await umCommands.createUser(
+    const password = generatePassword();
+    const roleIds = context.input.roleIds ?? [];
+    const result = await db.transaction().execute(async (trx) => {
+      const createResult = await umModules.commands.createUser(
         trx,
         {
           email: context.input.email,
@@ -21,26 +33,114 @@ export default createResolver({
         },
         createContext(context),
       );
-      if (!result.ok) {
-        switch (result.error.code) {
+      if (!createResult.ok) {
+        switch (createResult.error.code) {
+          case "USER_MANAGEMENT_USER_ALREADY_EXISTS":
+            throw new Error(`A user with email ${context.input.email} already exists`);
           case "USER_MANAGEMENT_MISSING_REQUIRED_FIELD":
-            throw new Error(`Missing required field: ${result.error.message}`);
+            throw new Error(`Missing required field: ${createResult.error.message}`);
           case "USER_MANAGEMENT_INVALID_EMAIL":
-            throw new Error(`Invalid email: ${result.error.message}`);
-          case "USER_MANAGEMENT_USER_ALREADY_EXISTS":
-            throw new Error(`User already exists: ${result.error.message}`);
+            throw new Error(`Invalid email format: ${context.input.email}`);
           case "INSUFFICIENT_PERMISSION":
-            throw new Error(`Insufficient permission: ${result.error.message}`);
+            throw createResult.error;
+        }
+      }
+
+      const activateResult = await umModules.commands.activateUser(
+        trx,
+        { userId: createResult.value.user.id },
+        createContext(context),
+      );
+      if (!activateResult.ok) throw activateResult.error;
+
+      for (const roleId of roleIds) {
+        const assignResult = await umModules.commands.assignRoleToUser(
+          trx,
+          {
+            userId: createResult.value.user.id,
+            roleId,
+          },
+          createContext(context),
+        );
+        if (!assignResult.ok) {
+          switch (assignResult.error.code) {
+            case "USER_MANAGEMENT_ROLE_NOT_FOUND":
+              throw new Error(`Role ${roleId} does not exist`);
+            case "USER_MANAGEMENT_USER_NOT_FOUND":
+              throw new Error(`User does not exist`);
+            case "USER_MANAGEMENT_USER_NOT_ACTIVE":
+              throw new Error("User is not in ACTIVE status");
+            case "INSUFFICIENT_PERMISSION":
+              throw assignResult.error;
+          }
         }
       }
+
+      // IDP failure rolls back the entire transaction, preventing orphaned DB records
+      const idpClient = new tailor.idp.Client({ namespace: "default" });
+      await idpClient.createUser({ name: context.input.email, password });
+
       return {
-        message: `User ${result.value.user.name} created successfully!`,
+        id: createResult.value.user.id,
+        name: createResult.value.user.name,
+        email: createResult.value.user.email,
+        status: activateResult.value.user.status,
       };
     });
+
+    const correlationId = crypto.randomUUID();
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "User",
+            entityId: result.id,
+            operationType: "CREATE",
+            correlationId,
+            changes: [
+              { fieldName: "name", newValue: result.name },
+              { fieldName: "email", newValue: result.email },
+              { fieldName: "status", newValue: result.status },
+            ],
+          },
+          createContext(context),
+        );
+        for (const roleId of roleIds) {
+          await auditModules.commands.logAuditEvent(
+            trx,
+            {
+              eventId: crypto.randomUUID(),
+              actorType: "USER",
+              actorId: context.user.id,
+              entityType: "UserRole",
+              entityId: `${result.id}:${roleId}`,
+              operationType: "CREATE",
+              correlationId,
+              changes: [
+                { fieldName: "userId", newValue: result.id },
+                { fieldName: "roleId", newValue: roleId },
+              ],
+            },
+            createContext(context),
+          );
+        }
+      })
+      .catch(() => undefined);
+
+    return { ...result, initialPassword: password };
   },
   output: t
     .object({
-      message: t.string().description("Result message"),
+      id: t.string().description("User ID"),
+      name: t.string().description("User name"),
+      email: t.string().description("User email"),
+      status: t.string().description("User status"),
+      initialPassword: t.string().description("Auto-generated initial password"),
     })
-    .description("Create user response"),
+    .description("Created user"),
 });

package/templates/scaffold/app/backend/src/resolvers/deactivateUser.ts

@@ -0,0 +1,67 @@
+import { createResolver, t } from "@tailor-platform/sdk";
+import { createContext } from "@tailor-platform/erp-kit/app";
+import { getDB } from "@/generated/kysely-tailordb";
+import { umModules, auditModules } from "@/modules";
+
+export default createResolver({
+  name: "deactivateUser",
+  operation: "mutation",
+  input: {
+    userId: t.string().description("ID of the user to deactivate"),
+  },
+  body: async (context) => {
+    if (context.input.userId === context.user.id) {
+      throw new Error("Cannot deactivate your own account");
+    }
+
+    const db = getDB("main-db");
+    const result = await db.transaction().execute(async (trx) => {
+      const cmdResult = await umModules.commands.deactivateUser(
+        trx,
+        { userId: context.input.userId },
+        createContext(context),
+      );
+      if (!cmdResult.ok) {
+        switch (cmdResult.error.code) {
+          case "USER_MANAGEMENT_USER_NOT_FOUND":
+            throw new Error(`User ${context.input.userId} does not exist`);
+          case "USER_MANAGEMENT_INVALID_STATUS_TRANSITION":
+            throw new Error("User is not in ACTIVE status");
+          case "INSUFFICIENT_PERMISSION":
+            throw cmdResult.error;
+        }
+      }
+      return {
+        id: cmdResult.value.user.id,
+        status: cmdResult.value.user.status,
+      };
+    });
+
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "User",
+            entityId: result.id,
+            operationType: "UPDATE",
+            changes: [{ fieldName: "status", oldValue: "ACTIVE", newValue: result.status }],
+          },
+          createContext(context),
+        );
+      })
+      .catch(() => undefined);
+
+    return result;
+  },
+  output: t
+    .object({
+      id: t.string().description("User ID"),
+      status: t.string().description("Updated status"),
+    })
+    .description("Deactivated user"),
+});