@tailor-platform/erp-kit 0.7.0 → 0.9.0

package/templates/scaffold/app/backend/seed/data/ChangeDetail.schema.ts

@@ -0,0 +1,20 @@
+import { t } from "@tailor-platform/sdk";
+import { defineSchema } from "@tailor-platform/sdk/seed";
+import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
+import { changeDetail } from "../../src/modules-db";
+
+const schemaType = t.object({
+  ...changeDetail.pickFields(["id","createdAt"], { optional: true }),
+  ...changeDetail.omitFields(["id","createdAt"]),
+});
+
+const hook = createTailorDBHook(changeDetail);
+
+export const schema = defineSchema(
+  createStandardSchema(schemaType, hook),
+  {
+    foreignKeys: [
+      {"column":"auditEntryId","references":{"table":"AuditEntry","column":"id"}},
+    ],
+  }
+);

package/templates/scaffold/app/backend/seed/data/Company.schema.ts

@@ -0,0 +1,15 @@
+import { t } from "@tailor-platform/sdk";
+import { defineSchema } from "@tailor-platform/sdk/seed";
+import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
+import { company } from "../../src/modules-db";
+
+const schemaType = t.object({
+  ...company.pickFields(["id"], { optional: true }),
+  ...company.omitFields(["id"]),
+});
+
+const hook = createTailorDBHook(company);
+
+export const schema = defineSchema(
+  createStandardSchema(schemaType, hook),
+);

package/templates/scaffold/app/backend/seed/data/Permission.jsonl

@@ -0,0 +1,13 @@
+{"id":"00000000-0000-0000-0000-000000000001","key":"user-management:createUser","description":"Create user accounts"}
+{"id":"00000000-0000-0000-0000-000000000002","key":"user-management:activateUser","description":"Activate user accounts"}
+{"id":"00000000-0000-0000-0000-000000000003","key":"user-management:deactivateUser","description":"Deactivate user accounts"}
+{"id":"00000000-0000-0000-0000-000000000004","key":"user-management:reactivateUser","description":"Reactivate user accounts"}
+{"id":"00000000-0000-0000-0000-000000000005","key":"user-management:createRole","description":"Create roles"}
+{"id":"00000000-0000-0000-0000-000000000006","key":"user-management:assignPermissionToRole","description":"Assign permissions to roles"}
+{"id":"00000000-0000-0000-0000-000000000007","key":"user-management:revokePermissionFromRole","description":"Revoke permissions from roles"}
+{"id":"00000000-0000-0000-0000-000000000008","key":"user-management:assignRoleToUser","description":"Assign roles to users"}
+{"id":"00000000-0000-0000-0000-000000000009","key":"user-management:revokeRoleFromUser","description":"Revoke roles from users"}
+{"id":"00000000-0000-0000-0000-00000000000a","key":"user-management:createPermission","description":"Create permissions"}
+{"id":"00000000-0000-0000-0000-00000000000b","key":"audit:logAuditEvent","description":"Log audit events"}
+{"id":"00000000-0000-0000-0000-00000000000c","key":"user-management:updateUser","description":"Update user profiles"}
+{"id":"00000000-0000-0000-0000-00000000000d","key":"user-management:updateOwnProfile","description":"Update own profile"}

package/templates/scaffold/app/backend/seed/data/Permission.schema.ts

@@ -1,7 +1,7 @@
 import { t } from "@tailor-platform/sdk";
 import { defineSchema } from "@tailor-platform/sdk/seed";
 import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
-import { permission } from "../../src/modules";
+import { permission } from "../../src/modules-db";
 
 const schemaType = t.object({
   ...permission.pickFields(["id","createdAt"], { optional: true }),

package/templates/scaffold/app/backend/seed/data/PolicyFieldRule.schema.ts

@@ -0,0 +1,20 @@
+import { t } from "@tailor-platform/sdk";
+import { defineSchema } from "@tailor-platform/sdk/seed";
+import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
+import { policyFieldRule } from "../../src/modules-db";
+
+const schemaType = t.object({
+  ...policyFieldRule.pickFields(["id","createdAt"], { optional: true }),
+  ...policyFieldRule.omitFields(["id","createdAt"]),
+});
+
+const hook = createTailorDBHook(policyFieldRule);
+
+export const schema = defineSchema(
+  createStandardSchema(schemaType, hook),
+  {
+    foreignKeys: [
+      {"column":"auditPolicyId","references":{"table":"AuditPolicy","column":"id"}},
+    ],
+  }
+);

package/templates/scaffold/app/backend/seed/data/Role.jsonl

@@ -0,0 +1 @@
+{"id":"00000000-0000-0000-0001-000000000001","name":"Admin","description":"Full system access"}

package/templates/scaffold/app/backend/seed/data/Role.schema.ts

@@ -1,7 +1,7 @@
 import { t } from "@tailor-platform/sdk";
 import { defineSchema } from "@tailor-platform/sdk/seed";
 import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
-import { role } from "../../src/modules";
+import { role } from "../../src/modules-db";
 
 const schemaType = t.object({
   ...role.pickFields(["id","createdAt"], { optional: true }),

package/templates/scaffold/app/backend/seed/data/RolePermission.jsonl

@@ -0,0 +1,13 @@
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000001"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000002"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000003"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000004"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000005"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000006"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000007"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000008"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-000000000009"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-00000000000a"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-00000000000b"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-00000000000c"}
+{"roleId":"00000000-0000-0000-0001-000000000001","permissionId":"00000000-0000-0000-0000-00000000000d"}

package/templates/scaffold/app/backend/seed/data/RolePermission.schema.ts

@@ -1,7 +1,7 @@
 import { t } from "@tailor-platform/sdk";
 import { defineSchema } from "@tailor-platform/sdk/seed";
 import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
-import { rolePermission } from "../../src/modules";
+import { rolePermission } from "../../src/modules-db";
 
 const schemaType = t.object({
   ...rolePermission.pickFields(["id","createdAt"], { optional: true }),

package/templates/scaffold/app/backend/seed/data/User.jsonl

@@ -1 +1 @@
-{"email":"test@example.com","name":"Demo User","status":"ACTIVE","permissions":["user-management:createUser"]}
+{"id":"00000000-0000-0000-0002-000000000001","email":"admin@example.com","name":"Admin User","status":"ACTIVE","permissions":["user-management:createUser","user-management:activateUser","user-management:deactivateUser","user-management:reactivateUser","user-management:createRole","user-management:assignPermissionToRole","user-management:revokePermissionFromRole","user-management:assignRoleToUser","user-management:revokeRoleFromUser","user-management:createPermission","audit:logAuditEvent"]}

package/templates/scaffold/app/backend/seed/data/User.schema.ts

@@ -1,7 +1,7 @@
 import { t } from "@tailor-platform/sdk";
 import { defineSchema } from "@tailor-platform/sdk/seed";
 import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
-import { user } from "../../src/modules";
+import { user } from "../../src/modules-db";
 
 const schemaType = t.object({
   ...user.pickFields(["id","createdAt"], { optional: true }),

package/templates/scaffold/app/backend/seed/data/UserRole.jsonl

@@ -0,0 +1 @@
+{"userId":"00000000-0000-0000-0002-000000000001","roleId":"00000000-0000-0000-0001-000000000001"}

package/templates/scaffold/app/backend/seed/data/UserRole.schema.ts

@@ -1,7 +1,7 @@
 import { t } from "@tailor-platform/sdk";
 import { defineSchema } from "@tailor-platform/sdk/seed";
 import { createTailorDBHook, createStandardSchema } from "@tailor-platform/sdk/test";
-import { userRole } from "../../src/modules";
+import { userRole } from "../../src/modules-db";
 
 const schemaType = t.object({
   ...userRole.pickFields(["id","createdAt"], { optional: true }),

package/templates/scaffold/app/backend/seed/data/_User.jsonl

@@ -1 +1 @@
-{"name":"test@example.com","password":"password"}
+{"name":"admin@example.com","password":"Passw0rd!"}

package/templates/scaffold/app/backend/seed/exec.mjs

@@ -141,7 +141,13 @@ if (!machineUserName) {
 // Entity configuration
 const namespaceEntities = {
   "main-db": [
+    "AuditEntry",
+    "AuditPolicy",
+    "AuditableEntity",
+    "ChangeDetail",
+    "Company",
     "Permission",
+    "PolicyFieldRule",
     "Role",
     "RolePermission",
     "User",
@@ -150,7 +156,13 @@ const namespaceEntities = {
 };
 const namespaceDeps = {
   "main-db": {
+    "AuditEntry": ["Company"],
+    "AuditPolicy": ["Company"],
+    "AuditableEntity": [],
+    "ChangeDetail": ["AuditEntry"],
+    "Company": [],
     "Permission": [],
+    "PolicyFieldRule": ["AuditPolicy"],
     "Role": [],
     "RolePermission": ["Role", "Permission"],
     "User": [],

package/templates/scaffold/app/backend/src/executors/permissionCreated.ts

@@ -1,3 +1,3 @@
-import { rolePermissionCreated } from "@/modules";
+import { umModules } from "@/modules";
 
-export default rolePermissionCreated;
+export default umModules.executors.rolePermissionCreated;

package/templates/scaffold/app/backend/src/executors/permissionDeleted.ts

@@ -1,3 +1,3 @@
-import { rolePermissionDeleted } from "@/modules";
+import { umModules } from "@/modules";
 
-export default rolePermissionDeleted;
+export default umModules.executors.rolePermissionDeleted;

package/templates/scaffold/app/backend/src/generated/kysely-tailordb.ts

@@ -13,6 +13,59 @@ import {
 
 export interface Namespace {
   "main-db": {
+    AuditEntry: {
+      id: Generated<string>;
+      eventId: string;
+      actorType: string;
+      actorId: string;
+      entityType: string;
+      entityId: string;
+      operationType: string;
+      companyId: string | null;
+      correlationId: string | null;
+      ipAddress: string | null;
+      userAgent: string | null;
+      sessionId: string | null;
+      requestId: string | null;
+      onBehalfOf: string | null;
+      timestamp: Timestamp;
+      createdAt: Generated<Timestamp>;
+      updatedAt: Timestamp | null;
+    }
+
+    AuditPolicy: {
+      id: Generated<string>;
+      entityName: string;
+      companyId: string | null;
+      operationType: string;
+      status: string;
+      createdAt: Generated<Timestamp>;
+      updatedAt: Timestamp | null;
+    }
+
+    AuditableEntity: {
+      id: Generated<string>;
+      entityName: string;
+      entityScope: string;
+      auditableFields: string;
+      createdAt: Generated<Timestamp>;
+      updatedAt: Timestamp | null;
+    }
+
+    ChangeDetail: {
+      id: Generated<string>;
+      auditEntryId: string;
+      fieldName: string;
+      oldValue: string | null;
+      newValue: string | null;
+      createdAt: Generated<Timestamp>;
+      updatedAt: Timestamp | null;
+    }
+
+    Company: {
+      id: Generated<string>;
+    }
+
     Permission: {
       id: Generated<string>;
       key: string;
@@ -21,6 +74,15 @@ export interface Namespace {
       updatedAt: Timestamp | null;
     }
 
+    PolicyFieldRule: {
+      id: Generated<string>;
+      auditPolicyId: string;
+      fieldName: string;
+      sensitivityMode: string;
+      createdAt: Generated<Timestamp>;
+      updatedAt: Timestamp | null;
+    }
+
     Role: {
       id: Generated<string>;
       name: string;

package/templates/scaffold/app/backend/src/modules-db.ts

@@ -0,0 +1,13 @@
+import { auditCompanyStub } from "@tailor-platform/erp-kit/module";
+import { umModules, auditModules } from "./modules";
+
+// Destructured for DB scanner (tailor.config.ts db.files).
+// This file must NOT be imported by resolvers — property access prevents tree-shaking.
+
+// user-management
+export const { user, permission, role, userRole, rolePermission } = umModules.db;
+
+// audit
+export const { auditableEntity, auditPolicy, policyFieldRule, auditEntry, changeDetail } =
+  auditModules.db;
+export { auditCompanyStub as company };

package/templates/scaffold/app/backend/src/modules.ts

@@ -1,9 +1,7 @@
-import { defineUserManagementModule } from "@tailor-platform/erp-kit/module";
+import { defineUserManagementModule, defineAuditModule } from "@tailor-platform/erp-kit/module";
 
-const umModules = defineUserManagementModule({
+export const umModules = defineUserManagementModule({
   dbNamespace: "main-db",
 });
 
-export const { db: umDb, executors: umExecutors, commands: umCommands } = umModules;
-export const { user, permission, role, userRole, rolePermission } = umDb;
-export const { rolePermissionCreated, rolePermissionDeleted } = umExecutors;
+export const auditModules = defineAuditModule();

package/templates/scaffold/app/backend/src/resolvers/assignPermissionToRole.ts

@@ -0,0 +1,70 @@
+import { createResolver, t } from "@tailor-platform/sdk";
+import { createContext } from "@tailor-platform/erp-kit/app";
+import { getDB } from "@/generated/kysely-tailordb";
+import { umModules, auditModules } from "@/modules";
+
+export default createResolver({
+  name: "assignPermissionToRole",
+  operation: "mutation",
+  input: {
+    roleId: t.string().description("Role ID"),
+    permissionId: t.string().description("Permission ID to assign"),
+  },
+  body: async (context) => {
+    const db = getDB("main-db");
+    const result = await db.transaction().execute(async (trx) => {
+      const cmdResult = await umModules.commands.assignPermissionToRole(
+        trx,
+        {
+          roleId: context.input.roleId,
+          permissionId: context.input.permissionId,
+        },
+        createContext(context),
+      );
+      if (!cmdResult.ok) {
+        switch (cmdResult.error.code) {
+          case "USER_MANAGEMENT_ROLE_NOT_FOUND":
+            throw new Error(`Role ${context.input.roleId} does not exist`);
+          case "USER_MANAGEMENT_PERMISSION_NOT_FOUND":
+            throw new Error(`Permission ${context.input.permissionId} does not exist`);
+          case "INSUFFICIENT_PERMISSION":
+            throw cmdResult.error;
+        }
+      }
+      return {
+        roleId: context.input.roleId,
+        permissionId: context.input.permissionId,
+      };
+    });
+
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "RolePermission",
+            entityId: `${result.roleId}:${result.permissionId}`,
+            operationType: "CREATE",
+            changes: [
+              { fieldName: "roleId", newValue: result.roleId },
+              { fieldName: "permissionId", newValue: result.permissionId },
+            ],
+          },
+          createContext(context),
+        );
+      })
+      .catch(() => undefined);
+
+    return result;
+  },
+  output: t
+    .object({
+      roleId: t.string().description("Role ID"),
+      permissionId: t.string().description("Assigned permission ID"),
+    })
+    .description("Permission assignment result"),
+});

package/templates/scaffold/app/backend/src/resolvers/assignRoleToUser.ts

@@ -0,0 +1,72 @@
+import { createResolver, t } from "@tailor-platform/sdk";
+import { createContext } from "@tailor-platform/erp-kit/app";
+import { getDB } from "@/generated/kysely-tailordb";
+import { umModules, auditModules } from "@/modules";
+
+export default createResolver({
+  name: "assignRoleToUser",
+  operation: "mutation",
+  input: {
+    userId: t.string().description("User ID"),
+    roleId: t.string().description("Role ID to assign"),
+  },
+  body: async (context) => {
+    const db = getDB("main-db");
+    const result = await db.transaction().execute(async (trx) => {
+      const cmdResult = await umModules.commands.assignRoleToUser(
+        trx,
+        {
+          userId: context.input.userId,
+          roleId: context.input.roleId,
+        },
+        createContext(context),
+      );
+      if (!cmdResult.ok) {
+        switch (cmdResult.error.code) {
+          case "USER_MANAGEMENT_USER_NOT_FOUND":
+            throw new Error(`User ${context.input.userId} does not exist`);
+          case "USER_MANAGEMENT_ROLE_NOT_FOUND":
+            throw new Error(`Role ${context.input.roleId} does not exist`);
+          case "USER_MANAGEMENT_USER_NOT_ACTIVE":
+            throw new Error("User is not in ACTIVE status");
+          case "INSUFFICIENT_PERMISSION":
+            throw cmdResult.error;
+        }
+      }
+      return {
+        userId: cmdResult.value.user.id,
+        roleId: context.input.roleId,
+      };
+    });
+
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "UserRole",
+            entityId: `${result.userId}:${result.roleId}`,
+            operationType: "CREATE",
+            changes: [
+              { fieldName: "userId", newValue: result.userId },
+              { fieldName: "roleId", newValue: result.roleId },
+            ],
+          },
+          createContext(context),
+        );
+      })
+      .catch(() => undefined);
+
+    return result;
+  },
+  output: t
+    .object({
+      userId: t.string().description("User ID"),
+      roleId: t.string().description("Assigned role ID"),
+    })
+    .description("Role assignment result"),
+});

package/templates/scaffold/app/backend/src/resolvers/createRole.ts

@@ -0,0 +1,92 @@
+import { createResolver, t } from "@tailor-platform/sdk";
+import { createContext } from "@tailor-platform/erp-kit/app";
+import { getDB } from "@/generated/kysely-tailordb";
+import { umModules, auditModules } from "@/modules";
+
+export default createResolver({
+  name: "createRole",
+  operation: "mutation",
+  input: {
+    name: t.string().description("Role name"),
+    description: t.string({ optional: true }).description("Role description"),
+  },
+  body: async (context) => {
+    const db = getDB("main-db");
+    const result = await db.transaction().execute(async (trx) => {
+      const cmdResult = await umModules.commands.createRole(
+        trx,
+        {
+          name: context.input.name,
+          description: context.input.description ?? undefined,
+        },
+        createContext(context),
+      );
+      if (!cmdResult.ok) {
+        switch (cmdResult.error.code) {
+          case "USER_MANAGEMENT_DUPLICATE_ROLE_NAME":
+            throw new Error(`A role with name "${context.input.name}" already exists`);
+          case "USER_MANAGEMENT_MISSING_REQUIRED_FIELD":
+            throw new Error("Role name is required");
+          case "INSUFFICIENT_PERMISSION":
+            throw cmdResult.error;
+        }
+      }
+
+      // Auto-assign permissions that every role needs
+      const autoAssignKeys = ["audit:logAuditEvent", "user-management:updateOwnProfile"];
+      const autoAssignPerms = await trx
+        .selectFrom("Permission")
+        .select("id")
+        .where("key", "in", autoAssignKeys)
+        .execute();
+
+      for (const perm of autoAssignPerms) {
+        await umModules.commands.assignPermissionToRole(
+          trx,
+          {
+            roleId: cmdResult.value.role.id,
+            permissionId: perm.id,
+          },
+          createContext(context),
+        );
+      }
+
+      return {
+        id: cmdResult.value.role.id,
+        name: cmdResult.value.role.name,
+        description: cmdResult.value.role.description ?? "",
+      };
+    });
+
+    await db
+      .transaction()
+      .execute(async (trx) => {
+        await auditModules.commands.logAuditEvent(
+          trx,
+          {
+            eventId: crypto.randomUUID(),
+            actorType: "USER",
+            actorId: context.user.id,
+            entityType: "Role",
+            entityId: result.id,
+            operationType: "CREATE",
+            changes: [
+              { fieldName: "name", newValue: result.name },
+              { fieldName: "description", newValue: result.description },
+            ],
+          },
+          createContext(context),
+        );
+      })
+      .catch(() => undefined);
+
+    return result;
+  },
+  output: t
+    .object({
+      id: t.string().description("Role ID"),
+      name: t.string().description("Role name"),
+      description: t.string().description("Role description"),
+    })
+    .description("Created role"),
+});