@techelusive/nest-auth 0.0.0-stage → 0.2.0

package/dist/features/organizations/organizations.dto.js

@@ -0,0 +1,100 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SwitchOrganizationInput = exports.AcceptInvitationInput = exports.ChangeMemberRoleInput = exports.InviteMemberInput = exports.UpdateOrganizationInput = exports.CreateOrganizationInput = void 0;
+const class_validator_1 = require("class-validator");
+const constants_1 = require("../../constants.js");
+/** POST /auth/organizations */
+class CreateOrganizationInput {
+    name;
+    /** Unique handle: lowercase letters, digits and dashes, e.g. "acme-india". */
+    slug;
+}
+exports.CreateOrganizationInput = CreateOrganizationInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.ORGANIZATION_NAME_MAX_LENGTH),
+    __metadata("design:type", String)
+], CreateOrganizationInput.prototype, "name", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Matches)(constants_1.ORGANIZATION_SLUG_PATTERN),
+    __metadata("design:type", String)
+], CreateOrganizationInput.prototype, "slug", void 0);
+/** PATCH /auth/organizations/:organizationId */
+class UpdateOrganizationInput {
+    name;
+    slug;
+    metadata;
+}
+exports.UpdateOrganizationInput = UpdateOrganizationInput;
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.ORGANIZATION_NAME_MAX_LENGTH),
+    __metadata("design:type", String)
+], UpdateOrganizationInput.prototype, "name", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.Matches)(constants_1.ORGANIZATION_SLUG_PATTERN),
+    __metadata("design:type", String)
+], UpdateOrganizationInput.prototype, "slug", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsObject)(),
+    __metadata("design:type", Object)
+], UpdateOrganizationInput.prototype, "metadata", void 0);
+/** POST /auth/organizations/:organizationId/invitations */
+class InviteMemberInput {
+    email;
+    role;
+}
+exports.InviteMemberInput = InviteMemberInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.EMAIL_MAX_LENGTH),
+    __metadata("design:type", String)
+], InviteMemberInput.prototype, "email", void 0);
+__decorate([
+    (0, class_validator_1.IsIn)(constants_1.ORGANIZATION_ROLES),
+    __metadata("design:type", String)
+], InviteMemberInput.prototype, "role", void 0);
+/** PATCH /auth/organizations/:organizationId/members/:userId */
+class ChangeMemberRoleInput {
+    role;
+}
+exports.ChangeMemberRoleInput = ChangeMemberRoleInput;
+__decorate([
+    (0, class_validator_1.IsIn)(constants_1.ORGANIZATION_ROLES),
+    __metadata("design:type", String)
+], ChangeMemberRoleInput.prototype, "role", void 0);
+/** POST /auth/organizations/invitations/accept */
+class AcceptInvitationInput {
+    token;
+}
+exports.AcceptInvitationInput = AcceptInvitationInput;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.MaxLength)(constants_1.RANDOM_TOKEN_INPUT_MAX_LENGTH),
+    __metadata("design:type", String)
+], AcceptInvitationInput.prototype, "token", void 0);
+/** POST /auth/organizations/switch. Send null to work outside any organization. */
+class SwitchOrganizationInput {
+    organizationId;
+}
+exports.SwitchOrganizationInput = SwitchOrganizationInput;
+__decorate([
+    (0, class_validator_1.ValidateIf)((input) => input.organizationId !== null),
+    (0, class_validator_1.IsUUID)(),
+    __metadata("design:type", Object)
+], SwitchOrganizationInput.prototype, "organizationId", void 0);
+//# sourceMappingURL=organizations.dto.js.map

package/dist/features/organizations/organizations.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.dto.js","sourceRoot":"","sources":["../../../src/features/organizations/organizations.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAA+G;AAC/G,2CAOqB;AAGrB,+BAA+B;AAC/B,MAAa,uBAAuB;IAElC,IAAI,CAAS;IAEb,8EAA8E;IAE9E,IAAI,CAAS;CACd;AAPD,0DAOC;AALC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,wCAA4B,CAAC;;qDACvC;AAIb;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,yBAAO,EAAC,qCAAyB,CAAC;;qDAClC;AAGf,gDAAgD;AAChD,MAAa,uBAAuB;IAElC,IAAI,CAAU;IAGd,IAAI,CAAU;IAGd,QAAQ,CAAc;CACvB;AATD,0DASC;AAPC;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,wCAA4B,CAAC;;qDACpD;AAGd;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,0BAAQ,GAAE;IAAE,IAAA,yBAAO,EAAC,qCAAyB,CAAC;;qDAC/C;AAGd;IADC,IAAA,4BAAU,GAAE;IAAE,IAAA,0BAAQ,GAAE;;yDACH;AAGxB,2DAA2D;AAC3D,MAAa,iBAAiB;IAE5B,KAAK,CAAS;IAGd,IAAI,CAAmB;CACxB;AAND,8CAMC;AAJC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,4BAAgB,CAAC;;gDAC1B;AAGd;IADC,IAAA,sBAAI,EAAC,8BAAkB,CAAC;;+CACF;AAGzB,gEAAgE;AAChE,MAAa,qBAAqB;IAEhC,IAAI,CAAmB;CACxB;AAHD,sDAGC;AADC;IADC,IAAA,sBAAI,EAAC,8BAAkB,CAAC;;mDACF;AAGzB,kDAAkD;AAClD,MAAa,qBAAqB;IAEhC,KAAK,CAAS;CACf;AAHD,sDAGC;AADC;IADC,IAAA,0BAAQ,GAAE;IAAE,IAAA,2BAAS,EAAC,yCAA6B,CAAC;;oDACvC;AAGhB,mFAAmF;AACnF,MAAa,uBAAuB;IAGlC,cAAc,CAAgB;CAC/B;AAJD,0DAIC;AADC;IAFC,IAAA,4BAAU,EAAC,CAAC,KAA8B,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,CAAC;IAC7E,IAAA,wBAAM,GAAE;;+DACqB"}

package/dist/features/organizations/organizations.service.d.ts

@@ -0,0 +1,274 @@
+import { AuthOptions } from '../../auth-options.js';
+import { RequestContext } from '../../common/request-context.js';
+import { OrganizationRole } from '../../constants.js';
+import { OrganizationEntity } from '../../database/entities/index.js';
+import { AuthEventsService } from '../events/auth-events.service.js';
+import { NotificationsService } from '../notifications/notifications.service.js';
+import { SessionService } from '../sessions/session.service.js';
+import { SettingsService } from '../settings/settings.service.js';
+import type { JsonObject } from '../../database/entities/json-object.js';
+export interface OrganizationChanges {
+    name?: string;
+    slug?: string;
+    metadata?: JsonObject;
+}
+/**
+ * Organizations (companies, teams, workspaces) and their members.
+ *
+ * Roles inside an organization:
+ *   owner  - everything, including deleting the organization and managing other owners
+ *   admin  - manage members and invitations (but not owners)
+ *   member - belongs to the organization
+ *
+ * A user picks the organization they are working in with switchActiveOrganization(); their access
+ * token then carries "org_id" and "org_role", so your API can scope data with one check.
+ */
+export declare class OrganizationsService {
+    private readonly settingsService;
+    private readonly sessions;
+    private readonly notifications;
+    private readonly events;
+    private readonly database;
+    constructor(options: AuthOptions, settingsService: SettingsService, sessions: SessionService, notifications: NotificationsService, events: AuthEventsService);
+    /**
+     * Creates an organization; the creator becomes its owner.
+     *
+     * @param userId - The creator.
+     * @param details - Name and URL-friendly slug.
+     * @param isAppAdmin - Lets app admins create one even when users may not.
+     * @param request - Who is asking (for the audit log).
+     * @returns The new organization.
+     * @throws AuthError FORBIDDEN when users may not create organizations.
+     * @throws AuthError ORGANIZATION_SLUG_TAKEN when the slug is in use.
+     * @throws AuthError VALIDATION_ERROR when the user is already in too many organizations.
+     */
+    createOrganization(userId: string, details: Required<Pick<OrganizationChanges, 'name' | 'slug'>>, isAppAdmin: boolean, request: RequestContext): Promise<{
+        name: string;
+        slug: string;
+        metadata: {};
+        createdByUserId: string;
+    } & OrganizationEntity>;
+    /**
+     * The organizations the user belongs to, with their role in each.
+     *
+     * @param userId - The signed-in user.
+     * @returns The organizations, sorted by name.
+     */
+    listMyOrganizations(userId: string): Promise<{
+        id: any;
+        name: any;
+        slug: any;
+        metadata: any;
+        role: OrganizationRole;
+        joinedAt: string;
+    }[]>;
+    /**
+     * @param organizationId - The organization.
+     * @param userId - The signed-in user, who must be a member.
+     * @returns The organization plus `myRole`.
+     * @throws AuthError NOT_FOUND when it doesn't exist or the user isn't a member.
+     */
+    getOrganization(organizationId: string, userId: string): Promise<{
+        myRole: OrganizationRole;
+        id: string;
+        name: string;
+        slug: string;
+        metadata: JsonObject;
+        createdByUserId: string | null;
+        createdAt: Date;
+        updatedAt: Date;
+    }>;
+    /**
+     * Changes the name, slug or metadata. Admins and owners only.
+     *
+     * @param organizationId - The organization.
+     * @param userId - The signed-in user.
+     * @param changes - The fields to change.
+     * @param request - Who is asking (for the audit log).
+     * @returns The updated organization.
+     * @throws AuthError FORBIDDEN for plain members.
+     * @throws AuthError ORGANIZATION_SLUG_TAKEN when the new slug is in use.
+     */
+    updateOrganization(organizationId: string, userId: string, changes: OrganizationChanges, request: RequestContext): Promise<OrganizationEntity>;
+    /**
+     * Deletes the organization. Owners only. Members, invitations and API keys of the organization go with it.
+     *
+     * @param organizationId - The organization.
+     * @param userId - The signed-in user.
+     * @param request - Who is asking (for the audit log).
+     * @returns `{ success: true }`.
+     * @throws AuthError FORBIDDEN unless the user is an owner.
+     */
+    deleteOrganization(organizationId: string, userId: string, request: RequestContext): Promise<{
+        success: true;
+    }>;
+    /**
+     * @param organizationId - The organization.
+     * @param userId - The signed-in user, who must be a member.
+     * @returns The members with their names, emails and roles, oldest first.
+     */
+    listMembers(organizationId: string, userId: string): Promise<{
+        userId: any;
+        email: any;
+        firstName: any;
+        lastName: any;
+        role: OrganizationRole;
+        joinedAt: string;
+    }[]>;
+    /**
+     * Changes a member's role. Admins manage members and admins; only owners can make or unmake owners.
+     *
+     * @param organizationId - The organization.
+     * @param actorUserId - The signed-in user doing it.
+     * @param targetUserId - The member whose role changes.
+     * @param newRole - "owner", "admin" or "member".
+     * @param request - Who is asking (for the audit log).
+     * @returns `{ success: true }`.
+     * @throws AuthError FORBIDDEN when the actor may not make this change.
+     * @throws AuthError LAST_OWNER when this would leave the organization without an owner.
+     */
+    changeMemberRole(organizationId: string, actorUserId: string, targetUserId: string, newRole: OrganizationRole, request: RequestContext): Promise<{
+        success: true;
+    }>;
+    /**
+     * Removes a member. Anyone may leave by removing themselves (unless they are the last owner).
+     * The member's devices stop working in this organization.
+     *
+     * @param organizationId - The organization.
+     * @param actorUserId - The signed-in user doing it.
+     * @param targetUserId - The member to remove (the actor themselves to leave).
+     * @param request - Who is asking (for the audit log).
+     * @returns `{ success: true }`.
+     * @throws AuthError FORBIDDEN when the actor may not remove this member.
+     * @throws AuthError LAST_OWNER when removing the last owner.
+     */
+    removeMember(organizationId: string, actorUserId: string, targetUserId: string, request: RequestContext): Promise<{
+        success: true;
+    }>;
+    /**
+     * Emails an invitation link. The invited person accepts it after signing in with that email.
+     * A new invitation replaces any open one for the same email.
+     *
+     * @param organizationId - The organization.
+     * @param actorUserId - The signed-in user doing it.
+     * @param typedEmail - Who to invite.
+     * @param role - The role they get when they accept.
+     * @param request - Who is asking (for the audit log).
+     * @returns `{ success: true }`.
+     * @throws AuthError FORBIDDEN for plain members, or when an admin tries to invite an owner.
+     */
+    inviteMember(organizationId: string, actorUserId: string, typedEmail: unknown, role: OrganizationRole, request: RequestContext): Promise<{
+        success: true;
+    }>;
+    /**
+     * @param organizationId - The organization.
+     * @param actorUserId - The signed-in user, who must be an admin or owner.
+     * @returns Open invitations (not accepted or revoked), newest first, without their token hashes.
+     */
+    listInvitations(organizationId: string, actorUserId: string): Promise<{
+        id: string;
+        organizationId: string;
+        email: string;
+        role: OrganizationRole;
+        invitedByUserId: string;
+        expiresAt: Date;
+        acceptedAt: Date | null;
+        revokedAt: Date | null;
+        createdAt: Date;
+    }[]>;
+    /**
+     * Cancels an open invitation; its link stops working.
+     *
+     * @param organizationId - The organization.
+     * @param actorUserId - The signed-in user doing it.
+     * @param invitationId - The invitation.
+     * @returns `{ success: true }`.
+     * @throws AuthError NOT_FOUND when there is no open invitation with this id.
+     */
+    revokeInvitation(organizationId: string, actorUserId: string, invitationId: string): Promise<{
+        success: true;
+    }>;
+    /**
+     * Accepts an invitation. The signed-in user's VERIFIED email must be the invited email, so a
+     * forwarded or leaked link can't be used by someone else.
+     *
+     * @param userId - The signed-in user.
+     * @param invitationToken - The token from the invitation link.
+     * @param request - Who is asking (for the audit log).
+     * @returns The organization joined and the role given.
+     * @throws AuthError INVALID_TOKEN when the link is unknown, used, expired or for another email.
+     * @throws AuthError ALREADY_MEMBER when the user is already in the organization.
+     */
+    acceptInvitation(userId: string, invitationToken: unknown, request: RequestContext): Promise<{
+        success: true;
+        organizationId: string;
+        role: OrganizationRole;
+    }>;
+    /**
+     * Picks the organization this device works in. The new access token carries "org_id" and "org_role".
+     *
+     * @param userId - The signed-in user.
+     * @param sessionId - This device's session.
+     * @param organizationId - The organization to switch to, or null for none.
+     * @returns A new access token and its lifetime.
+     * @throws AuthError NOT_FOUND when the user isn't a member of that organization.
+     */
+    switchActiveOrganization(userId: string, sessionId: string, organizationId: string | null): Promise<{
+        success: true;
+        accessToken: string;
+        expiresIn: number;
+        organizationId: string | null;
+    }>;
+    /**
+     * @returns The current settings.
+     * @throws AuthError FEATURE_DISABLED when organizations are turned off.
+     */
+    private assertOrganizationsEnabled;
+    /**
+     * @param organizationId - The organization.
+     * @param userId - The user.
+     * @returns The membership row, or null if the user isn't a member.
+     */
+    private findMembership;
+    /**
+     * Checks that the user is a member with at least `minimumRole` (owner > admin > member).
+     *
+     * @param organizationId - The organization.
+     * @param userId - The user.
+     * @param minimumRole - The lowest role allowed.
+     * @returns The user's membership.
+     * @throws AuthError NOT_FOUND when the user is not a member (so outsiders can't probe which organizations exist).
+     * @throws AuthError FORBIDDEN when their role is too low.
+     */
+    private requireRole;
+    /**
+     * Admins may act on members and admins; anything touching an owner needs an owner.
+     *
+     * @param actorRole - The role of the user making the change.
+     * @param currentRole - The target's role now.
+     * @param newRole - The target's role after the change.
+     * @throws AuthError FORBIDDEN when the actor may not make this change.
+     */
+    private assertMayManage;
+    /**
+     * @param organizationId - The organization.
+     * @throws AuthError LAST_OWNER when the organization has only one owner left.
+     */
+    private assertNotLastOwner;
+    /**
+     * A removed member's devices stop working in that organization.
+     *
+     * @param userId - The removed member.
+     * @param organizationId - The organization they left.
+     */
+    private clearActiveOrganization;
+    /**
+     * Runs a database write and turns a "duplicate value" error into a friendly AuthError.
+     *
+     * @param operation - The write to wait for.
+     * @param errorOnDuplicate - The error to throw when Postgres refuses a duplicate.
+     * @returns What the write returned.
+     * @throws AuthError `errorOnDuplicate` on a duplicate; any other error is re-thrown as is.
+     */
+    private translateUniqueViolation;
+}