@things-factory/auth-base 10.0.0-zeta.8 → 10.0.3

package/dist-server/service/index.d.ts

@@ -25,7 +25,7 @@ export * from './privilege/privilege-types.js';
 export * from './role/role-types.js';
 export * from './user/user-types.js';
 export * from './domain-link/domain-link-types.js';
-export declare const entities: (typeof import("./web-auth-credential/web-auth-credential.js").WebAuthCredential | typeof import("./user/user.js").User | typeof import("./auth-provider/auth-provider.js").AuthProvider | typeof import("./users-auth-providers/users-auth-providers.js").UsersAuthProviders | typeof import("./role/role.js").Role | typeof import("./privilege/privilege.js").Privilege | typeof import("./domain-owner/domain-owner.js").DomainOwner | typeof import("./verification-token/verification-token.js").VerificationToken | typeof import("./verification-token/verification-token.js").VerificationTokenType | typeof import("./password-history/password-history.js").PasswordHistory | typeof import("./invitation/invitation.js").Invitation | typeof import("./application/application.js").Application | typeof import("./login-history/login-history.js").LoginHistory | typeof import("./appliance/appliance.js").Appliance | typeof import("./granted-role/granted-role.js").GrantedRole | typeof import("./partner/partner.js").Partner | typeof import("./domain-link/domain-link.js").DomainLink)[];
+export declare const entities: (typeof import("./web-auth-credential/web-auth-credential.js").WebAuthCredential | typeof import("./user/user.js").User | typeof import("./auth-provider/auth-provider.js").AuthProvider | typeof import("./users-auth-providers/users-auth-providers.js").UsersAuthProviders | typeof import("./domain-owner/domain-owner.js").DomainOwner | typeof import("./granted-role/granted-role.js").GrantedRole | typeof import("./role/role.js").Role | typeof import("./privilege/privilege.js").Privilege | typeof import("./verification-token/verification-token.js").VerificationToken | typeof import("./verification-token/verification-token.js").VerificationTokenType | typeof import("./password-history/password-history.js").PasswordHistory | typeof import("./invitation/invitation.js").Invitation | typeof import("./application/application.js").Application | typeof import("./login-history/login-history.js").LoginHistory | typeof import("./appliance/appliance.js").Appliance | typeof import("./partner/partner.js").Partner | typeof import("./domain-link/domain-link.js").DomainLink)[];
 export declare const schema: {
     typeDefs: {
         privilegeDirectiveTypeDefs: import("graphql").DocumentNode;

package/dist-server/service/user/user-mutation.js

@@ -9,6 +9,7 @@ const env_1 = require("@things-factory/env");
 const shell_1 = require("@things-factory/shell");
 const delete_user_js_1 = require("../../controllers/delete-user.js");
 const get_domain_users_js_1 = require("../../utils/get-domain-users.js");
+const domain_ownership_js_1 = require("../../utils/domain-ownership.js");
 const role_js_1 = require("../role/role.js");
 const user_js_1 = require("./user.js");
 const user_types_js_1 = require("./user-types.js");
@@ -213,7 +214,7 @@ let UserMutation = class UserMutation {
         return true;
     }
     async transferOwner(username, context) {
-        const { domain, tx } = context.state;
+        const { domain, tx, user: actor } = context.state;
         const userRepository = (0, shell_1.getRepository)(user_js_1.User, tx);
         var user = await userRepository.findOne({
             where: { username },
@@ -234,11 +235,13 @@ let UserMutation = class UserMutation {
         if (user.domains.map((d) => d.id).indexOf(domain.id) < 0) {
             throw new Error(`User is not belongs to current domain`);
         }
-        if (user.roles.filter((r) => r.domainId == domain.id).length == 0) {
+        /* 역할은 부모 도메인으로부터 상속될 수 있으므로 부여된 상속 역할도 자격으로 인정한다. */
+        const grantableRoleDomainIds = [domain.id, domain.parentId].filter(Boolean);
+        if (user.roles.filter((r) => grantableRoleDomainIds.includes(r.domainId)).length == 0) {
             throw new Error(`Only users with at least one role in this domain are eligible to receive admin privileges.`);
         }
-        domain.owner = user.id;
-        await (0, shell_1.getRepository)(shell_1.Domain, tx).save(domain);
+        /* 대표 오너 컬럼과 `DomainOwner` 테이블을 함께 갱신한다 (기존 오너 엔트리는 유지). */
+        await (0, domain_ownership_js_1.setPrimaryDomainOwner)(domain, user.id, actor, tx);
         return true;
     }
     async activateUser(username, context) {
@@ -284,7 +287,8 @@ let UserMutation = class UserMutation {
         if (!targetUser?.domains?.find((userDomain) => userDomain.id === domain.id)) {
             throw new Error('User is not belong to domain');
         }
-        if (targetUser.userType == 'admin' || targetUser.id === domain.owner) {
+        /* 공동 오너(`DomainOwner` 테이블)도 도메인 관리자이므로 같은 보호를 받는다. */
+        if (targetUser.userType == 'admin' || (await (0, domain_ownership_js_1.isDomainOwner)(domain, targetUser, tx))) {
             throw new Error('Admin deactivation not allowed');
         }
         targetUser.status = user_js_1.UserStatus.INACTIVE;

package/dist-server/service/user/user-mutation.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-mutation.js","sourceRoot":"","sources":["../../../server/service/user/user-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAsE;AACtE,qDAAqD;AACrD,qCAAsE;AAEtE,6CAA4C;AAC5C,iDAAwE;AAExE,qEAAmH;AACnH,yEAA8E;AAC9E,6CAAsC;AACtC,uCAA4C;AAC5C,mDAAoD;AACpD,iEAA+G;AAGxG,IAAM,YAAY,GAAlB,MAAM,YAAY;IAOjB,AAAN,KAAK,CAAC,UAAU,CACqE,IAAa,EACzF,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAClD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;QAChC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;QAEzB,IAAI,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,uCAAuB,CAAC,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,oCAAoB,CAAC,CAAC,CAAA;QAC7D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;QAC9E,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,gCAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,mDAAmD;QACnD,6CAA6C;QAC7C,0DAA0D;QAE1D,MAAM,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;QAEhC,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC;YAC/B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC3B,GAAG,IAAI;YACP,OAAO,EAAE,CAAC,MAAM,CAAC;YACjB,KAAK,EACH,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;gBAC7B,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;oBACnC,EAAE,EAAE,IAAA,YAAE,EAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACvC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;iBAC1B,CAAC;gBACJ,CAAC,CAAC,EAAE;YACR,IAAI;YACJ,iBAAiB,EAAE,IAAI,IAAI,EAAE;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAI,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC;SAChG,CAAC,CAAA;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,UAAU,CAEd,KAAa,EACsE,KAAgB,EAC5F,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAuD,OAAO,CAAC,KAAK,CAAA;QACvG,MAAM,EAAE,GAA6B,IAAA,kDAA4B,EAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACpF,MAAM,IAAI,GAAS,MAAM,EAAE;aACxB,QAAQ,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;aACpF,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC;aACxC,iBAAiB,CAAC,cAAc,EAAE,UAAU,CAAC;aAC7C,MAAM,EAAE,CAAA;QAEX,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,CAAC,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;gBAC/C,KAAK,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;aAC/D,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,GAAG,oBAAU,CAAC,SAAS,CAAA;QACpC,CAAC;QAED,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;YACxC,GAAG,IAAI;YACP,GAAG,KAAK;YACR,OAAO;SACD,CAAC,CAAA;IACX,CAAC;IAQK,AAAN,KAAK,CAAC,kBAAkB,CAEtB,OAAoB,EACb,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAC1C,MAAM,QAAQ,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAExC,IAAI,OAAO,GAAG,EAAE,CAAA;QAChB,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAA;QACzF,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAA;QAEzF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;gBAEnC,mDAAmD;gBACnD,6CAA6C;gBAC7C,+DAA+D;gBAE/D,MAAM,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;gBAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;oBACjC,GAAI,SAAiB;oBACrB,OAAO,EAAE,CAAC,MAAM,CAAC;oBACjB,IAAI;oBACJ,QAAQ,EAAE,cAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC;oBAC/C,iBAAiB,EAAE,IAAI,IAAI,EAAE;oBAC7B,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,IAAI;iBACd,CAAC,CAAA;gBAEF,2BAA2B;gBAC3B,WAAW;gBACX,0BAA0B;gBAC1B,cAAc;gBACd,2BAA2B;gBAC3B,cAAc;gBACd,0BAA0B;gBAC1B,2BAA2B;gBAC3B,OAAO;gBACP,eAAe;gBAEf,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;gBACtC,mDAAmD;gBACnD,6CAA6C;gBAC7C,kEAAkE;gBAElE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;gBAC/F,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAEnG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;oBACjC,GAAG,IAAI;oBACP,GAAI,YAAoB;oBACxB,OAAO;oBACP,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;oBAC/F,OAAO,EAAE,IAAI;iBACd,CAAC,CAAA;gBAEF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;oBACzB,SAAQ;gBACV,CAAC;gBAED,mCAAmC;gBACnC,iBAAiB;gBACjB,aAAa;gBACb,IAAI;gBAEJ,6BAA6B;gBAC7B,qCAAqC;gBACrC,wDAAwD;gBACxD,aAAa;gBACb,4BAA4B;gBAC5B,gBAAgB;gBAChB,6BAA6B;gBAC7B,gBAAgB;gBAChB,0BAA0B;gBAC1B,6BAA6B;gBAC7B,SAAS;gBACT,iBAAiB;gBACjB,IAAI;gBAEJ,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAQK,AAAN,KAAK,CAAC,UAAU,CAC2D,QAAgB,EAClF,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE5B,MAAM,IAAA,2BAAgB,EAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAA;QAExC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,WAAW,CAC0E,SAAmB,EACrG,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAC5B,MAAM,IAAA,4BAAiB,EAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAA;QAE1C,OAAO,IAAI,CAAA;IACb,CAAC;IAOK,AAAN,KAAK,CAAC,UAAU,CACoE,QAAgB,EAC3F,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,OAAO,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACrC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,MAAM,eAAe,GAAa,OAAO,CAAC,OAAO,CAAA;QACjD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC3G,CAAC;QAED,OAAO,CAAC,OAAO,GAAG,CAAC,GAAG,eAAe,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAElC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,gBAAgB,CAC8E,QAAgB,EAC3G,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,IAAI,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,MAAM,eAAe,GAAW,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAA;QAC3G,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC9F,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAA;QAEvC,sCAAsC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC,CAAA;QAE3E,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE/B,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,aAAa,CACgF,QAAgB,EAC1G,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,IAAI,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,oBAAU,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;QACnF,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAA;QAC/G,CAAC;QAED,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAA;QACtB,MAAM,IAAA,qBAAa,EAAC,cAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAE5C,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,YAAY,CACoE,QAAgB,EAC7F,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,UAAU,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACxC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,UAAU,CAAC,SAAS,GAAG,CAAC,CAAA;QACxB,UAAU,CAAC,MAAM,GAAG,oBAAU,CAAC,SAAS,CAAA;QAExC,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAErC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,cAAc,CACoE,QAAgB,EAC/F,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,UAAU,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACxC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,IAAI,UAAU,CAAC,QAAQ,IAAI,OAAO,IAAI,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACnD,CAAC;QAED,UAAU,CAAC,MAAM,GAAG,oBAAU,CAAC,QAAQ,CAAA;QAEvC,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAErC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,sBAAsB,CACsE,QAAgB,EACzG,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEpC,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAClD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAC9C,CAAC;QAED,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,UAAU,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACxC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,UAAU,CAAC,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;QACrC,UAAU,CAAC,QAAQ,GAAG,cAAI,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,CAAA;QAEnE,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAErC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,eAAe,CAC2E,QAAgB,EAE9G,cAA2B,EAE3B,aAA0B,EACnB,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,IAAI,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,gBAAgB,GAAa,cAAc,CAAC,GAAG,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACxE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAuB,CAAC,CAAA;QAEvD,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxC,CAAC;CACF,CAAA;AAxhBY,oCAAY;AAOjB;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE;QACzB,WAAW,EACT,+HAA+H;KAClI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,MAAM,EAAE,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC,CAAA;IACjF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CADmF,uBAAO;;8CAkDjG;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE;QACzB,WAAW,EACT,+HAA+H;KAClI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,qCAAmB,EAAE,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC,CAAA;IAEtG,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC,CAAA;IACjF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;qDADoF,yBAAS;;8CA0BpG;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAI,CAAC,EAAE;QAC3B,WAAW,EACT,kHAAkH;KACrH,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,yBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC,CAAA;IAE/G,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;sDAyFP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,mIAAmI;KACtI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC,CAAA;IACvE,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;8CAOP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,uHAAuH;KAC1H,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACvF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;+CAMP;AAOK;IALL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,uIAAuI;KAC1I,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC,CAAA;IAChF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;8CA8BP;AAQK;IANL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,0IAA0I;KAC7I,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC,CAAA;IAChG,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;oDAmCP;AAQK;IANL,IAAA,wBAAS,EAAC,8DAA8D,CAAC;IACzE,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,+HAA+H;KAClI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,6DAA6D,EAAE,CAAC,CAAA;IAC/F,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;iDAqCP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,iHAAiH;KACpH,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC,CAAA;IAClF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;gDA+BP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,sHAAsH;KACzH,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC,CAAA;IACpF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;kDAkCP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,gIAAgI;KACnI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,4DAA4D,EAAE,CAAC,CAAA;IAC9F,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0DAqCP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE;QACzB,WAAW,EACT,2GAA2G;KAC9G,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC,CAAA;IAC5F,mBAAA,IAAA,kBAAG,EAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,iBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC,CAAA;IAElH,mBAAA,IAAA,kBAAG,EAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,iBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC,CAAA;IAE3G,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;mDA8BP;uBAvhBU,YAAY;IADxB,IAAA,uBAAQ,EAAC,cAAI,CAAC;GACF,YAAY,CAwhBxB","sourcesContent":["import { Arg, Ctx, Directive, Mutation, Resolver } from 'type-graphql'\nimport { GraphQLEmailAddress } from 'graphql-scalars'\nimport { ILike, In, SelectQueryBuilder, EntityManager } from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { Domain, getRepository, ObjectRef } from '@things-factory/shell'\n\nimport { deleteUser as commonDeleteUser, deleteUsers as commonDeleteUsers } from '../../controllers/delete-user.js'\nimport { buildDomainUsersQueryBuilder } from '../../utils/get-domain-users.js'\nimport { Role } from '../role/role.js'\nimport { User, UserStatus } from './user.js'\nimport { NewUser, UserPatch } from './user-types.js'\nimport { USERNAME_ALREADY_EXISTS, EMAIL_ALREADY_EXISTS, USERNAME_INVALID } from '../../constants/error-code.js'\n\n@Resolver(User)\nexport class UserMutation {\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => User, {\n    description:\n      'Creates a new user in the system. Use this mutation to register a user with the specified credentials and domain information.'\n  })\n  async createUser(\n    @Arg('user', { description: 'The input object containing new user information.' }) user: NewUser,\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, tx } = context.state\n    const { defaultPassword } = config.get('password')\n    const { username, email } = user\n    const userRepository = getRepository(User, tx)\n\n    user.username = username.trim()\n    user.email = email.trim()\n\n    if (await userRepository.findOne({ where: { username: user.username } })) {\n      throw new Error(context.t('error.' + USERNAME_ALREADY_EXISTS))\n    }\n\n    if (await userRepository.findOne({ where: { email: ILike(user.email) } })) {\n      throw new Error(context.t('error.' + EMAIL_ALREADY_EXISTS))\n    }\n\n    if (!user.password && !defaultPassword) {\n      throw new Error('initial password or default password should be supported.')\n    }\n\n    // TODO username은 다음 패턴을 따라야 한다. pattern=\"^[A-Za-z0-9._@-]+$\"\n    if (!/^[A-Za-z0-9._@-]+$/.test(user.username)) {\n      throw new Error(context.t('error.' + USERNAME_INVALID, { username: user.username }))\n    }\n\n    // consider if validation password rule is required\n    /* check if password is following the rule */\n    // User.validatePasswordByRule(user.password, context.lng)\n\n    const salt = User.generateSalt()\n\n    return await userRepository.save({\n      creator: context.state.user,\n      updater: context.state.user,\n      ...user,\n      domains: [domain],\n      roles:\n        user.roles && user.roles.length\n          ? await getRepository(Role, tx).findBy({\n              id: In(user.roles.map(role => role.id)),\n              domain: { id: domain.id }\n            })\n          : [],\n      salt,\n      passwordUpdatedAt: new Date(),\n      password: user.password ? User.encode(user.password, salt) : User.encode(defaultPassword, salt)\n    })\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => User, {\n    description:\n      'Updates the information of an existing user. Use this mutation to modify user profile details, such as name, email, or roles.'\n  })\n  async updateUser(\n    @Arg('email', type => GraphQLEmailAddress, { description: 'The email address of the user to update.' })\n    email: string,\n    @Arg('patch', { description: 'The patch object containing updated user fields.' }) patch: UserPatch,\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, user: updater, tx }: { domain: Domain; user: User; tx?: EntityManager } = context.state\n    const qb: SelectQueryBuilder<User> = buildDomainUsersQueryBuilder(domain.id, 'USER')\n    const user: User = await qb\n      .andWhere('LOWER(USER.email) = :email', { email: email?.toLowerCase().trim() || '' })\n      .leftJoinAndSelect('USER.roles', 'ROLES')\n      .leftJoinAndSelect('ROLES.domain', 'R_DOMAIN')\n      .getOne()\n\n    if (patch.roles) {\n      patch.roles = await getRepository(Role, tx).find({\n        where: { id: In(patch.roles.map((r: Partial<Role>) => r.id)) }\n      })\n    }\n\n    if (patch.status && patch.status === 'activated') {\n      user.status = UserStatus.ACTIVATED\n    }\n\n    return await getRepository(User, tx).save({\n      ...user,\n      ...patch,\n      updater\n    } as any)\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => [User], {\n    description:\n      'Updates or creates multiple users in a single operation. Use this mutation for batch processing of user records.'\n  })\n  async updateMultipleUser(\n    @Arg('patches', type => [UserPatch], { description: 'An array of patch objects for batch update or creation.' })\n    patches: UserPatch[],\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, user, tx } = context.state\n    const userRepo = getRepository(User, tx)\n\n    let results = []\n    const _createRecords = patches.filter((patch: any) => patch.cuFlag.toUpperCase() === '+')\n    const _updateRecords = patches.filter((patch: any) => patch.cuFlag.toUpperCase() === 'M')\n\n    if (_createRecords.length > 0) {\n      for (let i = 0; i < _createRecords.length; i++) {\n        const newRecord = _createRecords[i]\n\n        // consider if validation password rule is required\n        /* check if password is following the rule */\n        // User.validatePasswordByRule(newRecord.password, context.lng)\n\n        const salt = User.generateSalt()\n        const result = await userRepo.save({\n          ...(newRecord as any),\n          domains: [domain],\n          salt,\n          password: User.encode(newRecord.password, salt),\n          passwordUpdatedAt: new Date(),\n          creator: user,\n          updater: user\n        })\n\n        // repository api는 작동하지 않음.\n        // await tx\n        //   .createQueryBuilder()\n        //   .insert()\n        //   .into('users_domains')\n        //   .values({\n        //     usersId: result.id,\n        //     domainsId: domain.id\n        //   })\n        //   .execute()\n\n        results.push({ ...result, cuFlag: '+' })\n      }\n    }\n\n    if (_updateRecords.length > 0) {\n      for (let i = 0; i < _updateRecords.length; i++) {\n        const updateRecord = _updateRecords[i]\n        // consider if validation password rule is required\n        /* check if password is following the rule */\n        // User.validatePasswordByRule(updateRecord.password, context.lng)\n\n        const user = await userRepo.findOne({ where: { id: updateRecord.id }, relations: ['domains'] })\n        var domains = user.domains.find(d => d.id === domain.id) ? user.domains : [...user.domains, domain]\n\n        const result = await userRepo.save({\n          ...user,\n          ...(updateRecord as any),\n          domains,\n          password: updateRecord.password ? User.encode(updateRecord.password, user.salt) : user.password,\n          updater: user\n        })\n\n        if (!updateRecord.status) {\n          continue\n        }\n\n        // const domain = await user.domain\n        // if (!domain) {\n        //   continue\n        // }\n\n        // const domainId = domain.id\n        // const domains = await user.domains\n        // if (!domains.find(domain => domain.id == domainId)) {\n        //   await tx\n        //     .createQueryBuilder()\n        //     .insert()\n        //     .into('users_domains')\n        //     .values({\n        //       usersId: user.id,\n        //       domainsId: domain.id\n        //     })\n        //     .execute()\n        // }\n\n        results.push({ ...result, cuFlag: 'M' })\n      }\n    }\n\n    return results\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Deletes a user from the system by their username. Use this mutation to permanently remove a user account and revoke their access.'\n  })\n  async deleteUser(\n    @Arg('username', { description: 'The username of the user to delete.' }) username: string,\n    @Ctx() context: ResolverContext\n  ) {\n    const { tx } = context.state\n\n    await commonDeleteUser({ username }, tx)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Deletes multiple users from the system by their usernames. Use this mutation to remove several user accounts at once.'\n  })\n  async deleteUsers(\n    @Arg('usernames', type => [String], { description: 'An array of usernames to delete.' }) usernames: string[],\n    @Ctx() context: ResolverContext\n  ) {\n    const { tx } = context.state\n    await commonDeleteUsers({ usernames }, tx)\n\n    return true\n  }\n\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Invites an existing user to join the current domain. Use this mutation to add a user to a domain if they already exist in the system.'\n  })\n  async inviteUser(\n    @Arg('username', { description: 'The username or email of the user to invite.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { domain, tx } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var invitee: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!invitee && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      invitee = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!invitee) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    const existingDomains: Domain[] = invitee.domains\n    if (existingDomains.find((d: Domain) => d.id === domain.id)) {\n      throw new Error(context.t('error.x already exists in y', { x: context.t('field.user'), y: domain.name }))\n    }\n\n    invitee.domains = [...existingDomains, domain]\n    await userRepository.save(invitee)\n\n    return true\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Mutation(returns => Boolean, {\n    description:\n      \"Removes a user from the current domain. Use this mutation to revoke a user's access to a specific domain without deleting their account.\"\n  })\n  async deleteDomainUser(\n    @Arg('username', { description: 'The username or email of the user to remove from the domain.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var user: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains', 'roles']\n    })\n\n    if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      user = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains', 'roles']\n      })\n    }\n\n    if (!user) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    const targetDomainIdx: number = user.domains.findIndex((userDomain: Domain) => userDomain.id === domain.id)\n    if (targetDomainIdx < 0) {\n      throw new Error(context.t('error.x is not a member of y', { x: user.name, y: domain.name }))\n    }\n\n    // Remove domain relation with user\n    user.domains.splice(targetDomainIdx, 1)\n\n    // Remove domain's roles that user has\n    user.roles = user.roles.filter((role: Role) => role.domainId !== domain.id)\n\n    await userRepository.save(user)\n\n    return true\n  }\n\n  @Directive('@privilege(domainOwnerGranted: true, superUserGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Transfers domain ownership to another user. Use this mutation to assign the owner role to a different user within the domain.'\n  })\n  async transferOwner(\n    @Arg('username', { description: 'The username or email of the user to transfer ownership to.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { domain, tx } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var user: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains', 'roles']\n    })\n\n    if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      user = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains', 'roles']\n      })\n    }\n\n    if (!user) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (user.status !== UserStatus.ACTIVATED) {\n      throw new Error('Only activated users are eligible to receive admin privileges.')\n    }\n\n    if (user.domains.map((d: Domain) => d.id).indexOf(domain.id) < 0) {\n      throw new Error(`User is not belongs to current domain`)\n    }\n\n    if (user.roles.filter((r: Role) => r.domainId == domain.id).length == 0) {\n      throw new Error(`Only users with at least one role in this domain are eligible to receive admin privileges.`)\n    }\n\n    domain.owner = user.id\n    await getRepository(Domain, tx).save(domain)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Activates a user account in the current domain. Use this mutation to enable a user who was previously inactive.'\n  })\n  async activateUser(\n    @Arg('username', { description: 'The username or email of the user to activate.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var targetUser: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!targetUser && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      targetUser = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!targetUser) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (!targetUser?.domains?.find((userDomain: Domain) => userDomain.id === domain.id)) {\n      throw new Error('User is not belong to domain')\n    }\n\n    targetUser.failCount = 0\n    targetUser.status = UserStatus.ACTIVATED\n\n    await userRepository.save(targetUser)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Inactivates a user account in the current domain. Use this mutation to disable a user, making them unable to log in.'\n  })\n  async inactivateUser(\n    @Arg('username', { description: 'The username or email of the user to inactivate.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var targetUser: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!targetUser && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      targetUser = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!targetUser) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (!targetUser?.domains?.find((userDomain: Domain) => userDomain.id === domain.id)) {\n      throw new Error('User is not belong to domain')\n    }\n\n    if (targetUser.userType == 'admin' || targetUser.id === domain.owner) {\n      throw new Error('Admin deactivation not allowed')\n    }\n\n    targetUser.status = UserStatus.INACTIVE\n\n    await userRepository.save(targetUser)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      \"Resets a user's password to the default value. Use this mutation to restore access to a user who has forgotten their password.\"\n  })\n  async resetPasswordToDefault(\n    @Arg('username', { description: 'The username or email of the user whose password to reset.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n\n    const { defaultPassword } = config.get('password')\n    if (!defaultPassword) {\n      throw new Error('No default password found')\n    }\n\n    const userRepository = getRepository(User, tx)\n\n    var targetUser: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!targetUser && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      targetUser = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!targetUser) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (!targetUser?.domains?.find((userDomain: Domain) => userDomain.id === domain.id)) {\n      throw new Error('User is not belong to domain')\n    }\n\n    targetUser.salt = User.generateSalt()\n    targetUser.password = User.encode(defaultPassword, targetUser.salt)\n\n    await userRepository.save(targetUser)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => User, {\n    description:\n      \"Updates the roles assigned to a user. Use this mutation to change a user's permissions within the domain.\"\n  })\n  async updateUserRoles(\n    @Arg('username', { description: 'The username or email of the user whose roles to update.' }) username: string,\n    @Arg('availableRoles', type => [ObjectRef], { description: 'The list of roles that can be assigned to the user.' })\n    availableRoles: ObjectRef[],\n    @Arg('selectedRoles', type => [ObjectRef], { description: 'The list of roles to be assigned to the user.' })\n    selectedRoles: ObjectRef[],\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, tx } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var user: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains', 'roles']\n    })\n\n    if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      user = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains', 'roles']\n      })\n    }\n\n    if (!user) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (user.domains.map((d: Domain) => d.id).indexOf(domain.id) < 0) {\n      throw new Error(`User is not belongs to current domain`)\n    }\n\n    const availableRoleIds: string[] = availableRoles.map((r: Role) => r.id)\n    user.roles = user.roles.filter((r: Role) => availableRoleIds.indexOf(r.id) < 0)\n    user.roles = user.roles.concat(selectedRoles as Role[])\n\n    return await userRepository.save(user)\n  }\n}\n"]}
+{"version":3,"file":"user-mutation.js","sourceRoot":"","sources":["../../../server/service/user/user-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAsE;AACtE,qDAAqD;AACrD,qCAAsE;AAEtE,6CAA4C;AAC5C,iDAAwE;AAExE,qEAAmH;AACnH,yEAA8E;AAC9E,yEAAsF;AACtF,6CAAsC;AACtC,uCAA4C;AAC5C,mDAAoD;AACpD,iEAA+G;AAGxG,IAAM,YAAY,GAAlB,MAAM,YAAY;IAOjB,AAAN,KAAK,CAAC,UAAU,CACqE,IAAa,EACzF,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAClD,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;QAChC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;QAEzB,IAAI,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,uCAAuB,CAAC,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,oCAAoB,CAAC,CAAC,CAAA;QAC7D,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;QAC9E,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,GAAG,gCAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,mDAAmD;QACnD,6CAA6C;QAC7C,0DAA0D;QAE1D,MAAM,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;QAEhC,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC;YAC/B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC3B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC3B,GAAG,IAAI;YACP,OAAO,EAAE,CAAC,MAAM,CAAC;YACjB,KAAK,EACH,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM;gBAC7B,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;oBACnC,EAAE,EAAE,IAAA,YAAE,EAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACvC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;iBAC1B,CAAC;gBACJ,CAAC,CAAC,EAAE;YACR,IAAI;YACJ,iBAAiB,EAAE,IAAI,IAAI,EAAE;YAC7B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAI,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC;SAChG,CAAC,CAAA;IACJ,CAAC;IAQK,AAAN,KAAK,CAAC,UAAU,CAEd,KAAa,EACsE,KAAgB,EAC5F,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAuD,OAAO,CAAC,KAAK,CAAA;QACvG,MAAM,EAAE,GAA6B,IAAA,kDAA4B,EAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACpF,MAAM,IAAI,GAAS,MAAM,EAAE;aACxB,QAAQ,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC;aACpF,iBAAiB,CAAC,YAAY,EAAE,OAAO,CAAC;aACxC,iBAAiB,CAAC,cAAc,EAAE,UAAU,CAAC;aAC7C,MAAM,EAAE,CAAA;QAEX,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,CAAC,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;gBAC/C,KAAK,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAgB,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;aAC/D,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACjD,IAAI,CAAC,MAAM,GAAG,oBAAU,CAAC,SAAS,CAAA;QACpC,CAAC;QAED,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;YACxC,GAAG,IAAI;YACP,GAAG,KAAK;YACR,OAAO;SACD,CAAC,CAAA;IACX,CAAC;IAQK,AAAN,KAAK,CAAC,kBAAkB,CAEtB,OAAoB,EACb,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAC1C,MAAM,QAAQ,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAExC,IAAI,OAAO,GAAG,EAAE,CAAA;QAChB,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAA;QACzF,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAA;QAEzF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;gBAEnC,mDAAmD;gBACnD,6CAA6C;gBAC7C,+DAA+D;gBAE/D,MAAM,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;gBAChC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;oBACjC,GAAI,SAAiB;oBACrB,OAAO,EAAE,CAAC,MAAM,CAAC;oBACjB,IAAI;oBACJ,QAAQ,EAAE,cAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC;oBAC/C,iBAAiB,EAAE,IAAI,IAAI,EAAE;oBAC7B,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,IAAI;iBACd,CAAC,CAAA;gBAEF,2BAA2B;gBAC3B,WAAW;gBACX,0BAA0B;gBAC1B,cAAc;gBACd,2BAA2B;gBAC3B,cAAc;gBACd,0BAA0B;gBAC1B,2BAA2B;gBAC3B,OAAO;gBACP,eAAe;gBAEf,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;gBACtC,mDAAmD;gBACnD,6CAA6C;gBAC7C,kEAAkE;gBAElE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;gBAC/F,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAEnG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;oBACjC,GAAG,IAAI;oBACP,GAAI,YAAoB;oBACxB,OAAO;oBACP,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ;oBAC/F,OAAO,EAAE,IAAI;iBACd,CAAC,CAAA;gBAEF,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;oBACzB,SAAQ;gBACV,CAAC;gBAED,mCAAmC;gBACnC,iBAAiB;gBACjB,aAAa;gBACb,IAAI;gBAEJ,6BAA6B;gBAC7B,qCAAqC;gBACrC,wDAAwD;gBACxD,aAAa;gBACb,4BAA4B;gBAC5B,gBAAgB;gBAChB,6BAA6B;gBAC7B,gBAAgB;gBAChB,0BAA0B;gBAC1B,6BAA6B;gBAC7B,SAAS;gBACT,iBAAiB;gBACjB,IAAI;gBAEJ,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAQK,AAAN,KAAK,CAAC,UAAU,CAC2D,QAAgB,EAClF,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE5B,MAAM,IAAA,2BAAgB,EAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAA;QAExC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,WAAW,CAC0E,SAAmB,EACrG,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAC5B,MAAM,IAAA,4BAAiB,EAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAA;QAE1C,OAAO,IAAI,CAAA;IACb,CAAC;IAOK,AAAN,KAAK,CAAC,UAAU,CACoE,QAAgB,EAC3F,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,OAAO,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACrC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,MAAM,eAAe,GAAa,OAAO,CAAC,OAAO,CAAA;QACjD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,6BAA6B,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC3G,CAAC;QAED,OAAO,CAAC,OAAO,GAAG,CAAC,GAAG,eAAe,EAAE,MAAM,CAAC,CAAA;QAC9C,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAElC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,gBAAgB,CAC8E,QAAgB,EAC3G,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,IAAI,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,MAAM,eAAe,GAAW,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAA;QAC3G,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC9F,CAAC;QAED,mCAAmC;QACnC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAA;QAEvC,sCAAsC;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC,CAAA;QAE3E,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE/B,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,aAAa,CACgF,QAAgB,EAC1G,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACjD,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,IAAI,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,oBAAU,CAAC,SAAS,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;QACnF,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QAED,qDAAqD;QACrD,MAAM,sBAAsB,GAAa,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACrF,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAA;QAC/G,CAAC;QAED,2DAA2D;QAC3D,MAAM,IAAA,2CAAqB,EAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAA;QAEvD,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,YAAY,CACoE,QAAgB,EAC7F,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,UAAU,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACxC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,UAAU,CAAC,SAAS,GAAG,CAAC,CAAA;QACxB,UAAU,CAAC,MAAM,GAAG,oBAAU,CAAC,SAAS,CAAA;QAExC,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAErC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,cAAc,CACoE,QAAgB,EAC/F,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,UAAU,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACxC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,sDAAsD;QACtD,IAAI,UAAU,CAAC,QAAQ,IAAI,OAAO,IAAI,CAAC,MAAM,IAAA,mCAAa,EAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACnD,CAAC;QAED,UAAU,CAAC,MAAM,GAAG,oBAAU,CAAC,QAAQ,CAAA;QAEvC,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAErC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,sBAAsB,CACsE,QAAgB,EACzG,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEpC,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAClD,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAA;QAC9C,CAAC;QAED,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,UAAU,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAClD,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,UAAU,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBACxC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,CAAC;aACvB,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,UAAkB,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;QACjD,CAAC;QAED,UAAU,CAAC,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;QACrC,UAAU,CAAC,QAAQ,GAAG,cAAI,CAAC,MAAM,CAAC,eAAe,EAAE,UAAU,CAAC,IAAI,CAAC,CAAA;QAEnE,MAAM,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAErC,OAAO,IAAI,CAAA;IACb,CAAC;IAQK,AAAN,KAAK,CAAC,eAAe,CAC2E,QAAgB,EAE9G,cAA2B,EAE3B,aAA0B,EACnB,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACpC,MAAM,cAAc,GAAG,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAA;QAE9C,IAAI,IAAI,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,QAAQ,EAAE;YACnB,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;SAChC,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzD,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC,EAAE;gBACjC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,CAAC,CAAA;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB,EAAE,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;QACtF,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;QAED,MAAM,gBAAgB,GAAa,cAAc,CAAC,GAAG,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACxE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;QAC/E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,aAAuB,CAAC,CAAA;QAEvD,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACxC,CAAC;CACF,CAAA;AA3hBY,oCAAY;AAOjB;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE;QACzB,WAAW,EACT,+HAA+H;KAClI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,MAAM,EAAE,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC,CAAA;IACjF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CADmF,uBAAO;;8CAkDjG;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE;QACzB,WAAW,EACT,+HAA+H;KAClI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,qCAAmB,EAAE,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC,CAAA;IAEtG,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC,CAAA;IACjF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;qDADoF,yBAAS;;8CA0BpG;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAI,CAAC,EAAE;QAC3B,WAAW,EACT,kHAAkH;KACrH,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,yBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC,CAAA;IAE/G,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;sDAyFP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,mIAAmI;KACtI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC,CAAA;IACvE,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;8CAOP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,uHAAuH;KAC1H,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACvF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;+CAMP;AAOK;IALL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,uIAAuI;KAC1I,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC,CAAA;IAChF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;8CA8BP;AAQK;IANL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,0IAA0I;KAC7I,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC,CAAA;IAChG,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;oDAmCP;AAQK;IANL,IAAA,wBAAS,EAAC,8DAA8D,CAAC;IACzE,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,+HAA+H;KAClI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,6DAA6D,EAAE,CAAC,CAAA;IAC/F,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;iDAuCP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,iHAAiH;KACpH,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC,CAAA;IAClF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;gDA+BP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,sHAAsH;KACzH,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC,CAAA;IACpF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;kDAmCP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QAC5B,WAAW,EACT,gIAAgI;KACnI,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,4DAA4D,EAAE,CAAC,CAAA;IAC9F,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0DAqCP;AAQK;IANL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE;QACzB,WAAW,EACT,2GAA2G;KAC9G,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC,CAAA;IAC5F,mBAAA,IAAA,kBAAG,EAAC,gBAAgB,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,iBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC,CAAA;IAElH,mBAAA,IAAA,kBAAG,EAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,iBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC,CAAA;IAE3G,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;mDA8BP;uBA1hBU,YAAY;IADxB,IAAA,uBAAQ,EAAC,cAAI,CAAC;GACF,YAAY,CA2hBxB","sourcesContent":["import { Arg, Ctx, Directive, Mutation, Resolver } from 'type-graphql'\nimport { GraphQLEmailAddress } from 'graphql-scalars'\nimport { ILike, In, SelectQueryBuilder, EntityManager } from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { Domain, getRepository, ObjectRef } from '@things-factory/shell'\n\nimport { deleteUser as commonDeleteUser, deleteUsers as commonDeleteUsers } from '../../controllers/delete-user.js'\nimport { buildDomainUsersQueryBuilder } from '../../utils/get-domain-users.js'\nimport { isDomainOwner, setPrimaryDomainOwner } from '../../utils/domain-ownership.js'\nimport { Role } from '../role/role.js'\nimport { User, UserStatus } from './user.js'\nimport { NewUser, UserPatch } from './user-types.js'\nimport { USERNAME_ALREADY_EXISTS, EMAIL_ALREADY_EXISTS, USERNAME_INVALID } from '../../constants/error-code.js'\n\n@Resolver(User)\nexport class UserMutation {\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => User, {\n    description:\n      'Creates a new user in the system. Use this mutation to register a user with the specified credentials and domain information.'\n  })\n  async createUser(\n    @Arg('user', { description: 'The input object containing new user information.' }) user: NewUser,\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, tx } = context.state\n    const { defaultPassword } = config.get('password')\n    const { username, email } = user\n    const userRepository = getRepository(User, tx)\n\n    user.username = username.trim()\n    user.email = email.trim()\n\n    if (await userRepository.findOne({ where: { username: user.username } })) {\n      throw new Error(context.t('error.' + USERNAME_ALREADY_EXISTS))\n    }\n\n    if (await userRepository.findOne({ where: { email: ILike(user.email) } })) {\n      throw new Error(context.t('error.' + EMAIL_ALREADY_EXISTS))\n    }\n\n    if (!user.password && !defaultPassword) {\n      throw new Error('initial password or default password should be supported.')\n    }\n\n    // TODO username은 다음 패턴을 따라야 한다. pattern=\"^[A-Za-z0-9._@-]+$\"\n    if (!/^[A-Za-z0-9._@-]+$/.test(user.username)) {\n      throw new Error(context.t('error.' + USERNAME_INVALID, { username: user.username }))\n    }\n\n    // consider if validation password rule is required\n    /* check if password is following the rule */\n    // User.validatePasswordByRule(user.password, context.lng)\n\n    const salt = User.generateSalt()\n\n    return await userRepository.save({\n      creator: context.state.user,\n      updater: context.state.user,\n      ...user,\n      domains: [domain],\n      roles:\n        user.roles && user.roles.length\n          ? await getRepository(Role, tx).findBy({\n              id: In(user.roles.map(role => role.id)),\n              domain: { id: domain.id }\n            })\n          : [],\n      salt,\n      passwordUpdatedAt: new Date(),\n      password: user.password ? User.encode(user.password, salt) : User.encode(defaultPassword, salt)\n    })\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => User, {\n    description:\n      'Updates the information of an existing user. Use this mutation to modify user profile details, such as name, email, or roles.'\n  })\n  async updateUser(\n    @Arg('email', type => GraphQLEmailAddress, { description: 'The email address of the user to update.' })\n    email: string,\n    @Arg('patch', { description: 'The patch object containing updated user fields.' }) patch: UserPatch,\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, user: updater, tx }: { domain: Domain; user: User; tx?: EntityManager } = context.state\n    const qb: SelectQueryBuilder<User> = buildDomainUsersQueryBuilder(domain.id, 'USER')\n    const user: User = await qb\n      .andWhere('LOWER(USER.email) = :email', { email: email?.toLowerCase().trim() || '' })\n      .leftJoinAndSelect('USER.roles', 'ROLES')\n      .leftJoinAndSelect('ROLES.domain', 'R_DOMAIN')\n      .getOne()\n\n    if (patch.roles) {\n      patch.roles = await getRepository(Role, tx).find({\n        where: { id: In(patch.roles.map((r: Partial<Role>) => r.id)) }\n      })\n    }\n\n    if (patch.status && patch.status === 'activated') {\n      user.status = UserStatus.ACTIVATED\n    }\n\n    return await getRepository(User, tx).save({\n      ...user,\n      ...patch,\n      updater\n    } as any)\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => [User], {\n    description:\n      'Updates or creates multiple users in a single operation. Use this mutation for batch processing of user records.'\n  })\n  async updateMultipleUser(\n    @Arg('patches', type => [UserPatch], { description: 'An array of patch objects for batch update or creation.' })\n    patches: UserPatch[],\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, user, tx } = context.state\n    const userRepo = getRepository(User, tx)\n\n    let results = []\n    const _createRecords = patches.filter((patch: any) => patch.cuFlag.toUpperCase() === '+')\n    const _updateRecords = patches.filter((patch: any) => patch.cuFlag.toUpperCase() === 'M')\n\n    if (_createRecords.length > 0) {\n      for (let i = 0; i < _createRecords.length; i++) {\n        const newRecord = _createRecords[i]\n\n        // consider if validation password rule is required\n        /* check if password is following the rule */\n        // User.validatePasswordByRule(newRecord.password, context.lng)\n\n        const salt = User.generateSalt()\n        const result = await userRepo.save({\n          ...(newRecord as any),\n          domains: [domain],\n          salt,\n          password: User.encode(newRecord.password, salt),\n          passwordUpdatedAt: new Date(),\n          creator: user,\n          updater: user\n        })\n\n        // repository api는 작동하지 않음.\n        // await tx\n        //   .createQueryBuilder()\n        //   .insert()\n        //   .into('users_domains')\n        //   .values({\n        //     usersId: result.id,\n        //     domainsId: domain.id\n        //   })\n        //   .execute()\n\n        results.push({ ...result, cuFlag: '+' })\n      }\n    }\n\n    if (_updateRecords.length > 0) {\n      for (let i = 0; i < _updateRecords.length; i++) {\n        const updateRecord = _updateRecords[i]\n        // consider if validation password rule is required\n        /* check if password is following the rule */\n        // User.validatePasswordByRule(updateRecord.password, context.lng)\n\n        const user = await userRepo.findOne({ where: { id: updateRecord.id }, relations: ['domains'] })\n        var domains = user.domains.find(d => d.id === domain.id) ? user.domains : [...user.domains, domain]\n\n        const result = await userRepo.save({\n          ...user,\n          ...(updateRecord as any),\n          domains,\n          password: updateRecord.password ? User.encode(updateRecord.password, user.salt) : user.password,\n          updater: user\n        })\n\n        if (!updateRecord.status) {\n          continue\n        }\n\n        // const domain = await user.domain\n        // if (!domain) {\n        //   continue\n        // }\n\n        // const domainId = domain.id\n        // const domains = await user.domains\n        // if (!domains.find(domain => domain.id == domainId)) {\n        //   await tx\n        //     .createQueryBuilder()\n        //     .insert()\n        //     .into('users_domains')\n        //     .values({\n        //       usersId: user.id,\n        //       domainsId: domain.id\n        //     })\n        //     .execute()\n        // }\n\n        results.push({ ...result, cuFlag: 'M' })\n      }\n    }\n\n    return results\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Deletes a user from the system by their username. Use this mutation to permanently remove a user account and revoke their access.'\n  })\n  async deleteUser(\n    @Arg('username', { description: 'The username of the user to delete.' }) username: string,\n    @Ctx() context: ResolverContext\n  ) {\n    const { tx } = context.state\n\n    await commonDeleteUser({ username }, tx)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Deletes multiple users from the system by their usernames. Use this mutation to remove several user accounts at once.'\n  })\n  async deleteUsers(\n    @Arg('usernames', type => [String], { description: 'An array of usernames to delete.' }) usernames: string[],\n    @Ctx() context: ResolverContext\n  ) {\n    const { tx } = context.state\n    await commonDeleteUsers({ usernames }, tx)\n\n    return true\n  }\n\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Invites an existing user to join the current domain. Use this mutation to add a user to a domain if they already exist in the system.'\n  })\n  async inviteUser(\n    @Arg('username', { description: 'The username or email of the user to invite.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { domain, tx } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var invitee: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!invitee && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      invitee = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!invitee) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    const existingDomains: Domain[] = invitee.domains\n    if (existingDomains.find((d: Domain) => d.id === domain.id)) {\n      throw new Error(context.t('error.x already exists in y', { x: context.t('field.user'), y: domain.name }))\n    }\n\n    invitee.domains = [...existingDomains, domain]\n    await userRepository.save(invitee)\n\n    return true\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Mutation(returns => Boolean, {\n    description:\n      \"Removes a user from the current domain. Use this mutation to revoke a user's access to a specific domain without deleting their account.\"\n  })\n  async deleteDomainUser(\n    @Arg('username', { description: 'The username or email of the user to remove from the domain.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var user: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains', 'roles']\n    })\n\n    if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      user = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains', 'roles']\n      })\n    }\n\n    if (!user) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    const targetDomainIdx: number = user.domains.findIndex((userDomain: Domain) => userDomain.id === domain.id)\n    if (targetDomainIdx < 0) {\n      throw new Error(context.t('error.x is not a member of y', { x: user.name, y: domain.name }))\n    }\n\n    // Remove domain relation with user\n    user.domains.splice(targetDomainIdx, 1)\n\n    // Remove domain's roles that user has\n    user.roles = user.roles.filter((role: Role) => role.domainId !== domain.id)\n\n    await userRepository.save(user)\n\n    return true\n  }\n\n  @Directive('@privilege(domainOwnerGranted: true, superUserGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Transfers domain ownership to another user. Use this mutation to assign the owner role to a different user within the domain.'\n  })\n  async transferOwner(\n    @Arg('username', { description: 'The username or email of the user to transfer ownership to.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { domain, tx, user: actor } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var user: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains', 'roles']\n    })\n\n    if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      user = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains', 'roles']\n      })\n    }\n\n    if (!user) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (user.status !== UserStatus.ACTIVATED) {\n      throw new Error('Only activated users are eligible to receive admin privileges.')\n    }\n\n    if (user.domains.map((d: Domain) => d.id).indexOf(domain.id) < 0) {\n      throw new Error(`User is not belongs to current domain`)\n    }\n\n    /* 역할은 부모 도메인으로부터 상속될 수 있으므로 부여된 상속 역할도 자격으로 인정한다. */\n    const grantableRoleDomainIds: string[] = [domain.id, domain.parentId].filter(Boolean)\n    if (user.roles.filter((r: Role) => grantableRoleDomainIds.includes(r.domainId)).length == 0) {\n      throw new Error(`Only users with at least one role in this domain are eligible to receive admin privileges.`)\n    }\n\n    /* 대표 오너 컬럼과 `DomainOwner` 테이블을 함께 갱신한다 (기존 오너 엔트리는 유지). */\n    await setPrimaryDomainOwner(domain, user.id, actor, tx)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Activates a user account in the current domain. Use this mutation to enable a user who was previously inactive.'\n  })\n  async activateUser(\n    @Arg('username', { description: 'The username or email of the user to activate.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var targetUser: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!targetUser && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      targetUser = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!targetUser) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (!targetUser?.domains?.find((userDomain: Domain) => userDomain.id === domain.id)) {\n      throw new Error('User is not belong to domain')\n    }\n\n    targetUser.failCount = 0\n    targetUser.status = UserStatus.ACTIVATED\n\n    await userRepository.save(targetUser)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      'Inactivates a user account in the current domain. Use this mutation to disable a user, making them unable to log in.'\n  })\n  async inactivateUser(\n    @Arg('username', { description: 'The username or email of the user to inactivate.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var targetUser: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!targetUser && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      targetUser = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!targetUser) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (!targetUser?.domains?.find((userDomain: Domain) => userDomain.id === domain.id)) {\n      throw new Error('User is not belong to domain')\n    }\n\n    /* 공동 오너(`DomainOwner` 테이블)도 도메인 관리자이므로 같은 보호를 받는다. */\n    if (targetUser.userType == 'admin' || (await isDomainOwner(domain, targetUser, tx))) {\n      throw new Error('Admin deactivation not allowed')\n    }\n\n    targetUser.status = UserStatus.INACTIVE\n\n    await userRepository.save(targetUser)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, {\n    description:\n      \"Resets a user's password to the default value. Use this mutation to restore access to a user who has forgotten their password.\"\n  })\n  async resetPasswordToDefault(\n    @Arg('username', { description: 'The username or email of the user whose password to reset.' }) username: string,\n    @Ctx() context: ResolverContext\n  ): Promise<boolean> {\n    const { tx, domain } = context.state\n\n    const { defaultPassword } = config.get('password')\n    if (!defaultPassword) {\n      throw new Error('No default password found')\n    }\n\n    const userRepository = getRepository(User, tx)\n\n    var targetUser: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains']\n    })\n\n    if (!targetUser && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      targetUser = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains']\n      })\n    }\n\n    if (!targetUser) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (!targetUser?.domains?.find((userDomain: Domain) => userDomain.id === domain.id)) {\n      throw new Error('User is not belong to domain')\n    }\n\n    targetUser.salt = User.generateSalt()\n    targetUser.password = User.encode(defaultPassword, targetUser.salt)\n\n    await userRepository.save(targetUser)\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => User, {\n    description:\n      \"Updates the roles assigned to a user. Use this mutation to change a user's permissions within the domain.\"\n  })\n  async updateUserRoles(\n    @Arg('username', { description: 'The username or email of the user whose roles to update.' }) username: string,\n    @Arg('availableRoles', type => [ObjectRef], { description: 'The list of roles that can be assigned to the user.' })\n    availableRoles: ObjectRef[],\n    @Arg('selectedRoles', type => [ObjectRef], { description: 'The list of roles to be assigned to the user.' })\n    selectedRoles: ObjectRef[],\n    @Ctx() context: ResolverContext\n  ) {\n    const { domain, tx } = context.state\n    const userRepository = getRepository(User, tx)\n\n    var user: User = await userRepository.findOne({\n      where: { username },\n      relations: ['domains', 'roles']\n    })\n\n    if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n      user = await userRepository.findOne({\n        where: { email: ILike(username) },\n        relations: ['domains', 'roles']\n      })\n    }\n\n    if (!user) {\n      throw new Error(context.t('error.failed to find x', { x: context.t('field.user') }))\n    }\n\n    if (user.domains.map((d: Domain) => d.id).indexOf(domain.id) < 0) {\n      throw new Error(`User is not belongs to current domain`)\n    }\n\n    const availableRoleIds: string[] = availableRoles.map((r: Role) => r.id)\n    user.roles = user.roles.filter((r: Role) => availableRoleIds.indexOf(r.id) < 0)\n    user.roles = user.roles.concat(selectedRoles as Role[])\n\n    return await userRepository.save(user)\n  }\n}\n"]}

package/dist-server/service/user/user-query.js

@@ -8,6 +8,7 @@ const typeorm_1 = require("typeorm");
 const env_1 = require("@things-factory/env");
 const shell_1 = require("@things-factory/shell");
 const check_user_belongs_domain_js_1 = require("../../utils/check-user-belongs-domain.js");
+const domain_ownership_js_1 = require("../../utils/domain-ownership.js");
 const get_domain_users_js_1 = require("../../utils/get-domain-users.js");
 const user_js_1 = require("./user.js");
 const user_types_js_1 = require("./user-types.js");
@@ -50,8 +51,10 @@ let UserQuery = class UserQuery {
             return 'USER.id IN ' + subQuery;
         });
         const [items, total] = await qb.getManyAndCount();
+        /* 오너는 여러 명일 수 있다 — 대표 오너 컬럼만 보면 공동 오너가 일반 사용자로 표시된다. */
+        const ownerIds = await (0, domain_ownership_js_1.findDomainOwnerUserIds)(domain);
         const foundUsers = items.map((item) => {
-            item.owner = item.id === domain.owner;
+            item.owner = ownerIds.has(item.id);
             return item;
         });
         return { items: foundUsers, total };

package/dist-server/service/user/user-query.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-query.js","sourceRoot":"","sources":["../../../server/service/user/user-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8F;AAC9F,qDAAqD;AACrD,qCAAmD;AAEnD,6CAA4C;AAC5C,iDAA+F;AAE/F,2FAAiF;AACjF,yEAA8E;AAC9E,uCAAgC;AAChC,mDAAwD;AAExD,MAAM,YAAY,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI;IAC7C,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,KAAK;IAClB,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,oBAAoB,EAAE,CAAC;IACvB,oBAAoB,EAAE,EAAE;CACzB,CAAA;AAGM,IAAM,SAAS,GAAf,MAAM,SAAS;IAKpB,YAAY,CAAQ,OAAwB;QAC1C,OAAO,YAAY,CAAA;IACrB,CAAC;IAMK,AAAN,KAAK,CAAC,IAAI,CAER,KAAa,EACN,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,EAAE,GAA6B,IAAA,kDAA4B,EAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACpF,EAAE,CAAC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAEhF,OAAO,EAAE,CAAC,MAAM,EAAE,CAAA;IACpB,CAAC;IAMK,AAAN,KAAK,CAAC,KAAK,CAA0B,MAAiB,EAAS,OAAwB;QACrF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,EAAE,GAAG,IAAA,qCAA6B,EAAC;YACvC,UAAU,EAAE,IAAA,qBAAa,EAAC,cAAI,CAAC;YAC/B,MAAM;YACN,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC;SAC9C,CAAC,CAAA;QAEF,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;YACxB,MAAM,QAAQ,GAAG,EAAE;iBAChB,QAAQ,EAAE;iBACV,MAAM,CAAC,wBAAwB,CAAC;iBAChC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC;iBACtC,KAAK,CAAC,sCAAsC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;iBACtE,QAAQ,EAAE,CAAA;YAEb,OAAO,aAAa,GAAG,QAAQ,CAAA;QACjC,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,eAAe,EAAE,CAAA;QAEjD,MAAM,UAAU,GAAW,KAAK,CAAC,GAAG,CAAC,CAAC,IAAU,EAAE,EAAE;YAClD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAA;YACrC,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;QAEF,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;IACrC,CAAC;IAKK,AAAN,KAAK,CAAC,sBAAsB,CAAQ,OAAwB;QAC1D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEtC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,MAAM,IAAA,qDAAsB,EAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACnD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IAKK,AAAN,KAAK,CAAC,gCAAgC,CAAQ,OAAwB;QACpE,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAElD,OAAO,OAAO,CAAC,eAAe,CAAC,CAAA;IACjC,CAAC;IAKK,AAAN,KAAK,CAAC,oBAAoB,CAAQ,OAAwB;QACxD,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAElD,OAAO,OAAO,CAAC,eAAe,CAAC,CAAA;IACjC,CAAC;IAMK,AAAN,KAAK,CAAC,kBAAkB,CAEtB,KAAa;QAEb,OAAO,OAAO,CAAC,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACrF,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAS,IAAU;QAC/B,OAAO,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAA;IACpC,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,CACL,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAChC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CACH,CAAC,OAAO,CAAA;IACX,CAAC;IAGK,AAAN,KAAK,CAAC,KAAK,CAAS,IAAU;QAC5B,OAAO,CACL,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAChC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,OAAO,CAAC;SACrB,CAAC,CACH,CAAC,KAAK,CAAA;IACT,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;CACF,CAAA;AAzIY,8BAAS;AAKpB;IAJC,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,4BAAY,EAAE;QAC9B,WAAW,EACT,wHAAwH;KAC3H,CAAC;IACY,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;4CAA4B,4BAAY;6CAE1D;AAMK;IAJL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE;QACtB,WAAW,EAAE,kEAAkE;KAChF,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,qCAAmB,EAAE,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC,CAAA;IAErG,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qCAQP;AAMK;IAJL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,wBAAQ,EAAE;QAC1B,WAAW,EAAE,wFAAwF;KACtG,CAAC;IACW,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;sCA6BrD;AAKK;IAHL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,WAAW,EAAE,yEAAyE;KACvF,CAAC;IAC4B,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;uDAQlC;AAKK;IAHL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,WAAW,EAAE,qFAAqF;KACnG,CAAC;IACsC,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;iEAI5C;AAKK;IAHL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,WAAW,EAAE,iFAAiF;KAC/F,CAAC;IAC0B,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qDAIhC;AAMK;IAJL,IAAA,wBAAS,EAAC,kDAAkD,CAAC;IAC7D,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,WAAW,EAAE,qEAAqE;KACnF,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,qCAAmB,EAAE,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC,CAAA;;;;mDAIzG;AAGK;IADL,IAAA,4BAAa,EAAC,EAAE,WAAW,EAAE,0EAA0E,EAAE,CAAC;IAC3F,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;yCAEhC;AAGK;IADL,IAAA,4BAAa,EAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;IACpE,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAO/B;AAGK;IADL,IAAA,4BAAa,EAAC,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;IACrE,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;sCAO7B;AAGK;IADL,IAAA,4BAAa,EAAC,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;IACvE,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;AAGK;IADL,IAAA,4BAAa,EAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;IAC7E,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;oBAxIU,SAAS;IADrB,IAAA,uBAAQ,EAAC,cAAI,CAAC;GACF,SAAS,CAyIrB","sourcesContent":["import { Arg, Args, Ctx, Directive, FieldResolver, Query, Resolver, Root } from 'type-graphql'\nimport { GraphQLEmailAddress } from 'graphql-scalars'\nimport { ILike, SelectQueryBuilder } from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { getRepository, ListParam, getQueryBuilderFromListParams } from '@things-factory/shell'\n\nimport { checkUserBelongsDomain } from '../../utils/check-user-belongs-domain.js'\nimport { buildDomainUsersQueryBuilder } from '../../utils/get-domain-users.js'\nimport { User } from './user.js'\nimport { PasswordRule, UserList } from './user-types.js'\n\nconst passwordRule = config.get('password') || {\n  lowerCase: true,\n  upperCase: true,\n  digit: true,\n  specialCharacter: true,\n  allowRepeat: false,\n  useTightPattern: true,\n  useLoosePattern: false,\n  tightCharacterLength: 8,\n  looseCharacterLength: 15\n}\n\n@Resolver(User)\nexport class UserQuery {\n  @Query(returns => PasswordRule, {\n    description:\n      'Retrieves the current password rule configuration for the system, such as required character types and minimum length.'\n  })\n  passwordRule(@Ctx() context: ResolverContext): PasswordRule {\n    return passwordRule\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => User, {\n    description: 'Fetches a user by their email address within the current domain.'\n  })\n  async user(\n    @Arg('email', type => GraphQLEmailAddress, { description: 'The email address of the user to fetch.' })\n    email: string,\n    @Ctx() context: ResolverContext\n  ): Promise<User> {\n    const { domain } = context.state\n\n    const qb: SelectQueryBuilder<User> = buildDomainUsersQueryBuilder(domain.id, 'USER')\n    qb.andWhere(`LOWER(USER.email) = :email`, { email: email.toLowerCase().trim() })\n\n    return qb.getOne()\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => UserList, {\n    description: 'Fetches a list of users based on provided search parameters within the current domain.'\n  })\n  async users(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<UserList> {\n    const { domain } = context.state\n\n    const qb = getQueryBuilderFromListParams({\n      repository: getRepository(User),\n      params,\n      alias: 'USER',\n      searchables: ['name', 'email', 'description']\n    })\n\n    qb.select().andWhere(qb => {\n      const subQuery = qb\n        .subQuery()\n        .select('USERS_DOMAINS.users_id')\n        .from('users_domains', 'USERS_DOMAINS')\n        .where('USERS_DOMAINS.domains_id = :domainId', { domainId: domain.id })\n        .getQuery()\n\n      return 'USER.id IN ' + subQuery\n    })\n\n    const [items, total] = await qb.getManyAndCount()\n\n    const foundUsers: User[] = items.map((item: User) => {\n      item.owner = item.id === domain.owner\n      return item\n    })\n\n    return { items: foundUsers, total }\n  }\n\n  @Query(returns => Boolean, {\n    description: 'Checks if the current authenticated user belongs to the current domain.'\n  })\n  async checkUserBelongsDomain(@Ctx() context: ResolverContext): Promise<Boolean> {\n    const { user, domain } = context.state\n\n    if (user) {\n      return await checkUserBelongsDomain(domain, user)\n    } else {\n      throw new Error(`Failed to get current user information.`)\n    }\n  }\n\n  @Query(returns => Boolean, {\n    description: 'Determines whether the system provides a default password when creating a new user.'\n  })\n  async checkResettablePasswordToDefault(@Ctx() context: ResolverContext): Promise<Boolean> {\n    const { defaultPassword } = config.get('password')\n\n    return Boolean(defaultPassword)\n  }\n\n  @Query(returns => Boolean, {\n    description: 'Checks if the system is configured to provide a default password for new users.'\n  })\n  async checkDefaultPassword(@Ctx() context: ResolverContext): Promise<Boolean> {\n    const { defaultPassword } = config.get('password')\n\n    return Boolean(defaultPassword)\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"query\")')\n  @Query(returns => Boolean, {\n    description: 'Checks if a user with the given email address exists in the system.'\n  })\n  async checkUserExistence(\n    @Arg('email', type => GraphQLEmailAddress, { description: 'The email address to check for existence.' })\n    email: string\n  ): Promise<Boolean> {\n    return Boolean(await getRepository(User).count({ where: { email: ILike(email) } }))\n  }\n\n  @FieldResolver({ description: 'Returns the username of the user, or their email if username is not set.' })\n  async username(@Root() user: User) {\n    return user.username || user.email\n  }\n\n  @FieldResolver({ description: 'Returns the list of domains the user belongs to.' })\n  async domains(@Root() user: User) {\n    return (\n      await getRepository(User).findOne({\n        where: { id: user.id },\n        relations: ['domains']\n      })\n    ).domains\n  }\n\n  @FieldResolver({ description: 'Returns the list of roles assigned to the user.' })\n  async roles(@Root() user: User) {\n    return (\n      await getRepository(User).findOne({\n        where: { id: user.id },\n        relations: ['roles']\n      })\n    ).roles\n  }\n\n  @FieldResolver({ description: 'Returns the user who last updated this user record.' })\n  async updater(@Root() user: User): Promise<User> {\n    return await getRepository(User).findOneBy({ id: user.updaterId })\n  }\n\n  @FieldResolver({ description: 'Returns the user who originally created this user record.' })\n  async creator(@Root() user: User): Promise<User> {\n    return await getRepository(User).findOneBy({ id: user.creatorId })\n  }\n}\n"]}
+{"version":3,"file":"user-query.js","sourceRoot":"","sources":["../../../server/service/user/user-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8F;AAC9F,qDAAqD;AACrD,qCAAmD;AAEnD,6CAA4C;AAC5C,iDAA+F;AAE/F,2FAAiF;AACjF,yEAAwE;AACxE,yEAA8E;AAC9E,uCAAgC;AAChC,mDAAwD;AAExD,MAAM,YAAY,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI;IAC7C,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,KAAK;IAClB,eAAe,EAAE,IAAI;IACrB,eAAe,EAAE,KAAK;IACtB,oBAAoB,EAAE,CAAC;IACvB,oBAAoB,EAAE,EAAE;CACzB,CAAA;AAGM,IAAM,SAAS,GAAf,MAAM,SAAS;IAKpB,YAAY,CAAQ,OAAwB;QAC1C,OAAO,YAAY,CAAA;IACrB,CAAC;IAMK,AAAN,KAAK,CAAC,IAAI,CAER,KAAa,EACN,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,EAAE,GAA6B,IAAA,kDAA4B,EAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACpF,EAAE,CAAC,QAAQ,CAAC,4BAA4B,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAEhF,OAAO,EAAE,CAAC,MAAM,EAAE,CAAA;IACpB,CAAC;IAMK,AAAN,KAAK,CAAC,KAAK,CAA0B,MAAiB,EAAS,OAAwB;QACrF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,EAAE,GAAG,IAAA,qCAA6B,EAAC;YACvC,UAAU,EAAE,IAAA,qBAAa,EAAC,cAAI,CAAC;YAC/B,MAAM;YACN,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC;SAC9C,CAAC,CAAA;QAEF,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;YACxB,MAAM,QAAQ,GAAG,EAAE;iBAChB,QAAQ,EAAE;iBACV,MAAM,CAAC,wBAAwB,CAAC;iBAChC,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC;iBACtC,KAAK,CAAC,sCAAsC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;iBACtE,QAAQ,EAAE,CAAA;YAEb,OAAO,aAAa,GAAG,QAAQ,CAAA;QACjC,CAAC,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,eAAe,EAAE,CAAA;QAEjD,wDAAwD;QACxD,MAAM,QAAQ,GAAgB,MAAM,IAAA,4CAAsB,EAAC,MAAM,CAAC,CAAA;QAElE,MAAM,UAAU,GAAW,KAAK,CAAC,GAAG,CAAC,CAAC,IAAU,EAAE,EAAE;YAClD,IAAI,CAAC,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YAClC,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;QAEF,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;IACrC,CAAC;IAKK,AAAN,KAAK,CAAC,sBAAsB,CAAQ,OAAwB;QAC1D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEtC,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,MAAM,IAAA,qDAAsB,EAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACnD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IAKK,AAAN,KAAK,CAAC,gCAAgC,CAAQ,OAAwB;QACpE,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAElD,OAAO,OAAO,CAAC,eAAe,CAAC,CAAA;IACjC,CAAC;IAKK,AAAN,KAAK,CAAC,oBAAoB,CAAQ,OAAwB;QACxD,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAElD,OAAO,OAAO,CAAC,eAAe,CAAC,CAAA;IACjC,CAAC;IAMK,AAAN,KAAK,CAAC,kBAAkB,CAEtB,KAAa;QAEb,OAAO,OAAO,CAAC,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;IACrF,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAS,IAAU;QAC/B,OAAO,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAA;IACpC,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,CACL,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAChC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,SAAS,CAAC;SACvB,CAAC,CACH,CAAC,OAAO,CAAA;IACX,CAAC;IAGK,AAAN,KAAK,CAAC,KAAK,CAAS,IAAU;QAC5B,OAAO,CACL,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAChC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,OAAO,CAAC;SACrB,CAAC,CACH,CAAC,KAAK,CAAA;IACT,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;CACF,CAAA;AA5IY,8BAAS;AAKpB;IAJC,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,4BAAY,EAAE;QAC9B,WAAW,EACT,wHAAwH;KAC3H,CAAC;IACY,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;4CAA4B,4BAAY;6CAE1D;AAMK;IAJL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE;QACtB,WAAW,EAAE,kEAAkE;KAChF,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,qCAAmB,EAAE,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC,CAAA;IAErG,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qCAQP;AAMK;IAJL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,wBAAQ,EAAE;QAC1B,WAAW,EAAE,wFAAwF;KACtG,CAAC;IACW,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;sCAgCrD;AAKK;IAHL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,WAAW,EAAE,yEAAyE;KACvF,CAAC;IAC4B,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;uDAQlC;AAKK;IAHL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,WAAW,EAAE,qFAAqF;KACnG,CAAC;IACsC,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;iEAI5C;AAKK;IAHL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,WAAW,EAAE,iFAAiF;KAC/F,CAAC;IAC0B,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qDAIhC;AAMK;IAJL,IAAA,wBAAS,EAAC,kDAAkD,CAAC;IAC7D,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE;QACzB,WAAW,EAAE,qEAAqE;KACnF,CAAC;IAEC,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,qCAAmB,EAAE,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC,CAAA;;;;mDAIzG;AAGK;IADL,IAAA,4BAAa,EAAC,EAAE,WAAW,EAAE,0EAA0E,EAAE,CAAC;IAC3F,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;yCAEhC;AAGK;IADL,IAAA,4BAAa,EAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;IACpE,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAO/B;AAGK;IADL,IAAA,4BAAa,EAAC,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;IACrE,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;sCAO7B;AAGK;IADL,IAAA,4BAAa,EAAC,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;IACvE,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;AAGK;IADL,IAAA,4BAAa,EAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;IAC7E,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;oBA3IU,SAAS;IADrB,IAAA,uBAAQ,EAAC,cAAI,CAAC;GACF,SAAS,CA4IrB","sourcesContent":["import { Arg, Args, Ctx, Directive, FieldResolver, Query, Resolver, Root } from 'type-graphql'\nimport { GraphQLEmailAddress } from 'graphql-scalars'\nimport { ILike, SelectQueryBuilder } from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { getRepository, ListParam, getQueryBuilderFromListParams } from '@things-factory/shell'\n\nimport { checkUserBelongsDomain } from '../../utils/check-user-belongs-domain.js'\nimport { findDomainOwnerUserIds } from '../../utils/domain-ownership.js'\nimport { buildDomainUsersQueryBuilder } from '../../utils/get-domain-users.js'\nimport { User } from './user.js'\nimport { PasswordRule, UserList } from './user-types.js'\n\nconst passwordRule = config.get('password') || {\n  lowerCase: true,\n  upperCase: true,\n  digit: true,\n  specialCharacter: true,\n  allowRepeat: false,\n  useTightPattern: true,\n  useLoosePattern: false,\n  tightCharacterLength: 8,\n  looseCharacterLength: 15\n}\n\n@Resolver(User)\nexport class UserQuery {\n  @Query(returns => PasswordRule, {\n    description:\n      'Retrieves the current password rule configuration for the system, such as required character types and minimum length.'\n  })\n  passwordRule(@Ctx() context: ResolverContext): PasswordRule {\n    return passwordRule\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => User, {\n    description: 'Fetches a user by their email address within the current domain.'\n  })\n  async user(\n    @Arg('email', type => GraphQLEmailAddress, { description: 'The email address of the user to fetch.' })\n    email: string,\n    @Ctx() context: ResolverContext\n  ): Promise<User> {\n    const { domain } = context.state\n\n    const qb: SelectQueryBuilder<User> = buildDomainUsersQueryBuilder(domain.id, 'USER')\n    qb.andWhere(`LOWER(USER.email) = :email`, { email: email.toLowerCase().trim() })\n\n    return qb.getOne()\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => UserList, {\n    description: 'Fetches a list of users based on provided search parameters within the current domain.'\n  })\n  async users(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<UserList> {\n    const { domain } = context.state\n\n    const qb = getQueryBuilderFromListParams({\n      repository: getRepository(User),\n      params,\n      alias: 'USER',\n      searchables: ['name', 'email', 'description']\n    })\n\n    qb.select().andWhere(qb => {\n      const subQuery = qb\n        .subQuery()\n        .select('USERS_DOMAINS.users_id')\n        .from('users_domains', 'USERS_DOMAINS')\n        .where('USERS_DOMAINS.domains_id = :domainId', { domainId: domain.id })\n        .getQuery()\n\n      return 'USER.id IN ' + subQuery\n    })\n\n    const [items, total] = await qb.getManyAndCount()\n\n    /* 오너는 여러 명일 수 있다 — 대표 오너 컬럼만 보면 공동 오너가 일반 사용자로 표시된다. */\n    const ownerIds: Set<string> = await findDomainOwnerUserIds(domain)\n\n    const foundUsers: User[] = items.map((item: User) => {\n      item.owner = ownerIds.has(item.id)\n      return item\n    })\n\n    return { items: foundUsers, total }\n  }\n\n  @Query(returns => Boolean, {\n    description: 'Checks if the current authenticated user belongs to the current domain.'\n  })\n  async checkUserBelongsDomain(@Ctx() context: ResolverContext): Promise<Boolean> {\n    const { user, domain } = context.state\n\n    if (user) {\n      return await checkUserBelongsDomain(domain, user)\n    } else {\n      throw new Error(`Failed to get current user information.`)\n    }\n  }\n\n  @Query(returns => Boolean, {\n    description: 'Determines whether the system provides a default password when creating a new user.'\n  })\n  async checkResettablePasswordToDefault(@Ctx() context: ResolverContext): Promise<Boolean> {\n    const { defaultPassword } = config.get('password')\n\n    return Boolean(defaultPassword)\n  }\n\n  @Query(returns => Boolean, {\n    description: 'Checks if the system is configured to provide a default password for new users.'\n  })\n  async checkDefaultPassword(@Ctx() context: ResolverContext): Promise<Boolean> {\n    const { defaultPassword } = config.get('password')\n\n    return Boolean(defaultPassword)\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"query\")')\n  @Query(returns => Boolean, {\n    description: 'Checks if a user with the given email address exists in the system.'\n  })\n  async checkUserExistence(\n    @Arg('email', type => GraphQLEmailAddress, { description: 'The email address to check for existence.' })\n    email: string\n  ): Promise<Boolean> {\n    return Boolean(await getRepository(User).count({ where: { email: ILike(email) } }))\n  }\n\n  @FieldResolver({ description: 'Returns the username of the user, or their email if username is not set.' })\n  async username(@Root() user: User) {\n    return user.username || user.email\n  }\n\n  @FieldResolver({ description: 'Returns the list of domains the user belongs to.' })\n  async domains(@Root() user: User) {\n    return (\n      await getRepository(User).findOne({\n        where: { id: user.id },\n        relations: ['domains']\n      })\n    ).domains\n  }\n\n  @FieldResolver({ description: 'Returns the list of roles assigned to the user.' })\n  async roles(@Root() user: User) {\n    return (\n      await getRepository(User).findOne({\n        where: { id: user.id },\n        relations: ['roles']\n      })\n    ).roles\n  }\n\n  @FieldResolver({ description: 'Returns the user who last updated this user record.' })\n  async updater(@Root() user: User): Promise<User> {\n    return await getRepository(User).findOneBy({ id: user.updaterId })\n  }\n\n  @FieldResolver({ description: 'Returns the user who originally created this user record.' })\n  async creator(@Root() user: User): Promise<User> {\n    return await getRepository(User).findOneBy({ id: user.creatorId })\n  }\n}\n"]}

package/dist-server/service/user/user.d.ts

@@ -43,10 +43,22 @@ export declare class User {
     static verify(hashed: any, password: any, salt: any): boolean;
     static checkAuthWithEmail(decoded: any): Promise<User>;
     static checkAuth(decoded: any): Promise<User>;
+    /**
+     * 역할은 부모 도메인으로부터 상속되므로, 권한 판정도 현재 도메인과 부모 도메인에 정의된
+     * 역할을 함께 본다 (상속 규약 단일 소스: `applyDomainInheritanceFilter`).
+     * 부모 역할이 형제 자식 도메인으로 번지지 않도록 하는 것은 체크인 게이트(`getUserDomains`)의
+     * 멤버십 조건이 담당한다.
+     */
     static hasPrivilege(privilege: string, category: string, domain: Domain, user: User): Promise<boolean>;
     static getPrivilegesByDomain(user: User, domain: Domain): Promise<{
         category: string;
         privilege: string;
     }[]>;
+    /**
+     * 엔티티에서 조회 유틸을 정적으로 import 하면 순환 참조가 된다
+     * (user → get-user-domains → checkin-domain-facts → granted-role → role → user).
+     * 순환 참조 상태에서 엔티티 데코레이터가 평가되면 type-graphql 이 타입을 추론하지 못해
+     * 모듈 로드 자체가 실패하므로, 호출 시점에 지연 로드한다.
+     */
     static getDomainsWithPrivilege(privilege: string, category: string, user: User): Promise<Partial<Domain>[]>;
 }

package/dist-server/service/user/user.js

@@ -19,7 +19,6 @@ const role_js_1 = require("../role/role.js");
 const privilege_js_1 = require("../privilege/privilege.js");
 const web_auth_credential_js_1 = require("../web-auth-credential/web-auth-credential.js");
 const users_auth_providers_js_1 = require("../users-auth-providers/users-auth-providers.js");
-const get_user_domains_js_1 = require("../../utils/get-user-domains.js");
 const ORMCONFIG = env_1.config.get('ormconfig', {});
 const DATABASE_TYPE = ORMCONFIG.type;
 const sessionExpirySeconds = Number(env_1.config.get('session/expirySeconds')) || '7d';
@@ -178,26 +177,33 @@ let User = User_1 = class User {
             return user;
         }
     }
+    /**
+     * 역할은 부모 도메인으로부터 상속되므로, 권한 판정도 현재 도메인과 부모 도메인에 정의된
+     * 역할을 함께 본다 (상속 규약 단일 소스: `applyDomainInheritanceFilter`).
+     * 부모 역할이 형제 자식 도메인으로 번지지 않도록 하는 것은 체크인 게이트(`getUserDomains`)의
+     * 멤버십 조건이 담당한다.
+     */
     static async hasPrivilege(privilege, category, domain, user) {
-        const result = await (0, shell_1.getRepository)(privilege_js_1.Privilege)
+        const queryBuilder = (0, shell_1.getRepository)(privilege_js_1.Privilege)
             .createQueryBuilder('privilege')
             .innerJoin('privilege.roles', 'role')
             .innerJoin('role.users', 'user')
             .where('privilege.category = :category', { category })
             .andWhere('privilege.name = :privilege', { privilege })
-            .andWhere('user.id = :userId', { userId: user.id })
-            .andWhere('role.domain.id = :domainId', { domainId: domain.id })
-            .getCount();
+            .andWhere('user.id = :userId', { userId: user.id });
+        (0, shell_1.applyDomainInheritanceFilter)(queryBuilder, 'role', domain, shell_1.InheritedValueType.Include);
+        const result = await queryBuilder.getCount();
         return result > 0;
     }
     static async getPrivilegesByDomain(user, domain) {
-        const result = await (0, shell_1.getRepository)(User_1)
+        const queryBuilder = (0, shell_1.getRepository)(User_1)
             .createQueryBuilder('user')
             .leftJoinAndSelect('user.roles', 'role')
             .leftJoinAndSelect('role.privileges', 'privilege')
             .select(['privilege.name AS privilege', 'privilege.category AS category'])
-            .where('user.id = :userId', { userId: user.id })
-            .andWhere('role.domain.id = :domainId', { domainId: domain.id })
+            .where('user.id = :userId', { userId: user.id });
+        (0, shell_1.applyDomainInheritanceFilter)(queryBuilder, 'role', domain, shell_1.InheritedValueType.Include);
+        const result = await queryBuilder
             .orderBy('privilege.category')
             .addOrderBy('privilege.name')
             .getRawMany();
@@ -210,8 +216,15 @@ let User = User_1 = class User {
         }, []);
         return distinct;
     }
+    /**
+     * 엔티티에서 조회 유틸을 정적으로 import 하면 순환 참조가 된다
+     * (user → get-user-domains → checkin-domain-facts → granted-role → role → user).
+     * 순환 참조 상태에서 엔티티 데코레이터가 평가되면 type-graphql 이 타입을 추론하지 못해
+     * 모듈 로드 자체가 실패하므로, 호출 시점에 지연 로드한다.
+     */
     static async getDomainsWithPrivilege(privilege, category, user) {
-        return (0, get_user_domains_js_1.getDomainsWithPrivilege)(user, privilege, category);
+        const { getDomainsWithPrivilege } = await Promise.resolve().then(() => tslib_1.__importStar(require('../../utils/get-user-domains.js')));
+        return getDomainsWithPrivilege(user, privilege, category);
     }
 };
 exports.User = User;

package/dist-server/service/user/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../server/service/user/user.ts"],"names":[],"mappings":";AAAA,iGAAiG;AACjG,mGAAmG;;;;;AAEnG,4DAA2B;AAC3B,wEAA8B;AAC9B,+CAA+D;AAC/D,qDAAqD;AACrD,qCAagB;AAEhB,6CAA4C;AAC5C,iDAA6D;AAE7D,+EAAiF;AACjF,8DAAsD;AACtD,6DAAkD;AAClD,6CAAsC;AACtC,4DAAqD;AACrD,0FAAiF;AACjF,6FAAoF;AACpF,yEAAyE;AAEzE,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AAC7C,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAA;AAEpC,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,IAAI,IAAI,CAAA;AAEhF,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,qCAAuB,CAAA;IACvB,iCAAmB,CAAA;IACnB,+BAAiB,CAAA;IACjB,+BAAiB,CAAA;IACjB,4DAA8C,CAAA,CAAC,wDAAwD;AACzG,CAAC,EAPW,UAAU,0BAAV,UAAU,QAOrB;AAaM,IAAM,IAAI,YAAV,MAAM,IAAI;IA6Hf,8BAA8B;IAC9B,KAAK,CAAC,IAAI,CAAC,OAAQ;QACjB,IAAI,EAAE,SAAS,GAAG,oBAAoB,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;QAExD,IAAI,IAAI,GAAG;YACT,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK;YACrC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAA;QAED,OAAO,MAAM,sBAAG,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAM,EAAE;YAClC,SAAS;YACT,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;IACJ,CAAC;IAED,6CAA6C;IAC7C,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,GAAG;QACzC,IAAA,yCAAsB,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;IAED,mBAAmB;IACnB,MAAM,CAAC,YAAY;QACjB,OAAO,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/C,CAAC;IAED,qBAAqB;IACrB,MAAM,CAAC,MAAM,CAAC,QAAgB,EAAE,IAAI;QAClC,OAAO,gBAAM;aACV,UAAU,CAAC,QAAQ,EAAE,IAAI,IAAI,sBAAM,CAAC;aACpC,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC,QAAQ,CAAC,CAAA;IACrB,CAAC;IAED,qBAAqB;IACrB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI;QAClC,OAAO,CACL,MAAM;YACJ,gBAAM;iBACH,UAAU,CAAC,QAAQ,EAAE,IAAI,IAAI,sBAAM,CAAC;iBACpC,MAAM,CAAC,QAAQ,CAAC;iBAChB,MAAM,CAAC,QAAQ,CAAC;YACrB,MAAM;gBACJ,gBAAM;qBACH,UAAU,CAAC,MAAM,EAAE,IAAI,IAAI,sBAAM,CAAC;qBAClC,MAAM,CAAC,QAAQ,CAAC;qBAChB,MAAM,CAAC,QAAQ,CAAC,CACtB,CAAA;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO;QACrC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,MAAI,CAAC,CAAA;QACtC,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAClC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;YAC/B,SAAS,EAAE,CAAC,SAAS,CAAC;YACtB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;aACC,CAAC;YACJ,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,UAAU,CAAC,QAAQ;oBACtB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;wBACnD,MAAM,EAAE;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;yBAClB;qBACF,CAAC,CAAA;gBACJ,KAAK,UAAU,CAAC,MAAM;oBACpB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,WAAW;wBAC5C,MAAM,EAAE;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;yBAClB;qBACF,CAAC,CAAA;gBACJ,KAAK,UAAU,CAAC,OAAO;oBACrB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,YAAY;qBAC9C,CAAC,CAAA;YACN,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO;QAC5B,2BAA2B;QAC3B,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;QAEtC,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,MAAI,CAAC,CAAA;QACtC,IAAI,EAAE,EAAE,CAAC;YACP,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACb,SAAS,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;gBACrC,KAAK,EAAE,IAAI;aACZ,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,QAAQ,EAAE;gBACnB,SAAS,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;gBACrC,KAAK,EAAE,IAAI;aACZ,CAAC,CAAA;YAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzD,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;oBAC9B,KAAK,EAAE;wBACL,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC;qBACvB;oBACD,SAAS,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;oBACrC,KAAK,EAAE,IAAI;iBACZ,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;aACC,CAAC;YACJ,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,UAAU,CAAC,QAAQ;oBACtB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;wBACnD,MAAM,EAAE;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;yBAClB;qBACF,CAAC,CAAA;gBACJ,KAAK,UAAU,CAAC,MAAM;oBACpB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,WAAW;wBAC5C,MAAM,EAAE;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;yBAClB;qBACF,CAAC,CAAA;gBACJ,KAAK,UAAU,CAAC,OAAO;oBACrB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,YAAY;qBAC9C,CAAC,CAAA;YACN,CAAC;YAED,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAElD,IAAI,eAAe,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjF,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,kBAAkB,CAAA;YAC7C,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,QAAgB,EAAE,MAAc,EAAE,IAAU;QACvF,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC;aAC1C,kBAAkB,CAAC,WAAW,CAAC;aAC/B,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC;aACpC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC;aAC/B,KAAK,CAAC,gCAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC;aACrD,QAAQ,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,CAAC;aACtD,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aAClD,QAAQ,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;aAC/D,QAAQ,EAAE,CAAA;QAEb,OAAO,MAAM,GAAG,CAAC,CAAA;IACnB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAU,EAAE,MAAc;QAC3D,MAAM,MAAM,GAAG,MAAM,IAAA,qBAAa,EAAC,MAAI,CAAC;aACrC,kBAAkB,CAAC,MAAM,CAAC;aAC1B,iBAAiB,CAAC,YAAY,EAAE,MAAM,CAAC;aACvC,iBAAiB,CAAC,iBAAiB,EAAE,WAAW,CAAC;aACjD,MAAM,CAAC,CAAC,6BAA6B,EAAE,gCAAgC,CAAC,CAAC;aACzE,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aAC/C,QAAQ,CAAC,4BAA4B,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;aAC/D,OAAO,CAAC,oBAAoB,CAAC;aAC7B,UAAU,CAAC,gBAAgB,CAAC;aAC5B,UAAU,EAAE,CAAA;QAEf,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;YAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACxF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACnB,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC,EAAE,EAAE,CAAC,CAAA;QAEN,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,SAAiB,EAAE,QAAgB,EAAE,IAAU;QAClF,OAAO,IAAA,6CAAuB,EAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC3D,CAAC;CACF,CAAA;AA1UY,oBAAI;AAGN;IAFR,IAAA,gCAAsB,EAAC,MAAM,CAAC;IAC9B,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAE,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;;gCACnD;AAInB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;;sCACxD;AAIhB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;;kCACrD;AAIZ;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;;yCACpE;AAKnB;IAHC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IAC1B,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACpC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAM,CAAC,EAAE,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;;qCACxF;AAIlB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,qCAAmB,EAAE,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;;mCACrE;AAeb;IAbC,IAAA,wBAAS,EAAC,gFAAgF,CAAC;IAC3F,IAAA,gBAAM,EAAC;QACN,QAAQ,EAAE,IAAI;QACd,IAAI,EACF,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS;YACpD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,aAAa,IAAI,QAAQ;gBACzB,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,aAAa,IAAI,OAAO;oBACxB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,SAAS;QACnB,MAAM,EAAE,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACrD,CAAC;;sCACc;AAKhB;IAHC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;IAC5C,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAClC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAI,CAAC,EAAE,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;;mCACxD;AAId;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;;sCAC7F;AAIhB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6DAA6D,EAAE,CAAC;;uCACrF;AAIjB;IAFC,IAAA,wBAAS,EAAC,gFAAgF,CAAC;IAC3F,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kCACf;AAIZ;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;;oCACxE;AAKd;IAHC,IAAA,wBAAS,EAAC,gFAAgF,CAAC;IAC3F,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;;mCAC3F;AAiBb;IAfC,IAAA,gBAAM,EAAC;QACN,IAAI,EACF,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS;YACnF,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,aAAa,IAAI,QAAQ;gBACzB,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,aAAa,IAAI,OAAO;oBACxB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,SAAS;QACnB,IAAI,EACF,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAChH,MAAM,EAAE,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QAC9G,OAAO,EAAE,UAAU,CAAC,QAAQ;KAC7B,CAAC;IACD,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;;oCAC5D;AAGlB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;;uCACxB;AAGjB;IADC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;sCACR,IAAI,CAAC,qCAAqC;;+CAAtC;AAGvB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;;mCAC/F;AAGd;IADC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,0CAAiB,EAAE,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;;yCAClC;AAOhC;IALC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,4CAAkB,EAAE,kBAAkB,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC;IAClF,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,4CAAkB,CAAC,EAAE;QACnC,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,uDAAuD;KACrE,CAAC;;gDACsC;AAIxC;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;sCACrE,IAAI;qCAAA;AAGb;IADC,IAAA,oBAAU,EAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;;uCACxB;AAIjB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;sCAC1E,IAAI;qCAAA;AAGb;IADC,IAAA,oBAAU,EAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;;uCACxB;AAIjB;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;sCAC5E,IAAI;uCAAA;AAIf;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;sCACjF,IAAI;IAEf,8BAA8B;;uCAFf;eA3HJ,IAAI;IAXhB,IAAA,gBAAM,GAAE;IACR,IAAA,eAAK,EAAC,WAAW,EAAE,CAAC,IAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAChD,MAAM,EAAE,IAAI;KACb,CAAC;IACD,IAAA,eAAK,EAAC,WAAW,EAAE,CAAC,IAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QACnD,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,wBAAwB;KAChC,CAAC;IACD,IAAA,yBAAU,EAAC;QACV,WAAW,EAAE,oGAAoG;KAClH,CAAC;GACW,IAAI,CA0UhB","sourcesContent":["// This file defines the User entity and its GraphQL schema for authentication and authorization.\n// It includes user fields, status enum, and utility methods for password and privilege management.\n\nimport crypto from 'crypto'\nimport jwt from 'jsonwebtoken'\nimport { Directive, Field, ID, ObjectType } from 'type-graphql'\nimport { GraphQLEmailAddress } from 'graphql-scalars'\nimport {\n  Column,\n  CreateDateColumn,\n  Entity,\n  ILike,\n  Index,\n  JoinTable,\n  ManyToMany,\n  ManyToOne,\n  OneToMany,\n  PrimaryGeneratedColumn,\n  RelationId,\n  UpdateDateColumn\n} from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { validatePasswordByRule } from '../../controllers/utils/password-rule.js'\nimport { AuthError } from '../../errors/auth-error.js'\nimport { SECRET } from '../../utils/get-secret.js'\nimport { Role } from '../role/role.js'\nimport { Privilege } from '../privilege/privilege.js'\nimport { WebAuthCredential } from '../web-auth-credential/web-auth-credential.js'\nimport { UsersAuthProviders } from '../users-auth-providers/users-auth-providers.js'\nimport { getDomainsWithPrivilege } from '../../utils/get-user-domains.js'\n\nconst ORMCONFIG = config.get('ormconfig', {})\nconst DATABASE_TYPE = ORMCONFIG.type\n\nconst sessionExpirySeconds = Number(config.get('session/expirySeconds')) || '7d'\n\nexport enum UserStatus {\n  INACTIVE = 'inactive', // The user account is inactive and cannot log in.\n  ACTIVATED = 'activated', // The user account is active and can log in.\n  DELETED = 'deleted', // The user account has been deleted.\n  LOCKED = 'locked', // The user account is locked due to security reasons.\n  BANNED = 'banned', // The user account is banned from the system.\n  PWD_RESET_REQUIRED = 'password_reset_required' // The user must reset their password before logging in.\n}\n\n@Entity()\n@Index('ix_user_0', (user: User) => [user.email], {\n  unique: true\n})\n@Index('ix_user_1', (user: User) => [user.username], {\n  unique: true,\n  where: '\"username\" IS NOT NULL'\n})\n@ObjectType({\n  description: 'Represents a user account in the system, including authentication, roles, and domain associations.'\n})\nexport class User {\n  @PrimaryGeneratedColumn('uuid')\n  @Field(type => ID, { description: 'Unique identifier for the user.' })\n  readonly id: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Unique username for the user.' })\n  username: string\n\n  @Column()\n  @Field({ nullable: true, description: 'Full name of the user.' })\n  name: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Optional description or note about the user.' })\n  description: string\n\n  @ManyToMany(type => Domain)\n  @JoinTable({ name: 'users_domains' })\n  @Field(type => [Domain], { description: 'Domains (organizations, companies, etc.) the user belongs to.' })\n  domains?: Domain[]\n\n  @Column()\n  @Field(type => GraphQLEmailAddress, { description: 'Email address of the user.' })\n  email: string\n\n  @Directive('@privilege(category: \"security\", privilege: \"query\", domainOwnerGranted: true)')\n  @Column({\n    nullable: true,\n    type:\n      DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'\n        ? 'longtext'\n        : DATABASE_TYPE == 'oracle'\n          ? 'clob'\n          : DATABASE_TYPE == 'mssql'\n            ? 'nvarchar'\n            : 'varchar',\n    length: DATABASE_TYPE == 'mssql' ? 'MAX' : undefined\n  })\n  password: string // Hashed password for authentication\n\n  @ManyToMany(type => Role, role => role.users)\n  @JoinTable({ name: 'users_roles' })\n  @Field(type => [Role], { description: 'Roles assigned to the user.' })\n  roles?: Role[]\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Type or category of the user (e.g., user, application, appliance).' })\n  userType: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Reference information for the user (external system, etc.).' })\n  reference: string\n\n  @Directive('@privilege(category: \"security\", privilege: \"query\", domainOwnerGranted: true)')\n  @Column({ nullable: true })\n  salt: string // Salt used for password hashing\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Locale or language preference for the user.' })\n  locale: string\n\n  @Directive('@privilege(category: \"security\", privilege: \"query\", domainOwnerGranted: true)')\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Single sign-on (SSO) identifier for federated authentication.' })\n  ssoId: string\n\n  @Column({\n    type:\n      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'\n        ? 'enum'\n        : DATABASE_TYPE == 'oracle'\n          ? 'varchar2'\n          : DATABASE_TYPE == 'mssql'\n            ? 'nvarchar'\n            : 'varchar',\n    enum:\n      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? UserStatus : undefined,\n    length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,\n    default: UserStatus.INACTIVE\n  })\n  @Field(type => String, { description: 'Current status of the user account.' })\n  status: UserStatus\n\n  @Column({ type: 'smallint', default: 0 })\n  failCount: number // Number of failed login attempts\n\n  @Column({ nullable: true })\n  passwordUpdatedAt: Date // Last time the password was updated\n\n  @Field({ nullable: true, description: 'Whether the user is the owner of the domain (not persisted in DB).' })\n  owner: boolean /* should not be a column */\n\n  @OneToMany(() => WebAuthCredential, credential => credential.user)\n  credentials: WebAuthCredential[]\n\n  @OneToMany(() => UsersAuthProviders, usersAuthProviders => usersAuthProviders.user)\n  @Field(type => [UsersAuthProviders], {\n    nullable: true,\n    description: 'External authentication providers linked to the user.'\n  })\n  usersAuthProviders: UsersAuthProviders[]\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field({ nullable: true, description: 'User who created this user account.' })\n  creator: User\n\n  @RelationId((user: User) => user.creator)\n  creatorId: string\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field({ nullable: true, description: 'User who last updated this user account.' })\n  updater: User\n\n  @RelationId((user: User) => user.updater)\n  updaterId: string\n\n  @CreateDateColumn()\n  @Field({ nullable: true, description: 'Timestamp when the user account was created.' })\n  createdAt: Date\n\n  @UpdateDateColumn()\n  @Field({ nullable: true, description: 'Timestamp when the user account was last updated.' })\n  updatedAt: Date\n\n  /* signing for jsonwebtoken */\n  async sign(options?) {\n    var { expiresIn = sessionExpirySeconds } = options || {}\n\n    var user = {\n      username: this.username || this.email,\n      email: this.email\n    }\n\n    return await jwt.sign(user, SECRET, {\n      expiresIn,\n      issuer: 'hatiolab.com',\n      subject: 'user'\n    })\n  }\n\n  /* validate password through password rule */\n  static validatePasswordByRule(password, lng) {\n    validatePasswordByRule(password, lng)\n  }\n\n  /* generate salt */\n  static generateSalt() {\n    return crypto.randomBytes(16).toString('hex')\n  }\n\n  /* encode password */\n  static encode(password: string, salt) {\n    return crypto\n      .createHmac('sha256', salt || SECRET)\n      .update(password)\n      .digest('base64')\n  }\n\n  /* verify password */\n  static verify(hashed, password, salt) {\n    return (\n      hashed ==\n        crypto\n          .createHmac('sha256', salt || SECRET)\n          .update(password)\n          .digest('base64') ||\n      hashed ==\n        crypto\n          .createHmac('sha1', salt || SECRET)\n          .update(password)\n          .digest('base64')\n    )\n  }\n\n  static async checkAuthWithEmail(decoded) {\n    if (!decoded?.email) {\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    }\n\n    const repository = getRepository(User)\n    var user = await repository.findOne({\n      where: { email: decoded.email },\n      relations: ['domains'],\n      cache: true\n    })\n\n    if (!user)\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    else {\n      switch (user.status) {\n        case UserStatus.INACTIVE:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,\n            detail: {\n              email: user.email\n            }\n          })\n        case UserStatus.LOCKED:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_LOCKED,\n            detail: {\n              email: user.email\n            }\n          })\n        case UserStatus.DELETED:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_DELETED\n          })\n      }\n\n      return user\n    }\n  }\n\n  static async checkAuth(decoded) {\n    // id 는 하위호환성을 위해 단기적으로 유지함\n    const { id, username } = decoded || {}\n\n    if (!id && !username) {\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    }\n\n    const repository = getRepository(User)\n    if (id) {\n      var user = await repository.findOne({\n        where: { id },\n        relations: ['domains', 'credentials'],\n        cache: true\n      })\n    } else {\n      var user = await repository.findOne({\n        where: { username },\n        relations: ['domains', 'credentials'],\n        cache: true\n      })\n\n      if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n        user = await repository.findOne({\n          where: {\n            email: ILike(username)\n          },\n          relations: ['domains', 'credentials'],\n          cache: true\n        })\n      }\n    }\n\n    if (!user)\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    else {\n      switch (user.status) {\n        case UserStatus.INACTIVE:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,\n            detail: {\n              email: user.email\n            }\n          })\n        case UserStatus.LOCKED:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_LOCKED,\n            detail: {\n              email: user.email\n            }\n          })\n        case UserStatus.DELETED:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_DELETED\n          })\n      }\n\n      const { defaultPassword } = config.get('password')\n\n      if (defaultPassword && user.password === this.encode(defaultPassword, user.salt)) {\n        user.status = UserStatus.PWD_RESET_REQUIRED\n      }\n\n      return user\n    }\n  }\n\n  static async hasPrivilege(privilege: string, category: string, domain: Domain, user: User): Promise<boolean> {\n    const result = await getRepository(Privilege)\n      .createQueryBuilder('privilege')\n      .innerJoin('privilege.roles', 'role')\n      .innerJoin('role.users', 'user')\n      .where('privilege.category = :category', { category })\n      .andWhere('privilege.name = :privilege', { privilege })\n      .andWhere('user.id = :userId', { userId: user.id })\n      .andWhere('role.domain.id = :domainId', { domainId: domain.id })\n      .getCount()\n\n    return result > 0\n  }\n\n  static async getPrivilegesByDomain(user: User, domain: Domain): Promise<{ category: string; privilege: string }[]> {\n    const result = await getRepository(User)\n      .createQueryBuilder('user')\n      .leftJoinAndSelect('user.roles', 'role')\n      .leftJoinAndSelect('role.privileges', 'privilege')\n      .select(['privilege.name AS privilege', 'privilege.category AS category'])\n      .where('user.id = :userId', { userId: user.id })\n      .andWhere('role.domain.id = :domainId', { domainId: domain.id })\n      .orderBy('privilege.category')\n      .addOrderBy('privilege.name')\n      .getRawMany()\n\n    const distinct = result.reduce((acc, current) => {\n      const last = acc[acc.length - 1]\n      if (!last || last.privilege !== current.privilege || last.category !== current.category) {\n        acc.push(current)\n      }\n      return acc\n    }, [])\n\n    return distinct\n  }\n\n  static async getDomainsWithPrivilege(privilege: string, category: string, user: User) {\n    return getDomainsWithPrivilege(user, privilege, category)\n  }\n}\n"]}
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../server/service/user/user.ts"],"names":[],"mappings":";AAAA,iGAAiG;AACjG,mGAAmG;;;;;AAEnG,4DAA2B;AAC3B,wEAA8B;AAC9B,+CAA+D;AAC/D,qDAAqD;AACrD,qCAagB;AAEhB,6CAA4C;AAC5C,iDAA+G;AAE/G,+EAAiF;AACjF,8DAAsD;AACtD,6DAAkD;AAClD,6CAAsC;AACtC,4DAAqD;AACrD,0FAAiF;AACjF,6FAAoF;AAEpF,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AAC7C,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAA;AAEpC,MAAM,oBAAoB,GAAG,MAAM,CAAC,YAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,IAAI,IAAI,CAAA;AAEhF,IAAY,UAOX;AAPD,WAAY,UAAU;IACpB,mCAAqB,CAAA;IACrB,qCAAuB,CAAA;IACvB,iCAAmB,CAAA;IACnB,+BAAiB,CAAA;IACjB,+BAAiB,CAAA;IACjB,4DAA8C,CAAA,CAAC,wDAAwD;AACzG,CAAC,EAPW,UAAU,0BAAV,UAAU,QAOrB;AAaM,IAAM,IAAI,YAAV,MAAM,IAAI;IA6Hf,8BAA8B;IAC9B,KAAK,CAAC,IAAI,CAAC,OAAQ;QACjB,IAAI,EAAE,SAAS,GAAG,oBAAoB,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;QAExD,IAAI,IAAI,GAAG;YACT,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK;YACrC,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAA;QAED,OAAO,MAAM,sBAAG,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAM,EAAE;YAClC,SAAS;YACT,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;IACJ,CAAC;IAED,6CAA6C;IAC7C,MAAM,CAAC,sBAAsB,CAAC,QAAQ,EAAE,GAAG;QACzC,IAAA,yCAAsB,EAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;IAED,mBAAmB;IACnB,MAAM,CAAC,YAAY;QACjB,OAAO,gBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC/C,CAAC;IAED,qBAAqB;IACrB,MAAM,CAAC,MAAM,CAAC,QAAgB,EAAE,IAAI;QAClC,OAAO,gBAAM;aACV,UAAU,CAAC,QAAQ,EAAE,IAAI,IAAI,sBAAM,CAAC;aACpC,MAAM,CAAC,QAAQ,CAAC;aAChB,MAAM,CAAC,QAAQ,CAAC,CAAA;IACrB,CAAC;IAED,qBAAqB;IACrB,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI;QAClC,OAAO,CACL,MAAM;YACJ,gBAAM;iBACH,UAAU,CAAC,QAAQ,EAAE,IAAI,IAAI,sBAAM,CAAC;iBACpC,MAAM,CAAC,QAAQ,CAAC;iBAChB,MAAM,CAAC,QAAQ,CAAC;YACrB,MAAM;gBACJ,gBAAM;qBACH,UAAU,CAAC,MAAM,EAAE,IAAI,IAAI,sBAAM,CAAC;qBAClC,MAAM,CAAC,QAAQ,CAAC;qBAChB,MAAM,CAAC,QAAQ,CAAC,CACtB,CAAA;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,OAAO;QACrC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;YACpB,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,MAAI,CAAC,CAAA;QACtC,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAClC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE;YAC/B,SAAS,EAAE,CAAC,SAAS,CAAC;YACtB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;aACC,CAAC;YACJ,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,UAAU,CAAC,QAAQ;oBACtB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;wBACnD,MAAM,EAAE;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;yBAClB;qBACF,CAAC,CAAA;gBACJ,KAAK,UAAU,CAAC,MAAM;oBACpB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,WAAW;wBAC5C,MAAM,EAAE;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;yBAClB;qBACF,CAAC,CAAA;gBACJ,KAAK,UAAU,CAAC,OAAO;oBACrB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,YAAY;qBAC9C,CAAC,CAAA;YACN,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO;QAC5B,2BAA2B;QAC3B,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;QAEtC,IAAI,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,MAAI,CAAC,CAAA;QACtC,IAAI,EAAE,EAAE,CAAC;YACP,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,EAAE,EAAE;gBACb,SAAS,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;gBACrC,KAAK,EAAE,IAAI;aACZ,CAAC,CAAA;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,QAAQ,EAAE;gBACnB,SAAS,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;gBACrC,KAAK,EAAE,IAAI;aACZ,CAAC,CAAA;YAEF,IAAI,CAAC,IAAI,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzD,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;oBAC9B,KAAK,EAAE;wBACL,KAAK,EAAE,IAAA,eAAK,EAAC,QAAQ,CAAC;qBACvB;oBACD,SAAS,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;oBACrC,KAAK,EAAE,IAAI;iBACZ,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,yBAAS,CAAC;gBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,cAAc;aAChD,CAAC,CAAA;aACC,CAAC;YACJ,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,UAAU,CAAC,QAAQ;oBACtB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,kBAAkB;wBACnD,MAAM,EAAE;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;yBAClB;qBACF,CAAC,CAAA;gBACJ,KAAK,UAAU,CAAC,MAAM;oBACpB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,WAAW;wBAC5C,MAAM,EAAE;4BACN,KAAK,EAAE,IAAI,CAAC,KAAK;yBAClB;qBACF,CAAC,CAAA;gBACJ,KAAK,UAAU,CAAC,OAAO;oBACrB,MAAM,IAAI,yBAAS,CAAC;wBAClB,SAAS,EAAE,yBAAS,CAAC,WAAW,CAAC,YAAY;qBAC9C,CAAC,CAAA;YACN,CAAC;YAED,MAAM,EAAE,eAAe,EAAE,GAAG,YAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YAElD,IAAI,eAAe,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjF,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,kBAAkB,CAAA;YAC7C,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,QAAgB,EAAE,MAAc,EAAE,IAAU;QACvF,MAAM,YAAY,GAAG,IAAA,qBAAa,EAAC,wBAAS,CAAC;aAC1C,kBAAkB,CAAC,WAAW,CAAC;aAC/B,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC;aACpC,SAAS,CAAC,YAAY,EAAE,MAAM,CAAC;aAC/B,KAAK,CAAC,gCAAgC,EAAE,EAAE,QAAQ,EAAE,CAAC;aACrD,QAAQ,CAAC,6BAA6B,EAAE,EAAE,SAAS,EAAE,CAAC;aACtD,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QAErD,IAAA,oCAA4B,EAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,0BAAkB,CAAC,OAAO,CAAC,CAAA;QAEtF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,CAAA;QAE5C,OAAO,MAAM,GAAG,CAAC,CAAA;IACnB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAU,EAAE,MAAc;QAC3D,MAAM,YAAY,GAAG,IAAA,qBAAa,EAAC,MAAI,CAAC;aACrC,kBAAkB,CAAC,MAAM,CAAC;aAC1B,iBAAiB,CAAC,YAAY,EAAE,MAAM,CAAC;aACvC,iBAAiB,CAAC,iBAAiB,EAAE,WAAW,CAAC;aACjD,MAAM,CAAC,CAAC,6BAA6B,EAAE,gCAAgC,CAAC,CAAC;aACzE,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;QAElD,IAAA,oCAA4B,EAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,0BAAkB,CAAC,OAAO,CAAC,CAAA;QAEtF,MAAM,MAAM,GAAG,MAAM,YAAY;aAC9B,OAAO,CAAC,oBAAoB,CAAC;aAC7B,UAAU,CAAC,gBAAgB,CAAC;aAC5B,UAAU,EAAE,CAAA;QAEf,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;YAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAChC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACxF,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YACnB,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC,EAAE,EAAE,CAAC,CAAA;QAEN,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,uBAAuB,CAAC,SAAiB,EAAE,QAAgB,EAAE,IAAU;QAClF,MAAM,EAAE,uBAAuB,EAAE,GAAG,gEAAa,iCAAiC,GAAC,CAAA;QAEnF,OAAO,uBAAuB,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC3D,CAAC;CACF,CAAA;AA7VY,oBAAI;AAGN;IAFR,IAAA,gCAAsB,EAAC,MAAM,CAAC;IAC9B,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAE,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;;gCACnD;AAInB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;;sCACxD;AAIhB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;;kCACrD;AAIZ;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;;yCACpE;AAKnB;IAHC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IAC1B,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACpC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAM,CAAC,EAAE,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;;qCACxF;AAIlB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,qCAAmB,EAAE,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;;mCACrE;AAeb;IAbC,IAAA,wBAAS,EAAC,gFAAgF,CAAC;IAC3F,IAAA,gBAAM,EAAC;QACN,QAAQ,EAAE,IAAI;QACd,IAAI,EACF,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS;YACpD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,aAAa,IAAI,QAAQ;gBACzB,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,aAAa,IAAI,OAAO;oBACxB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,SAAS;QACnB,MAAM,EAAE,aAAa,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;KACrD,CAAC;;sCACc;AAKhB;IAHC,IAAA,oBAAU,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;IAC5C,IAAA,mBAAS,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;IAClC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAI,CAAC,EAAE,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;;mCACxD;AAId;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;;sCAC7F;AAIhB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6DAA6D,EAAE,CAAC;;uCACrF;AAIjB;IAFC,IAAA,wBAAS,EAAC,gFAAgF,CAAC;IAC3F,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kCACf;AAIZ;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;;oCACxE;AAKd;IAHC,IAAA,wBAAS,EAAC,gFAAgF,CAAC;IAC3F,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;;mCAC3F;AAiBb;IAfC,IAAA,gBAAM,EAAC;QACN,IAAI,EACF,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS;YACnF,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,aAAa,IAAI,QAAQ;gBACzB,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,aAAa,IAAI,OAAO;oBACxB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,SAAS;QACnB,IAAI,EACF,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAChH,MAAM,EAAE,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QAC9G,OAAO,EAAE,UAAU,CAAC,QAAQ;KAC7B,CAAC;IACD,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;;oCAC5D;AAGlB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;;uCACxB;AAGjB;IADC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;sCACR,IAAI,CAAC,qCAAqC;;+CAAtC;AAGvB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oEAAoE,EAAE,CAAC;;mCAC/F;AAGd;IADC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,0CAAiB,EAAE,UAAU,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;;yCAClC;AAOhC;IALC,IAAA,mBAAS,EAAC,GAAG,EAAE,CAAC,4CAAkB,EAAE,kBAAkB,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC;IAClF,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,4CAAkB,CAAC,EAAE;QACnC,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,uDAAuD;KACrE,CAAC;;gDACsC;AAIxC;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;sCACrE,IAAI;qCAAA;AAGb;IADC,IAAA,oBAAU,EAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;;uCACxB;AAIjB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;sCAC1E,IAAI;qCAAA;AAGb;IADC,IAAA,oBAAU,EAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;;uCACxB;AAIjB;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;sCAC5E,IAAI;uCAAA;AAIf;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;sCACjF,IAAI;IAEf,8BAA8B;;uCAFf;eA3HJ,IAAI;IAXhB,IAAA,gBAAM,GAAE;IACR,IAAA,eAAK,EAAC,WAAW,EAAE,CAAC,IAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;QAChD,MAAM,EAAE,IAAI;KACb,CAAC;IACD,IAAA,eAAK,EAAC,WAAW,EAAE,CAAC,IAAU,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;QACnD,MAAM,EAAE,IAAI;QACZ,KAAK,EAAE,wBAAwB;KAChC,CAAC;IACD,IAAA,yBAAU,EAAC;QACV,WAAW,EAAE,oGAAoG;KAClH,CAAC;GACW,IAAI,CA6VhB","sourcesContent":["// This file defines the User entity and its GraphQL schema for authentication and authorization.\n// It includes user fields, status enum, and utility methods for password and privilege management.\n\nimport crypto from 'crypto'\nimport jwt from 'jsonwebtoken'\nimport { Directive, Field, ID, ObjectType } from 'type-graphql'\nimport { GraphQLEmailAddress } from 'graphql-scalars'\nimport {\n  Column,\n  CreateDateColumn,\n  Entity,\n  ILike,\n  Index,\n  JoinTable,\n  ManyToMany,\n  ManyToOne,\n  OneToMany,\n  PrimaryGeneratedColumn,\n  RelationId,\n  UpdateDateColumn\n} from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { applyDomainInheritanceFilter, Domain, getRepository, InheritedValueType } from '@things-factory/shell'\n\nimport { validatePasswordByRule } from '../../controllers/utils/password-rule.js'\nimport { AuthError } from '../../errors/auth-error.js'\nimport { SECRET } from '../../utils/get-secret.js'\nimport { Role } from '../role/role.js'\nimport { Privilege } from '../privilege/privilege.js'\nimport { WebAuthCredential } from '../web-auth-credential/web-auth-credential.js'\nimport { UsersAuthProviders } from '../users-auth-providers/users-auth-providers.js'\n\nconst ORMCONFIG = config.get('ormconfig', {})\nconst DATABASE_TYPE = ORMCONFIG.type\n\nconst sessionExpirySeconds = Number(config.get('session/expirySeconds')) || '7d'\n\nexport enum UserStatus {\n  INACTIVE = 'inactive', // The user account is inactive and cannot log in.\n  ACTIVATED = 'activated', // The user account is active and can log in.\n  DELETED = 'deleted', // The user account has been deleted.\n  LOCKED = 'locked', // The user account is locked due to security reasons.\n  BANNED = 'banned', // The user account is banned from the system.\n  PWD_RESET_REQUIRED = 'password_reset_required' // The user must reset their password before logging in.\n}\n\n@Entity()\n@Index('ix_user_0', (user: User) => [user.email], {\n  unique: true\n})\n@Index('ix_user_1', (user: User) => [user.username], {\n  unique: true,\n  where: '\"username\" IS NOT NULL'\n})\n@ObjectType({\n  description: 'Represents a user account in the system, including authentication, roles, and domain associations.'\n})\nexport class User {\n  @PrimaryGeneratedColumn('uuid')\n  @Field(type => ID, { description: 'Unique identifier for the user.' })\n  readonly id: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Unique username for the user.' })\n  username: string\n\n  @Column()\n  @Field({ nullable: true, description: 'Full name of the user.' })\n  name: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Optional description or note about the user.' })\n  description: string\n\n  @ManyToMany(type => Domain)\n  @JoinTable({ name: 'users_domains' })\n  @Field(type => [Domain], { description: 'Domains (organizations, companies, etc.) the user belongs to.' })\n  domains?: Domain[]\n\n  @Column()\n  @Field(type => GraphQLEmailAddress, { description: 'Email address of the user.' })\n  email: string\n\n  @Directive('@privilege(category: \"security\", privilege: \"query\", domainOwnerGranted: true)')\n  @Column({\n    nullable: true,\n    type:\n      DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'\n        ? 'longtext'\n        : DATABASE_TYPE == 'oracle'\n          ? 'clob'\n          : DATABASE_TYPE == 'mssql'\n            ? 'nvarchar'\n            : 'varchar',\n    length: DATABASE_TYPE == 'mssql' ? 'MAX' : undefined\n  })\n  password: string // Hashed password for authentication\n\n  @ManyToMany(type => Role, role => role.users)\n  @JoinTable({ name: 'users_roles' })\n  @Field(type => [Role], { description: 'Roles assigned to the user.' })\n  roles?: Role[]\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Type or category of the user (e.g., user, application, appliance).' })\n  userType: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Reference information for the user (external system, etc.).' })\n  reference: string\n\n  @Directive('@privilege(category: \"security\", privilege: \"query\", domainOwnerGranted: true)')\n  @Column({ nullable: true })\n  salt: string // Salt used for password hashing\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Locale or language preference for the user.' })\n  locale: string\n\n  @Directive('@privilege(category: \"security\", privilege: \"query\", domainOwnerGranted: true)')\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'Single sign-on (SSO) identifier for federated authentication.' })\n  ssoId: string\n\n  @Column({\n    type:\n      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'\n        ? 'enum'\n        : DATABASE_TYPE == 'oracle'\n          ? 'varchar2'\n          : DATABASE_TYPE == 'mssql'\n            ? 'nvarchar'\n            : 'varchar',\n    enum:\n      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? UserStatus : undefined,\n    length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,\n    default: UserStatus.INACTIVE\n  })\n  @Field(type => String, { description: 'Current status of the user account.' })\n  status: UserStatus\n\n  @Column({ type: 'smallint', default: 0 })\n  failCount: number // Number of failed login attempts\n\n  @Column({ nullable: true })\n  passwordUpdatedAt: Date // Last time the password was updated\n\n  @Field({ nullable: true, description: 'Whether the user is the owner of the domain (not persisted in DB).' })\n  owner: boolean /* should not be a column */\n\n  @OneToMany(() => WebAuthCredential, credential => credential.user)\n  credentials: WebAuthCredential[]\n\n  @OneToMany(() => UsersAuthProviders, usersAuthProviders => usersAuthProviders.user)\n  @Field(type => [UsersAuthProviders], {\n    nullable: true,\n    description: 'External authentication providers linked to the user.'\n  })\n  usersAuthProviders: UsersAuthProviders[]\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field({ nullable: true, description: 'User who created this user account.' })\n  creator: User\n\n  @RelationId((user: User) => user.creator)\n  creatorId: string\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field({ nullable: true, description: 'User who last updated this user account.' })\n  updater: User\n\n  @RelationId((user: User) => user.updater)\n  updaterId: string\n\n  @CreateDateColumn()\n  @Field({ nullable: true, description: 'Timestamp when the user account was created.' })\n  createdAt: Date\n\n  @UpdateDateColumn()\n  @Field({ nullable: true, description: 'Timestamp when the user account was last updated.' })\n  updatedAt: Date\n\n  /* signing for jsonwebtoken */\n  async sign(options?) {\n    var { expiresIn = sessionExpirySeconds } = options || {}\n\n    var user = {\n      username: this.username || this.email,\n      email: this.email\n    }\n\n    return await jwt.sign(user, SECRET, {\n      expiresIn,\n      issuer: 'hatiolab.com',\n      subject: 'user'\n    })\n  }\n\n  /* validate password through password rule */\n  static validatePasswordByRule(password, lng) {\n    validatePasswordByRule(password, lng)\n  }\n\n  /* generate salt */\n  static generateSalt() {\n    return crypto.randomBytes(16).toString('hex')\n  }\n\n  /* encode password */\n  static encode(password: string, salt) {\n    return crypto\n      .createHmac('sha256', salt || SECRET)\n      .update(password)\n      .digest('base64')\n  }\n\n  /* verify password */\n  static verify(hashed, password, salt) {\n    return (\n      hashed ==\n        crypto\n          .createHmac('sha256', salt || SECRET)\n          .update(password)\n          .digest('base64') ||\n      hashed ==\n        crypto\n          .createHmac('sha1', salt || SECRET)\n          .update(password)\n          .digest('base64')\n    )\n  }\n\n  static async checkAuthWithEmail(decoded) {\n    if (!decoded?.email) {\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    }\n\n    const repository = getRepository(User)\n    var user = await repository.findOne({\n      where: { email: decoded.email },\n      relations: ['domains'],\n      cache: true\n    })\n\n    if (!user)\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    else {\n      switch (user.status) {\n        case UserStatus.INACTIVE:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,\n            detail: {\n              email: user.email\n            }\n          })\n        case UserStatus.LOCKED:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_LOCKED,\n            detail: {\n              email: user.email\n            }\n          })\n        case UserStatus.DELETED:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_DELETED\n          })\n      }\n\n      return user\n    }\n  }\n\n  static async checkAuth(decoded) {\n    // id 는 하위호환성을 위해 단기적으로 유지함\n    const { id, username } = decoded || {}\n\n    if (!id && !username) {\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    }\n\n    const repository = getRepository(User)\n    if (id) {\n      var user = await repository.findOne({\n        where: { id },\n        relations: ['domains', 'credentials'],\n        cache: true\n      })\n    } else {\n      var user = await repository.findOne({\n        where: { username },\n        relations: ['domains', 'credentials'],\n        cache: true\n      })\n\n      if (!user && /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(username)) {\n        user = await repository.findOne({\n          where: {\n            email: ILike(username)\n          },\n          relations: ['domains', 'credentials'],\n          cache: true\n        })\n      }\n    }\n\n    if (!user)\n      throw new AuthError({\n        errorCode: AuthError.ERROR_CODES.USER_NOT_FOUND\n      })\n    else {\n      switch (user.status) {\n        case UserStatus.INACTIVE:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_NOT_ACTIVATED,\n            detail: {\n              email: user.email\n            }\n          })\n        case UserStatus.LOCKED:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_LOCKED,\n            detail: {\n              email: user.email\n            }\n          })\n        case UserStatus.DELETED:\n          throw new AuthError({\n            errorCode: AuthError.ERROR_CODES.USER_DELETED\n          })\n      }\n\n      const { defaultPassword } = config.get('password')\n\n      if (defaultPassword && user.password === this.encode(defaultPassword, user.salt)) {\n        user.status = UserStatus.PWD_RESET_REQUIRED\n      }\n\n      return user\n    }\n  }\n\n  /**\n   * 역할은 부모 도메인으로부터 상속되므로, 권한 판정도 현재 도메인과 부모 도메인에 정의된\n   * 역할을 함께 본다 (상속 규약 단일 소스: `applyDomainInheritanceFilter`).\n   * 부모 역할이 형제 자식 도메인으로 번지지 않도록 하는 것은 체크인 게이트(`getUserDomains`)의\n   * 멤버십 조건이 담당한다.\n   */\n  static async hasPrivilege(privilege: string, category: string, domain: Domain, user: User): Promise<boolean> {\n    const queryBuilder = getRepository(Privilege)\n      .createQueryBuilder('privilege')\n      .innerJoin('privilege.roles', 'role')\n      .innerJoin('role.users', 'user')\n      .where('privilege.category = :category', { category })\n      .andWhere('privilege.name = :privilege', { privilege })\n      .andWhere('user.id = :userId', { userId: user.id })\n\n    applyDomainInheritanceFilter(queryBuilder, 'role', domain, InheritedValueType.Include)\n\n    const result = await queryBuilder.getCount()\n\n    return result > 0\n  }\n\n  static async getPrivilegesByDomain(user: User, domain: Domain): Promise<{ category: string; privilege: string }[]> {\n    const queryBuilder = getRepository(User)\n      .createQueryBuilder('user')\n      .leftJoinAndSelect('user.roles', 'role')\n      .leftJoinAndSelect('role.privileges', 'privilege')\n      .select(['privilege.name AS privilege', 'privilege.category AS category'])\n      .where('user.id = :userId', { userId: user.id })\n\n    applyDomainInheritanceFilter(queryBuilder, 'role', domain, InheritedValueType.Include)\n\n    const result = await queryBuilder\n      .orderBy('privilege.category')\n      .addOrderBy('privilege.name')\n      .getRawMany()\n\n    const distinct = result.reduce((acc, current) => {\n      const last = acc[acc.length - 1]\n      if (!last || last.privilege !== current.privilege || last.category !== current.category) {\n        acc.push(current)\n      }\n      return acc\n    }, [])\n\n    return distinct\n  }\n\n  /**\n   * 엔티티에서 조회 유틸을 정적으로 import 하면 순환 참조가 된다\n   * (user → get-user-domains → checkin-domain-facts → granted-role → role → user).\n   * 순환 참조 상태에서 엔티티 데코레이터가 평가되면 type-graphql 이 타입을 추론하지 못해\n   * 모듈 로드 자체가 실패하므로, 호출 시점에 지연 로드한다.\n   */\n  static async getDomainsWithPrivilege(privilege: string, category: string, user: User) {\n    const { getDomainsWithPrivilege } = await import('../../utils/get-user-domains.js')\n\n    return getDomainsWithPrivilege(user, privilege, category)\n  }\n}\n"]}