@things-factory/auth-base 10.1.107 → 10.1.113
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist-server/ai-entry/access-assistant.d.ts +8 -0
- package/dist-server/ai-entry/access-assistant.js +9 -1
- package/dist-server/ai-entry/access-assistant.js.map +1 -1
- package/dist-server/ai-entry/access-entry-targets.js +4 -3
- package/dist-server/ai-entry/access-entry-targets.js.map +1 -1
- package/dist-server/controllers/access-request.d.ts +2 -0
- package/dist-server/controllers/access-request.js +56 -18
- package/dist-server/controllers/access-request.js.map +1 -1
- package/dist-server/service/access-request/access-request-query.d.ts +2 -0
- package/dist-server/service/access-request/access-request-query.js +22 -5
- package/dist-server/service/access-request/access-request-query.js.map +1 -1
- package/dist-server/service/appliance/appliance-query.js +4 -2
- package/dist-server/service/appliance/appliance-query.js.map +1 -1
- package/dist-server/service/application/application-query.js +2 -1
- package/dist-server/service/application/application-query.js.map +1 -1
- package/dist-server/service/auth-provider/auth-provider-query.js +2 -1
- package/dist-server/service/auth-provider/auth-provider-query.js.map +1 -1
- package/dist-server/service/index.d.ts +1 -1
- package/dist-server/service/invitation/invitation-query.js +2 -1
- package/dist-server/service/invitation/invitation-query.js.map +1 -1
- package/dist-server/service/login-history/login-history-query.js +8 -4
- package/dist-server/service/login-history/login-history-query.js.map +1 -1
- package/dist-server/service/open-fields.js +1 -0
- package/dist-server/service/open-fields.js.map +1 -1
- package/dist-server/service/partner/partner-query.js +2 -1
- package/dist-server/service/partner/partner-query.js.map +1 -1
- package/dist-server/service/role/role-query.d.ts +2 -0
- package/dist-server/service/role/role-query.js +12 -0
- package/dist-server/service/role/role-query.js.map +1 -1
- package/dist-server/service/user/index.d.ts +1 -1
- package/dist-server/service/user/user-mutation.js +1 -1
- package/dist-server/service/user/user-mutation.js.map +1 -1
- package/dist-server/tsconfig.tsbuildinfo +1 -1
- package/dist-server/utils/access-request-review.d.ts +3 -0
- package/dist-server/utils/access-request-review.js +3 -0
- package/dist-server/utils/access-request-review.js.map +1 -1
- package/dist-server/utils/assignable-roles.d.ts +11 -1
- package/dist-server/utils/assignable-roles.js +73 -1
- package/dist-server/utils/assignable-roles.js.map +1 -1
- package/package.json +2 -2
- package/tests/access-request-db.test.ts +44 -0
- package/tests/access-request-pg.test.ts +11 -0
- package/tests/access-request-review.test.ts +8 -0
- package/tests/assignable-roles-db.test.ts +79 -1
- package/tests/list-inheritance-db.test.ts +149 -0
- package/translations/en.json +2 -1
- package/translations/ja.json +2 -1
- package/translations/ko.json +2 -1
- package/translations/ms.json +2 -1
- package/translations/zh.json +2 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"access-request-query.js","sourceRoot":"","sources":["../../../server/service/access-request/access-request-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8E;AAE9E,
|
|
1
|
+
{"version":3,"file":"access-request-query.js","sourceRoot":"","sources":["../../../server/service/access-request/access-request-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8E;AAE9E,iDAAmH;AAEnH,2EAAmG;AACnG,yEAA0E;AAC1E,2DAAmD;AACnD,uEAA4H;AAE5H,gFAAgF;AAChF,MAAM,MAAM,GAAG,+EAA+E,CAAA;AAGvF,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B;;;OAGG;IAGG,AAAN,KAAK,CAAC,cAAc,CAA0B,MAAiB,EAAS,OAAwB;QAC9F,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;YACjD,MAAM;YACN,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,0BAAkB,CAAC,IAAI,EAAE;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,iCAAa,CAAC;YACxC,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC;SACjD,CAAC,CAAA;QACF,YAAY,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC,iBAAiB,CAAC,2BAA2B,EAAE,aAAa,CAAC,CAAA;QAC9L,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAED,sFAAsF;IAEhF,AAAN,KAAK,CAAC,gBAAgB,CAAQ,OAAwB;QACpD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACtC,OAAO,MAAM,IAAA,qBAAa,EAAC,iCAAa,CAAC,CAAC,IAAI,CAAC;YAC7C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE;YAChE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC;YACjD,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5B,IAAI,EAAE,GAAG;SACV,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IAEG,AAAN,KAAK,CAAC,yBAAyB,CAAQ,OAAwB;QAC7D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACtC,OAAO,CAAC,MAAM,IAAA,kCAAc,EAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;IACvD,CAAC;IAIK,AAAN,KAAK,CAAC,aAAa,CAAkB,QAAgB,EAAoB,SAAiB,EAAS,OAAwB;QACzH,OAAO,CAAC,MAAM,IAAA,iCAAa,EAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;IAC/I,CAAC;IAED,4HAA4H;IAGtH,AAAN,KAAK,CAAC,oBAAoB,CAAc,IAAY,EAAS,OAAwB;QACnF,MAAM,KAAK,GAAG,MAAM,IAAA,8CAAwB,EAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACxE,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;IAC5G,CAAC;IAED,iHAAiH;IAG3G,AAAN,KAAK,CAAC,oBAAoB,CAA+C,QAA6B,EAAS,OAAwB;QACrI,OAAO,CAAC,MAAM,IAAA,kCAAc,EAAC,QAAe,EAAE,OAAO,CAAC,CAA0B,CAAA;IAClF,CAAC;CACF,CAAA;AA/DY,gDAAkB;AAOvB;IAFL,IAAA,wBAAS,EAAC,MAAM,CAAC;IACjB,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,2CAAiB,EAAE,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;IAC1E,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;wDAY9D;AAIK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,iCAAa,CAAC,EAAE,EAAE,WAAW,EAAE,yEAAyE,EAAE,CAAC;IACtG,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0DAQ5B;AAOK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,4FAA4F,EAAE,CAAC;IACpG,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;mEAGrC;AAIK;IAFL,IAAA,wBAAS,EAAC,MAAM,CAAC;IACjB,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6CAAmB,CAAC,EAAE,EAAE,WAAW,EAAE,2FAA2F,EAAE,CAAC;IACjI,mBAAA,IAAA,kBAAG,EAAC,UAAU,CAAC,CAAA;IAAoB,mBAAA,IAAA,kBAAG,EAAC,WAAW,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;uDAEjG;AAKK;IAFL,IAAA,wBAAS,EAAC,MAAM,CAAC;IACjB,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6CAAmB,CAAC,EAAE,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;IAC1F,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IAAgB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;8DAG3D;AAKK;IAFL,IAAA,wBAAS,EAAC,MAAM,CAAC;IACjB,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6CAAmB,CAAC,EAAE,EAAE,WAAW,EAAE,kGAAkG,EAAE,CAAC;IACjI,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,6CAAmB,CAAC,CAAA;IAAiC,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAA3B,6CAAmB;;8DAErG;6BA9DU,kBAAkB;IAD9B,IAAA,uBAAQ,EAAC,iCAAa,CAAC;GACX,kBAAkB,CA+D9B","sourcesContent":["import { Arg, Args, Ctx, Directive, Int, Query, Resolver } from 'type-graphql'\n\nimport { getQueryBuilderFromListParams, getRepository, InheritedValueType, ListParam } from '@things-factory/shell'\n\nimport { findDeciderIds, reviewDecision, rolesGranting } from '../../controllers/access-request.js'\nimport { findAssignableRolesNamed } from '../../utils/assignable-roles.js'\nimport { AccessRequest } from './access-request.js'\nimport { AccessDecisionInput, AccessDecisionIssue, AccessRequestList, AccessRoleCandidate } from './access-request-types.js'\n\n/* The review and the candidates serve a decision - the deciding declaration. */\nconst DECIDE = '@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)'\n\n@Resolver(AccessRequest)\nexport class AccessRequestQuery {\n /*\n * A decider's list - the same declaration as the decision, so the people told of a request can open it (ADR-0103).\n * This domain's rows only: `inherited` is pinned, a parent domain's requests are not this domain's to read.\n */\n @Directive(DECIDE)\n @Query(returns => AccessRequestList, { description: \"To fetch this domain's access requests.\" })\n async accessRequests(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<AccessRequestList> {\n const { domain } = context.state\n const queryBuilder = getQueryBuilderFromListParams({\n domain,\n params: { ...params, inherited: InheritedValueType.None },\n repository: getRepository(AccessRequest),\n alias: 'accessRequest',\n searchables: ['category', 'privilege', 'reason']\n })\n queryBuilder.leftJoinAndSelect('accessRequest.requester', 'requester').leftJoinAndSelect('accessRequest.decidedBy', 'decidedBy').leftJoinAndSelect('accessRequest.grantedRole', 'grantedRole')\n const [items, total] = await queryBuilder.getManyAndCount()\n return { items, total }\n }\n\n /** Open by design: the caller's own requests - where they see what became of them. */\n @Query(returns => [AccessRequest], { description: \"To fetch the caller's own access requests in this domain, newest first.\" })\n async myAccessRequests(@Ctx() context: ResolverContext): Promise<AccessRequest[]> {\n const { domain, user } = context.state\n return await getRepository(AccessRequest).find({\n where: { domain: { id: domain.id }, requester: { id: user.id } },\n relations: ['domain', 'requester', 'grantedRole'],\n order: { createdAt: 'DESC' },\n take: 100\n })\n }\n\n /**\n * Open by design: how many people a request would reach - the popup says it before the person sends, so asking reads\n * as what it is. A number, never who.\n */\n @Query(returns => Int, { description: 'To count the people who would be told of an access request from the caller in this domain.' })\n async accessRequestDeciderCount(@Ctx() context: ResolverContext): Promise<number> {\n const { domain, user } = context.state\n return (await findDeciderIds(domain, user.id)).length\n }\n\n @Directive(DECIDE)\n @Query(returns => [AccessRoleCandidate], { description: 'To list the roles this domain can assign that grant a privilege, fewest privileges first.' })\n async rolesGranting(@Arg('category') category: string, @Arg('privilege') privilege: string, @Ctx() context: ResolverContext): Promise<AccessRoleCandidate[]> {\n return (await rolesGranting(category, privilege, context.state.domain)).map(({ id, name, privilegeCount }) => ({ id, name, privilegeCount }))\n }\n\n /** The roles of this domain's assignable scope (own, parent, granted) with exactly this name - what a decision may name. */\n @Directive(DECIDE)\n @Query(returns => [AccessRoleCandidate], { description: 'To find, by exact name, the roles this domain can assign.' })\n async assignableRolesNamed(@Arg('name') name: string, @Ctx() context: ResolverContext): Promise<AccessRoleCandidate[]> {\n const roles = await findAssignableRolesNamed(name, context.state.domain)\n return roles.map(role => ({ id: role.id, name: role.name, privilegeCount: role.privileges?.length ?? 0 }))\n }\n\n /** The same review the decision runs - the list screen and the AI draft card show this (ADR-0103 decision 4). */\n @Directive(DECIDE)\n @Query(returns => [AccessDecisionIssue], { description: 'To review a decision before it is made: what blocks it and what the person deciding should know.' })\n async reviewAccessDecision(@Arg('decision', type => AccessDecisionInput) decision: AccessDecisionInput, @Ctx() context: ResolverContext): Promise<AccessDecisionIssue[]> {\n return (await reviewDecision(decision as any, context)) as AccessDecisionIssue[]\n }\n}\n"]}
|
|
@@ -17,7 +17,8 @@ let ApplianceQuery = class ApplianceQuery {
|
|
|
17
17
|
const { domain } = context.state;
|
|
18
18
|
const queryBuilder = (0, shell_1.getQueryBuilderFromListParams)({
|
|
19
19
|
domain,
|
|
20
|
-
|
|
20
|
+
// this domain's rows only - a parent domain's are another tenant's, whatever `inherited` the caller sent
|
|
21
|
+
params: { ...params, inherited: shell_1.InheritedValueType.None },
|
|
21
22
|
repository: (0, shell_1.getRepository)(appliance_js_1.Appliance),
|
|
22
23
|
alias: 'appliance',
|
|
23
24
|
searchables: ['name', 'description']
|
|
@@ -29,7 +30,8 @@ let ApplianceQuery = class ApplianceQuery {
|
|
|
29
30
|
const { domain } = context.state;
|
|
30
31
|
const queryBuilder = (0, shell_1.getQueryBuilderFromListParams)({
|
|
31
32
|
domain,
|
|
32
|
-
|
|
33
|
+
// this domain's rows only - a parent domain's are another tenant's, whatever `inherited` the caller sent
|
|
34
|
+
params: { ...params, inherited: shell_1.InheritedValueType.None },
|
|
33
35
|
repository: (0, shell_1.getRepository)(appliance_js_1.Appliance),
|
|
34
36
|
alias: 'appliance',
|
|
35
37
|
searchables: ['name', 'description']
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"appliance-query.js","sourceRoot":"","sources":["../../../server/service/appliance/appliance-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8F;AAE9F,
|
|
1
|
+
{"version":3,"file":"appliance-query.js","sourceRoot":"","sources":["../../../server/service/appliance/appliance-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8F;AAE9F,iDAA2H;AAE3H,+EAA+E;AAC/E,4DAAqD;AACrD,6CAAkD;AAClD,6DAAoD;AAG7C,IAAM,cAAc,GAApB,MAAM,cAAc;IAGnB,AAAN,KAAK,CAAC,SAAS,CAAY,EAAU,EAAS,OAAwB;QACpE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,OAAO,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;IACpF,CAAC;IAIK,AAAN,KAAK,CAAC,UAAU,CACW,MAAiB,EACnC,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;YACjD,MAAM;YACN,yGAAyG;YACzG,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,0BAAkB,CAAC,IAAI,EAAE;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,wBAAS,CAAC;YACpC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;SACrC,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;QAE3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CAA0B,MAAiB,EAAS,OAAwB;QACrF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;YACjD,MAAM;YACN,yGAAyG;YACzG,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,0BAAkB,CAAC,IAAI,EAAE;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,wBAAS,CAAC;YACpC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;SACrC,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;QAE3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IAGG,AAAN,KAAK,CAAC,4BAA4B;QAChC,OAAO,IAAA,mDAA0B,GAAE,CAAA;IACrC,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAS,SAAoB,EAAS,OAAwB;QAC7E,OAAO,SAAS,CAAC,WAAW,CAAA;IAC9B,CAAC;IAED;;;;;;;;OAQG;IAEG,AAAN,KAAK,CAAC,iBAAiB,CAAS,SAAoB;QAClD,MAAM,OAAO,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAA;QAEvG,OAAO,OAAO,EAAE,MAAM,KAAK,oBAAU,CAAC,QAAQ,CAAA;IAChD,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CAAQ,OAAwB;QAC1C,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAA;IAC7B,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,SAAoB;QACxC,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAA;IACzE,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,SAAoB;QACxC,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAA;IACzE,CAAC;CACF,CAAA;AA3GY,wCAAc;AAGnB;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,wBAAS,EAAE,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACnD,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;+CAG5C;AAIK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,kCAAa,EAAE,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;IAE7E,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IACvB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAD2B,iBAAS;;gDAiB3C;AAIK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,kCAAa,EAAE,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;IACnE,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;2CAerD;AAqBK;IAFL,IAAA,wBAAS,EAAC,mFAAmF,CAAC;IAC9F,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,kEAAkE,EAAE,CAAC;;;;kEAG9G;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC;IACX,mBAAA,IAAA,mBAAI,GAAE,CAAA;IAAwB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,wBAAS;;iDAE7C;AAYK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;IACN,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAY,wBAAS;;uDAInD;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IAChB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;4CAElB;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAY,wBAAS;;6CAEzC;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAY,wBAAS;;6CAEzC;yBA1GU,cAAc;IAD1B,IAAA,uBAAQ,EAAC,wBAAS,CAAC;GACP,cAAc,CA2G1B","sourcesContent":["import { Arg, Args, Ctx, Directive, FieldResolver, Query, Resolver, Root } from 'type-graphql'\n\nimport { getQueryBuilderFromListParams, InheritedValueType, Domain, getRepository, ListParam } from '@things-factory/shell'\n\nimport { offersCredentialRevocation } from '../../utils/credential-features.js'\nimport { Appliance } from '../appliance/appliance.js'\nimport { User, UserStatus } from '../user/user.js'\nimport { ApplianceList } from './appliance-types.js'\n\n@Resolver(Appliance)\nexport class ApplianceQuery {\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => Appliance, { description: ' To fetch appliance' })\n async appliance(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<Appliance> {\n const { domain } = context.state\n return await getRepository(Appliance).findOneBy({ domain: { id: domain.id }, id })\n }\n\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => ApplianceList, { description: 'To fetch multiple appliance' })\n async appliances(\n @Args(type => ListParam) params: ListParam,\n @Ctx() context: ResolverContext\n ): Promise<ApplianceList> {\n const { domain } = context.state\n\n const queryBuilder = getQueryBuilderFromListParams({\n domain,\n // this domain's rows only - a parent domain's are another tenant's, whatever `inherited` the caller sent\n params: { ...params, inherited: InheritedValueType.None },\n repository: getRepository(Appliance),\n alias: 'appliance',\n searchables: ['name', 'description']\n })\n\n const [items, total] = await queryBuilder.getManyAndCount()\n\n return { items, total }\n }\n\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => ApplianceList, { description: 'To fetch multiple appliance' })\n async edges(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<ApplianceList> {\n const { domain } = context.state\n\n const queryBuilder = getQueryBuilderFromListParams({\n domain,\n // this domain's rows only - a parent domain's are another tenant's, whatever `inherited` the caller sent\n params: { ...params, inherited: InheritedValueType.None },\n repository: getRepository(Appliance),\n alias: 'appliance',\n searchables: ['name', 'description']\n })\n\n const [items, total] = await queryBuilder.getManyAndCount()\n\n return { items, total }\n }\n\n /*\n * Does revoking an appliance credential work here? (ADR-0085 decision 1.)\n *\n * ── Why the screen has to ask ───────────────────────────────────────────\n * Revocation is behind `credential/revocable`, and an installation that never configured it\n * has no such door — `revokeApplianceCredential` answers 404. The screen cannot read the\n * config, so without this it would either hide a feature the installation paid for or show a\n * button that always refuses. The second is the worse one: it reads as a broken product\n * rather than as something nobody turned on.\n *\n * ── Why it carries the mutation's own gate ──────────────────────────────\n * The same `category` / `privilege` pair as `revokeApplianceCredential`, so what comes back is\n * not \"the installation has this\" but **\"pressing it would work for you\"**. Those differ for a\n * reader who may list appliances and may not act on their credentials, and a button should\n * follow the second. A refusal here reaches the client as an error, which it reads the same\n * way as false.\n */\n @Directive('@privilege(category: \"security\", privilege: \"mutation\", domainOwnerGranted: true)')\n @Query(returns => Boolean, { description: 'Whether this installation offers appliance credential revocation' })\n async applianceCredentialRevocable(): Promise<boolean> {\n return offersCredentialRevocation()\n }\n\n @FieldResolver(type => String)\n async accessToken(@Root() appliance: Appliance, @Ctx() context: ResolverContext) {\n return appliance.accessToken\n }\n\n /*\n * Revocation is recorded on the shadow user, so the answer is not on the row that was asked\n * for. INACTIVE means revoked and nothing else does: `ensureApplianceUser` creates the user\n * ACTIVATED, `generateApplianceSecret` puts it back to ACTIVATED, and `revokeApplianceCredential`\n * is the one place that sets INACTIVE.\n *\n * An appliance with no shadow user at all is not revoked — it is one nothing was ever issued\n * for, which is the state a freshly registered appliance is in.\n */\n @FieldResolver(type => Boolean)\n async credentialRevoked(@Root() appliance: Appliance): Promise<boolean> {\n const appuser = await getRepository(User).findOneBy({ reference: appliance.id, userType: 'appliance' })\n\n return appuser?.status === UserStatus.INACTIVE\n }\n\n @FieldResolver(type => Domain)\n async domain(@Ctx() context: ResolverContext) {\n return context.state.domain\n }\n\n @FieldResolver(type => User)\n async updater(@Root() appliance: Appliance): Promise<User> {\n return await getRepository(User).findOneBy({ id: appliance.updaterId })\n }\n\n @FieldResolver(type => User)\n async creator(@Root() appliance: Appliance): Promise<User> {\n return await getRepository(User).findOneBy({ id: appliance.creatorId })\n }\n}\n"]}
|
|
@@ -18,7 +18,8 @@ let ApplicationQuery = class ApplicationQuery {
|
|
|
18
18
|
const { domain } = context.state;
|
|
19
19
|
const queryBuilder = (0, shell_1.getQueryBuilderFromListParams)({
|
|
20
20
|
domain,
|
|
21
|
-
|
|
21
|
+
// this domain's rows only - a parent domain's are another tenant's, whatever `inherited` the caller sent
|
|
22
|
+
params: { ...params, inherited: shell_1.InheritedValueType.None },
|
|
22
23
|
repository: (0, shell_1.getRepository)(application_js_1.Application),
|
|
23
24
|
alias: 'application',
|
|
24
25
|
searchables: ['name', 'description']
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"application-query.js","sourceRoot":"","sources":["../../../server/service/application/application-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8F;AAE9F,
|
|
1
|
+
{"version":3,"file":"application-query.js","sourceRoot":"","sources":["../../../server/service/application/application-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8F;AAE9F,iDAA2H;AAE3H,qEAA4D;AAE5D,6CAAsC;AACtC,6CAAsC;AACtC,qDAA8C;AAC9C,iEAAwD;AAGjD,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAGrB,AAAN,KAAK,CAAC,WAAW,CAAY,EAAU,EAAS,OAAwB;QACtE,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,4BAAW,CAAC,CAAA;QAE7C,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;IAC3C,CAAC;IAIK,AAAN,KAAK,CAAC,YAAY,CAA0B,MAAiB,EAAS,OAAwB;QAC5F,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;YACjD,MAAM;YACN,yGAAyG;YACzG,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,0BAAkB,CAAC,IAAI,EAAE;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,4BAAW,CAAC;YACtC,KAAK,EAAE,aAAa;YACpB,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;SACrC,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;QAE3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAGK,AAAN,KAAK,CAAC,eAAe,CAAQ,OAAwB;QACnD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAE7E,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAU,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACvD,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CAAQ,OAAwB;QAClD,OAAO,IAAA,gCAAY,EAAC,qBAAqB,EAAE,OAAO,CAAC,CAAA;IACrD,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAQ,OAAwB;QAC3C,OAAO,IAAA,gCAAY,EAAC,kBAAkB,EAAE,OAAO,CAAC,CAAA;IAClD,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CAAQ,OAAwB;QAC1C,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAA;IAC7B,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,WAAwB;QAC5C,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,CAAA;IAC3E,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,WAAwB;QAC5C,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,SAAS,EAAE,CAAC,CAAA;IAC3E,CAAC;CACF,CAAA;AA5DY,4CAAgB;AAGrB;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,4BAAW,EAAE,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;IACpD,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;mDAI9C;AAIK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,sCAAe,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;IAChE,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;oDAe5D;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC;IACP,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;uDAK3B;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC;IACR,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;sDAE1B;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC;IACf,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;+CAEnB;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IAChB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;8CAElB;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAc,4BAAW;;+CAE7C;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAc,4BAAW;;+CAE7C;2BA3DU,gBAAgB;IAD5B,IAAA,uBAAQ,EAAC,4BAAW,CAAC;GACT,gBAAgB,CA4D5B","sourcesContent":["import { Directive, Arg, Args, Ctx, FieldResolver, Query, Resolver, Root } from 'type-graphql'\n\nimport { getQueryBuilderFromListParams, InheritedValueType, Domain, getRepository, ListParam } from '@things-factory/shell'\n\nimport { buildAuthURL } from '../../utils/build-auth-url.js'\n\nimport { Role } from '../role/role.js'\nimport { User } from '../user/user.js'\nimport { Application } from './application.js'\nimport { ApplicationList } from './application-types.js'\n\n@Resolver(Application)\nexport class ApplicationQuery {\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => Application, { description: 'To fetch application' })\n async application(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<Application> {\n const repository = getRepository(Application)\n\n return await repository.findOneBy({ id })\n }\n\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => ApplicationList, { description: 'To fetch multiple application' })\n async applications(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext) {\n const { domain } = context.state\n\n const queryBuilder = getQueryBuilderFromListParams({\n domain,\n // this domain's rows only - a parent domain's are another tenant's, whatever `inherited` the caller sent\n params: { ...params, inherited: InheritedValueType.None },\n repository: getRepository(Application),\n alias: 'application',\n searchables: ['name', 'description']\n })\n\n const [items, total] = await queryBuilder.getManyAndCount()\n\n return { items, total }\n }\n\n @FieldResolver(type => String)\n async availableScopes(@Ctx() context: ResolverContext): Promise<string> {\n const { domain } = context.state\n const roles = await getRepository(Role).findBy({ domain: { id: domain.id } })\n\n return roles.map((role: Role) => role.name).join(' ')\n }\n\n @FieldResolver(type => String)\n async accessTokenUrl(@Ctx() context: ResolverContext): Promise<string> {\n return buildAuthURL('/oauth/access-token', context)\n }\n\n @FieldResolver(type => String)\n async authUrl(@Ctx() context: ResolverContext): Promise<string> {\n return buildAuthURL('/oauth/authorize', context)\n }\n\n @FieldResolver(type => Domain)\n async domain(@Ctx() context: ResolverContext) {\n return context.state.domain\n }\n\n @FieldResolver(type => User)\n async updater(@Root() application: Application): Promise<User> {\n return await getRepository(User).findOneBy({ id: application.updaterId })\n }\n\n @FieldResolver(type => User)\n async creator(@Root() application: Application): Promise<User> {\n return await getRepository(User).findOneBy({ id: application.creatorId })\n }\n}\n"]}
|
|
@@ -22,7 +22,8 @@ let AuthProviderQuery = class AuthProviderQuery {
|
|
|
22
22
|
const { domain } = context.state;
|
|
23
23
|
const queryBuilder = (0, shell_1.getQueryBuilderFromListParams)({
|
|
24
24
|
domain,
|
|
25
|
-
|
|
25
|
+
// this domain's rows only - a parent domain's are another tenant's, whatever `inherited` the caller sent
|
|
26
|
+
params: { ...params, inherited: shell_1.InheritedValueType.None },
|
|
26
27
|
repository: await (0, shell_1.getRepository)(auth_provider_js_1.AuthProvider),
|
|
27
28
|
searchables: ['type']
|
|
28
29
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth-provider-query.js","sourceRoot":"","sources":["../../../server/service/auth-provider/auth-provider-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8F;AAC9F,
|
|
1
|
+
{"version":3,"file":"auth-provider-query.js","sourceRoot":"","sources":["../../../server/service/auth-provider/auth-provider-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8F;AAC9F,iDAA2H;AAC3H,6CAAsC;AACtC,yDAAuE;AACvE,mEAA0D;AAGnD,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAE5B,iBAAiB,CAAQ,OAAwB;QAC/C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,OAAO,+BAAY,CAAC,oBAAoB,EAAE,CAAA;IAC5C,CAAC;IAIK,AAAN,KAAK,CAAC,YAAY,CAAY,EAAU,EAAS,OAAwB;QACvE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,OAAO,MAAM,IAAA,qBAAa,EAAC,+BAAY,CAAC,CAAC,OAAO,CAAC;YAC/C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;SACzC,CAAC,CAAA;IACJ,CAAC;IAIK,AAAN,KAAK,CAAC,aAAa,CACQ,MAAiB,EACnC,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;YACjD,MAAM;YACN,yGAAyG;YACzG,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,0BAAkB,CAAC,IAAI,EAAE;YACzD,UAAU,EAAE,MAAM,IAAA,qBAAa,EAAC,+BAAY,CAAC;YAC7C,WAAW,EAAE,CAAC,MAAM,CAAC;SACtB,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;QAE3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAGD,YAAY,CAAS,YAA0B;QAC7C,MAAM,YAAY,GAAG,YAAY,CAAC,YAAY,CAAA;QAE9C,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC9C,OAAO,YAAY,CAAA,CAAC,8BAA8B;QACpD,CAAC;QACD,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAC7D,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAEtD,OAAO,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;IAC1C,CAAC;IAGD,UAAU,CAAS,YAA0B;QAC3C,MAAM,UAAU,GAAG,YAAY,CAAC,UAAU,CAAA;QAE1C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC1C,OAAO,UAAU,CAAA,CAAC,8BAA8B;QAClD,CAAC;QACD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QACzD,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;QAEpD,OAAO,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;IAC1C,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CAAS,YAA0B;QAC7C,OAAO,YAAY,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IACxG,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,YAA0B;QAC9C,OAAO,YAAY,CAAC,SAAS,IAAI,CAAC,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IACxG,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,YAA0B;QAC9C,OAAO,YAAY,CAAC,SAAS,IAAI,CAAC,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IACxG,CAAC;CACF,CAAA;AAjFY,8CAAiB;AAE5B;IADC,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,uCAAqB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;IACjF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;4CAA4B,uCAAoB;0DAIvE;AAIK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,+BAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;IACxE,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qDAM/C;AAIK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,wCAAgB,EAAE,EAAE,WAAW,EAAE,iCAAiC,EAAE,CAAC;IAEpF,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IACvB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAD2B,iBAAS;;sDAgB3C;AAGD;IADC,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC;IAChB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAe,+BAAY;;qDAW9C;AAGD;IADC,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC;IAClB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAe,+BAAY;;mDAW5C;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IAChB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAe,+BAAY;;+CAE9C;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAe,+BAAY;;gDAE/C;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAe,+BAAY;;gDAE/C;4BAhFU,iBAAiB;IAD7B,IAAA,uBAAQ,EAAC,+BAAY,CAAC;GACV,iBAAiB,CAiF7B","sourcesContent":["import { Resolver, Query, FieldResolver, Root, Args, Arg, Ctx, Directive } from 'type-graphql'\nimport { Domain, getQueryBuilderFromListParams, InheritedValueType, getRepository, ListParam } from '@things-factory/shell'\nimport { User } from '../user/user.js'\nimport { AuthProvider, AuthProviderTypeList } from './auth-provider.js'\nimport { AuthProviderList } from './auth-provider-type.js'\n\n@Resolver(AuthProvider)\nexport class AuthProviderQuery {\n @Query(returns => AuthProviderTypeList!, { nullable: true, description: 'To fetch a AuthProvider' })\n authProviderTypes(@Ctx() context: ResolverContext): AuthProviderTypeList {\n const { domain } = context.state\n\n return AuthProvider.getAuthProviderTypes()\n }\n\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => AuthProvider!, { nullable: true, description: 'To fetch a AuthProvider' })\n async authProvider(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<AuthProvider> {\n const { domain } = context.state\n\n return await getRepository(AuthProvider).findOne({\n where: { domain: { id: domain.id }, id }\n })\n }\n\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => AuthProviderList, { description: 'To fetch multiple AuthProviders' })\n async authProviders(\n @Args(type => ListParam) params: ListParam,\n @Ctx() context: ResolverContext\n ): Promise<AuthProviderList> {\n const { domain } = context.state\n\n const queryBuilder = getQueryBuilderFromListParams({\n domain,\n // this domain's rows only - a parent domain's are another tenant's, whatever `inherited` the caller sent\n params: { ...params, inherited: InheritedValueType.None },\n repository: await getRepository(AuthProvider),\n searchables: ['type']\n })\n\n const [items, total] = await queryBuilder.getManyAndCount()\n\n return { items, total }\n }\n\n @FieldResolver(type => String)\n clientSecret(@Root() authProvider: AuthProvider): string {\n const clientSecret = authProvider.clientSecret\n\n if (!clientSecret || clientSecret.length <= 2) {\n return clientSecret // 입력 문자열의 길이가 2 이하인 경우 그대로 반환\n }\n const firstChar = clientSecret.charAt(0)\n const lastChar = clientSecret.charAt(clientSecret.length - 1)\n const maskedPart = '*'.repeat(clientSecret.length - 2)\n\n return firstChar + maskedPart + lastChar\n }\n\n @FieldResolver(type => String)\n privateKey(@Root() authProvider: AuthProvider): string {\n const privateKey = authProvider.privateKey\n\n if (!privateKey || privateKey.length <= 2) {\n return privateKey // 입력 문자열의 길이가 2 이하인 경우 그대로 반환\n }\n const firstChar = privateKey.charAt(0)\n const lastChar = privateKey.charAt(privateKey.length - 1)\n const maskedPart = '*'.repeat(privateKey.length - 2)\n\n return firstChar + maskedPart + lastChar\n }\n\n @FieldResolver(type => Domain)\n async domain(@Root() authProvider: AuthProvider): Promise<Domain> {\n return authProvider.domainId && (await getRepository(Domain).findOneBy({ id: authProvider.domainId }))\n }\n\n @FieldResolver(type => User)\n async updater(@Root() authProvider: AuthProvider): Promise<User> {\n return authProvider.updaterId && (await getRepository(User).findOneBy({ id: authProvider.updaterId }))\n }\n\n @FieldResolver(type => User)\n async creator(@Root() authProvider: AuthProvider): Promise<User> {\n return authProvider.creatorId && (await getRepository(User).findOneBy({ id: authProvider.creatorId }))\n }\n}\n"]}
|
|
@@ -32,7 +32,7 @@ export * from './role/role-types.js';
|
|
|
32
32
|
export * from './user/user-types.js';
|
|
33
33
|
export * from './domain-link/domain-link-types.js';
|
|
34
34
|
export * from './access-request/access-request-types.js';
|
|
35
|
-
export declare const entities: (typeof import("./access-request/access-request.js").AccessRequest | typeof import("./role/role.js").Role | typeof import("./privilege/privilege.js").Privilege | typeof import("./user/user.js").User | typeof import("./users-auth-providers/users-auth-providers.js").UsersAuthProviders | typeof import("./auth-provider/auth-provider.js").AuthProvider | typeof import("./application/application.js").Application | typeof import("./appliance/appliance.js").Appliance | typeof import("./partner/partner.js").Partner | typeof import("./
|
|
35
|
+
export declare const entities: (typeof import("./access-request/access-request.js").AccessRequest | typeof import("./role/role.js").Role | typeof import("./privilege/privilege.js").Privilege | typeof import("./user/user.js").User | typeof import("./granted-role/granted-role.js").GrantedRole | typeof import("./users-auth-providers/users-auth-providers.js").UsersAuthProviders | typeof import("./auth-provider/auth-provider.js").AuthProvider | typeof import("./application/application.js").Application | typeof import("./appliance/appliance.js").Appliance | typeof import("./partner/partner.js").Partner | typeof import("./invitation/invitation.js").Invitation | typeof import("./password-history/password-history.js").PasswordHistory | typeof import("./verification-token/verification-token.js").VerificationToken | typeof import("./verification-token/verification-token.js").VerificationTokenType | typeof import("./login-history/login-history.js").LoginHistory | typeof import("./web-auth-credential/web-auth-credential.js").WebAuthCredential | typeof import("./domain-link/domain-link.js").DomainLink | typeof import("./domain-owner/domain-owner.js").DomainOwner)[];
|
|
36
36
|
export declare const schema: {
|
|
37
37
|
typeDefs: {
|
|
38
38
|
privilegeDirectiveTypeDefs: import("graphql").DocumentNode;
|
|
@@ -36,7 +36,8 @@ let InvitationQuery = class InvitationQuery {
|
|
|
36
36
|
const { domain } = context.state;
|
|
37
37
|
const queryBuilder = (0, shell_1.getQueryBuilderFromListParams)({
|
|
38
38
|
domain,
|
|
39
|
-
|
|
39
|
+
// this domain's rows only - a parent domain's are another tenant's, whatever `inherited` the caller sent
|
|
40
|
+
params: { ...params, inherited: shell_1.InheritedValueType.None },
|
|
40
41
|
repository: (0, shell_1.getRepository)(invitation_js_1.Invitation),
|
|
41
42
|
alias: 'invitation',
|
|
42
43
|
searchables: ['email']
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"invitation-query.js","sourceRoot":"","sources":["../../../server/service/invitation/invitation-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8F;AAE9F,
|
|
1
|
+
{"version":3,"file":"invitation-query.js","sourceRoot":"","sources":["../../../server/service/invitation/invitation-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8F;AAE9F,iDAAmH;AAEnH,yEAAiE;AACjE,mDAA4C;AAC5C,+DAAsD;AAEtD;;;;;;;;GAQG;AACH,MAAM,IAAI,GAAG,oGAAoG,CAAA;AAG1G,IAAM,eAAe,GAArB,MAAM,eAAe;IAGpB,AAAN,KAAK,CAAC,UAAU,CAAY,EAAU,EAAS,OAAwB;QACrE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,OAAO,MAAM,IAAA,qBAAa,EAAC,0BAAU,CAAC,CAAC,OAAO,CAAC;YAC7C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE;YACxC,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;OAMG;IAGG,AAAN,KAAK,CAAC,WAAW,CACU,MAAiB,EACnC,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;YACjD,MAAM;YACN,yGAAyG;YACzG,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,0BAAkB,CAAC,IAAI,EAAE;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,0BAAU,CAAC;YACrC,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,CAAC,OAAO,CAAC;SACvB,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;QAE3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAED;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,KAAK,CAAS,UAAsB;QACxC,OAAO,IAAA,qCAAe,EAAC,UAAU,CAAC,CAAA;IACpC,CAAC;CACF,CAAA;AArDY,0CAAe;AAGpB;IAFL,IAAA,wBAAS,EAAC,IAAI,CAAC;IACf,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,0BAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC;IACrF,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;iDAO7C;AAWK;IAFL,IAAA,wBAAS,EAAC,IAAI,CAAC;IACf,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,oCAAc,EAAE,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IAErF,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IACvB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAD2B,iBAAS;;kDAiB3C;AAWK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC;IACjB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAa,0BAAU;;4CAEzC;0BApDU,eAAe;IAD3B,IAAA,uBAAQ,EAAC,0BAAU,CAAC;GACR,eAAe,CAqD3B","sourcesContent":["import { Arg, Args, Ctx, Directive, FieldResolver, Query, Resolver, Root } from 'type-graphql'\n\nimport { getQueryBuilderFromListParams, InheritedValueType, getRepository, ListParam } from '@things-factory/shell'\n\nimport { invitationState } from '../../utils/invitation-state.js'\nimport { Invitation } from './invitation.js'\nimport { InvitationList } from './invitation-types.js'\n\n/*\n * ── What changed here, and why ──────────────────────────────────────────────\n * These read by `{ email, reference, type }` and took no domain at all — `invitations` did not\n * even take a context, so there was nothing to compare a caller against. An id from one tenant\n * and an id from another were the same kind of argument.\n *\n * They are the invitation **list** now: this domain's invitations, scoped the way every other\n * list in this package is scoped. `reference` is not read; the domain is a column.\n */\nconst GATE = '@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)'\n\n@Resolver(Invitation)\nexport class InvitationQuery {\n @Directive(GATE)\n @Query(returns => Invitation, { nullable: true, description: 'To fetch an invitation of this domain' })\n async invitation(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<Invitation> {\n const { domain } = context.state\n\n return await getRepository(Invitation).findOne({\n where: { id, domain: { id: domain.id } },\n relations: ['domain', 'roles']\n })\n }\n\n /**\n * Who was invited to this domain, by whom, when, and whether they came in.\n *\n * ⚠ This is why the rows are kept. Accepting used to delete the row, so the moment somebody\n * joined, the fact that they had been invited stopped existing — there was nothing to put on a\n * screen, so no screen was built, so nothing called any of this.\n */\n @Directive(GATE)\n @Query(returns => InvitationList, { description: \"To fetch this domain's invitations\" })\n async invitations(\n @Args(type => ListParam) params: ListParam,\n @Ctx() context: ResolverContext\n ): Promise<InvitationList> {\n const { domain } = context.state\n\n const queryBuilder = getQueryBuilderFromListParams({\n domain,\n // this domain's rows only - a parent domain's are another tenant's, whatever `inherited` the caller sent\n params: { ...params, inherited: InheritedValueType.None },\n repository: getRepository(Invitation),\n alias: 'invitation',\n searchables: ['email']\n })\n\n const [items, total] = await queryBuilder.getManyAndCount()\n\n return { items, total }\n }\n\n /**\n * What state this invitation is in, read against the clock.\n *\n * ⚠ Not the stored column on its own. A pending row whose expiry has passed **is** expired\n * whether or not anything has been round to write that down — otherwise the list would show a\n * live invitation for a token that no longer opens anything, which is the more dangerous of\n * the two ways to be wrong here.\n */\n @FieldResolver(type => String)\n async state(@Root() invitation: Invitation): Promise<string> {\n return invitationState(invitation)\n }\n}\n"]}
|
|
@@ -12,11 +12,15 @@ let LoginHistoryQuery = class LoginHistoryQuery {
|
|
|
12
12
|
and it exists precisely because this one should not be open. */
|
|
13
13
|
async loginHistories(params, context) {
|
|
14
14
|
const { domain } = context.state;
|
|
15
|
+
/*
|
|
16
|
+
* The row's domain is `accessDomain` - there is no `domain` column, so handing `domain` to the builder failed every
|
|
17
|
+
* call (no such column). This domain's sign-ins only; `inherited` never widens it to the parent's.
|
|
18
|
+
*/
|
|
15
19
|
const queryBuilder = (0, shell_1.getQueryBuilderFromListParams)({
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
});
|
|
20
|
+
params: { ...params, inherited: shell_1.InheritedValueType.None },
|
|
21
|
+
repository: (0, shell_1.getRepository)(login_history_js_1.LoginHistory),
|
|
22
|
+
alias: 'loginHistory'
|
|
23
|
+
}).andWhere('loginHistory.accessDomain = :accessDomainId', { accessDomainId: domain.id });
|
|
20
24
|
const [items, total] = await queryBuilder.getManyAndCount();
|
|
21
25
|
return { items, total };
|
|
22
26
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"login-history-query.js","sourceRoot":"","sources":["../../../server/service/login-history/login-history-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8F;AAE9F,
|
|
1
|
+
{"version":3,"file":"login-history-query.js","sourceRoot":"","sources":["../../../server/service/login-history/login-history-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8F;AAE9F,iDAA2H;AAE3H,6CAAsC;AACtC,yDAAiD;AACjD,mEAA0D;AAGnD,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B;sEACkE;IAG5D,AAAN,KAAK,CAAC,cAAc,CACO,MAAiB,EACnC,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC;;;WAGG;QACH,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;YACjD,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,0BAAkB,CAAC,IAAI,EAAE;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,+BAAY,CAAC;YACvC,KAAK,EAAE,cAAc;SACtB,CAAC,CAAC,QAAQ,CAAC,6CAA6C,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAA;QAEzF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAGK,AAAN,KAAK,CAAC,gBAAgB,CAAe,KAAa,EAAS,OAAwB;QACjF,MAAM,IAAI,GAAS,OAAO,CAAC,KAAK,CAAC,IAAI,CAAA;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAA;QACtC,CAAC;QAED,OAAO,MAAM,IAAA,qBAAa,EAAC,+BAAY,CAAC,CAAC,IAAI,CAAC;YAC5C,KAAK,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE;YACtC,IAAI,EAAE,KAAK,IAAI,EAAE;YACjB,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;SAC9B,CAAC,CAAA;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CAAS,YAA0B;QACnD,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,cAAc,EAAE,CAAC,CAAA;IACnF,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU,CAAS,YAA0B;QACjD,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,YAAY,EAAE,CAAC,CAAA;IAC/E,CAAC;CACF,CAAA;AAhDY,8CAAiB;AAKtB;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,wCAAgB,EAAE,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAErF,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IACvB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAD2B,iBAAS;;uDAiB3C;AAGK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,+BAAY,CAAC,CAAC;IACT,mBAAA,IAAA,kBAAG,EAAC,OAAO,CAAC,CAAA;IAAiB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;yDAWzD;AAGK;IADL,IAAA,4BAAa,GAAE;IACI,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAe,+BAAY;;qDAEpD;AAGK;IADL,IAAA,4BAAa,GAAE;IACE,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAe,+BAAY;;mDAElD;4BA/CU,iBAAiB;IAD7B,IAAA,uBAAQ,EAAC,+BAAY,CAAC;GACV,iBAAiB,CAgD7B","sourcesContent":["import { Arg, Args, Ctx, Directive, FieldResolver, Query, Resolver, Root } from 'type-graphql'\n\nimport { Domain, getQueryBuilderFromListParams, InheritedValueType, getRepository, ListParam } from '@things-factory/shell'\n\nimport { User } from '../user/user.js'\nimport { LoginHistory } from './login-history.js'\nimport { LoginHistoryList } from './login-history-type.js'\n\n@Resolver(LoginHistory)\nexport class LoginHistoryQuery {\n /* Everybody's sign-ins. `myLoginHistories` below is the one that answers about the caller,\n and it exists precisely because this one should not be open. */\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => LoginHistoryList, { description: 'To fetch multiple LoginHistories' })\n async loginHistories(\n @Args(type => ListParam) params: ListParam,\n @Ctx() context: ResolverContext\n ): Promise<LoginHistoryList> {\n const { domain } = context.state\n\n /*\n * The row's domain is `accessDomain` - there is no `domain` column, so handing `domain` to the builder failed every\n * call (no such column). This domain's sign-ins only; `inherited` never widens it to the parent's.\n */\n const queryBuilder = getQueryBuilderFromListParams({\n params: { ...params, inherited: InheritedValueType.None },\n repository: getRepository(LoginHistory),\n alias: 'loginHistory'\n }).andWhere('loginHistory.accessDomain = :accessDomainId', { accessDomainId: domain.id })\n\n const [items, total] = await queryBuilder.getManyAndCount()\n return { items, total }\n }\n\n @Query(returns => [LoginHistory])\n async myLoginHistories(@Arg('limit') limit: number, @Ctx() context: ResolverContext): Promise<LoginHistory[]> {\n const user: User = context.state.user\n if (!user) {\n throw new Error('No user specified')\n }\n\n return await getRepository(LoginHistory).find({\n where: { accessUser: { id: user.id } },\n take: limit || 10,\n order: { accessedAt: 'DESC' }\n })\n }\n\n @FieldResolver()\n async accessDomain(@Root() loginHistory: LoginHistory) {\n return await getRepository(Domain).findOneBy({ id: loginHistory.accessDomainId })\n }\n\n @FieldResolver()\n async accessUser(@Root() loginHistory: LoginHistory) {\n return await getRepository(User).findOneBy({ id: loginHistory.accessUserId })\n }\n}\n"]}
|
|
@@ -20,6 +20,7 @@ exports.openFields = {
|
|
|
20
20
|
'Query.passwordRule': "the installation's password policy. The change-password screen needs it before the caller has any privilege — and after a forced reset they may have none",
|
|
21
21
|
'Query.authProviderTypes': "which provider types this build supports. A catalogue, not a tenant's configuration",
|
|
22
22
|
'Query.myAccessRequests': "the caller's own access requests",
|
|
23
|
+
'Query.mayChangeParentRoles': "whether the caller may give the parent domain's roles here - about the caller only",
|
|
23
24
|
'Query.accessRequestDeciderCount': 'how many people an access request from the caller would reach - a number, never who',
|
|
24
25
|
'Mutation.requestAccess': 'asked by someone refused for want of a role - a gate here would need the privilege being asked for. The door asks only for the caller and judges again that a role would open it (ADR-0103)',
|
|
25
26
|
'Mutation.withdrawAccessRequest': "withdraws the caller's own pending request and nobody else's"
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"open-fields.js","sourceRoot":"","sources":["../../server/service/open-fields.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AACU,QAAA,UAAU,GAA0B;IAC/C,QAAQ,EAAE;QACR,wBAAwB,EAAE,2BAA2B;QACrD,eAAe,EAAE,wBAAwB;QACzC,oBAAoB,EAAE,0EAA0E;QAChG,4BAA4B,EAAE,sCAAsC;QACpE,8BAA8B,EAAE,2CAA2C;QAC3E,wCAAwC,EAAE,iCAAiC;QAC3E,4BAA4B,EAAE,qDAAqD;QACnF,oBAAoB,EAClB,2JAA2J;QAC7J,yBAAyB,EAAE,qFAAqF;QAChH,wBAAwB,EAAE,kCAAkC;QAC5D,iCAAiC,EAAE,qFAAqF;QACxH,wBAAwB,EACtB,6LAA6L;QAC/L,gCAAgC,EAAE,8DAA8D;KACjG;CACF,CAAA","sourcesContent":["import type { OpenFieldsDeclaration } from './privilege/open-field-rule.js'\n\n/**\n * auth-base's root fields that declare no `@privilege` — every one of them, and why.\n *\n * There is no `notYetDeclared` here. The twelve that were open without a reason were closed on\n * 2026-09-20 (`c02ee9bdc1`); what is left answers about the caller, or about the installation\n * rather than anybody's data. An addition to this list needs its reason written first.\n */\nexport const openFields: OpenFieldsDeclaration = {\n byDesign: {\n 'Query.myLoginHistories': \"the caller's own sign-ins\",\n 'Query.myRoles': \"the caller's own roles\",\n 'Query.hasPrivilege': 'whether the caller has one — a gate here would need the answer to itself',\n 'Query.domainsWithPrivilege': 'the domains where the caller has one',\n 'Query.checkUserBelongsDomain': 'whether the caller belongs to this domain',\n 'Query.checkResettablePasswordToDefault': \"about the caller's own password\",\n 'Query.checkDefaultPassword': 'whether the caller is still on the default password',\n 'Query.passwordRule':\n \"the installation's password policy. The change-password screen needs it before the caller has any privilege — and after a forced reset they may have none\",\n 'Query.authProviderTypes': \"which provider types this build supports. A catalogue, not a tenant's configuration\",\n 'Query.myAccessRequests': \"the caller's own access requests\",\n 'Query.accessRequestDeciderCount': 'how many people an access request from the caller would reach - a number, never who',\n 'Mutation.requestAccess':\n 'asked by someone refused for want of a role - a gate here would need the privilege being asked for. The door asks only for the caller and judges again that a role would open it (ADR-0103)',\n 'Mutation.withdrawAccessRequest': \"withdraws the caller's own pending request and nobody else's\"\n }\n}\n"]}
|
|
1
|
+
{"version":3,"file":"open-fields.js","sourceRoot":"","sources":["../../server/service/open-fields.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AACU,QAAA,UAAU,GAA0B;IAC/C,QAAQ,EAAE;QACR,wBAAwB,EAAE,2BAA2B;QACrD,eAAe,EAAE,wBAAwB;QACzC,oBAAoB,EAAE,0EAA0E;QAChG,4BAA4B,EAAE,sCAAsC;QACpE,8BAA8B,EAAE,2CAA2C;QAC3E,wCAAwC,EAAE,iCAAiC;QAC3E,4BAA4B,EAAE,qDAAqD;QACnF,oBAAoB,EAClB,2JAA2J;QAC7J,yBAAyB,EAAE,qFAAqF;QAChH,wBAAwB,EAAE,kCAAkC;QAC5D,4BAA4B,EAAE,oFAAoF;QAClH,iCAAiC,EAAE,qFAAqF;QACxH,wBAAwB,EACtB,6LAA6L;QAC/L,gCAAgC,EAAE,8DAA8D;KACjG;CACF,CAAA","sourcesContent":["import type { OpenFieldsDeclaration } from './privilege/open-field-rule.js'\n\n/**\n * auth-base's root fields that declare no `@privilege` — every one of them, and why.\n *\n * There is no `notYetDeclared` here. The twelve that were open without a reason were closed on\n * 2026-09-20 (`c02ee9bdc1`); what is left answers about the caller, or about the installation\n * rather than anybody's data. An addition to this list needs its reason written first.\n */\nexport const openFields: OpenFieldsDeclaration = {\n byDesign: {\n 'Query.myLoginHistories': \"the caller's own sign-ins\",\n 'Query.myRoles': \"the caller's own roles\",\n 'Query.hasPrivilege': 'whether the caller has one — a gate here would need the answer to itself',\n 'Query.domainsWithPrivilege': 'the domains where the caller has one',\n 'Query.checkUserBelongsDomain': 'whether the caller belongs to this domain',\n 'Query.checkResettablePasswordToDefault': \"about the caller's own password\",\n 'Query.checkDefaultPassword': 'whether the caller is still on the default password',\n 'Query.passwordRule':\n \"the installation's password policy. The change-password screen needs it before the caller has any privilege — and after a forced reset they may have none\",\n 'Query.authProviderTypes': \"which provider types this build supports. A catalogue, not a tenant's configuration\",\n 'Query.myAccessRequests': \"the caller's own access requests\",\n 'Query.mayChangeParentRoles': \"whether the caller may give the parent domain's roles here - about the caller only\",\n 'Query.accessRequestDeciderCount': 'how many people an access request from the caller would reach - a number, never who',\n 'Mutation.requestAccess':\n 'asked by someone refused for want of a role - a gate here would need the privilege being asked for. The door asks only for the caller and judges again that a role would open it (ADR-0103)',\n 'Mutation.withdrawAccessRequest': \"withdraws the caller's own pending request and nobody else's\"\n }\n}\n"]}
|
|
@@ -14,7 +14,8 @@ let PartnerQuery = class PartnerQuery {
|
|
|
14
14
|
const { domain } = context.state;
|
|
15
15
|
const queryBuilder = (0, shell_1.getQueryBuilderFromListParams)({
|
|
16
16
|
domain,
|
|
17
|
-
|
|
17
|
+
// this domain's rows only - a parent domain's are another tenant's, whatever `inherited` the caller sent
|
|
18
|
+
params: { ...params, inherited: shell_1.InheritedValueType.None },
|
|
18
19
|
repository: (0, shell_1.getRepository)(partner_js_1.Partner),
|
|
19
20
|
alias: 'partner'
|
|
20
21
|
});
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"partner-query.js","sourceRoot":"","sources":["../../../server/service/partner/partner-query.ts"],"names":[],"mappings":";;;;AAAA,+CAAyF;AAGzF,
|
|
1
|
+
{"version":3,"file":"partner-query.js","sourceRoot":"","sources":["../../../server/service/partner/partner-query.ts"],"names":[],"mappings":";;;;AAAA,+CAAyF;AAGzF,iDAAuI;AAEvI,2FAAiF;AACjF,6CAAsC;AACtC,6CAAsC;AACtC,yDAAgD;AAGzC,IAAM,YAAY,GAAlB,MAAM,YAAY;IAGjB,AAAN,KAAK,CAAC,QAAQ,CAA0B,MAAiB,EAAS,OAAwB;QACxF,IAAI,MAAM,IAAA,qDAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;YAEhC,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;gBACjD,MAAM;gBACN,yGAAyG;gBACzG,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,0BAAkB,CAAC,IAAI,EAAE;gBACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,oBAAO,CAAC;gBAClC,KAAK,EAAE,SAAS;aACjB,CAAC,CAAA;YAEF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;YAE3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1D,CAAC;IACH,CAAC;IAIK,AAAN,KAAK,CAAC,SAAS,CAAQ,OAAwB;QAC7C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,QAAQ,GAAc,MAAM,IAAA,qBAAa,EAAC,oBAAO,CAAC,CAAC,IAAI,CAAC;YAC5D,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE;YACpC,SAAS,EAAE,CAAC,eAAe,CAAC;SAC7B,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;IACtD,CAAC;IAIK,AAAN,KAAK,CAAC,eAAe,CACM,MAAiB,EACnC,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,QAAQ,GAAc,MAAM,IAAA,qBAAa,EAAC,oBAAO,CAAC,CAAC,IAAI,CAAC;YAC5D,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE;YACpC,SAAS,EAAE,CAAC,eAAe,CAAC;SAC7B,CAAC,CAAA;QAEF,MAAM,EAAE,GAA+B,MAAM,IAAA,qCAA6B,EAAC;YACzE,UAAU,EAAE,IAAA,qBAAa,EAAC,cAAM,CAAC;YACjC,MAAM;YACN,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;SACrC,CAAC,CAAA;QAEF,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAA;QAClE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,eAAe,EAAE,CAAA;QACjD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAIK,AAAN,KAAK,CAAC,OAAO,CAAQ,OAAwB;QAC3C,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,EAAE,GAAgC,IAAA,qBAAa,EAAC,oBAAO,CAAC,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAA;QAC5F,MAAM,QAAQ,GAAc,MAAM,EAAE;aACjC,iBAAiB,CAAC,gBAAgB,EAAE,QAAQ,CAAC;aAC7C,iBAAiB,CAAC,uBAAuB,EAAE,UAAU,CAAC;aACtD,KAAK,CAAC,yBAAyB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;aACzD,OAAO,EAAE,CAAA;QAEZ,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAC/C,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CAAS,OAAgB;QACnC,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAA;IACxE,CAAC;IAGK,AAAN,KAAK,CAAC,aAAa,CAAS,OAAgB;QAC1C,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,eAAe,EAAE,CAAC,CAAA;IAC/E,CAAC;IAGK,AAAN,KAAK,CAAC,SAAS,CAAS,OAAgB;QACtC,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;IACzE,CAAC;IAGK,AAAN,KAAK,CAAC,QAAQ,CAAS,OAAgB;QACrC,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAA;IACxE,CAAC;CACF,CAAA;AA3FY,oCAAY;AAGjB;IAFL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,8BAAW,CAAC;IACd,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;4CAkBxD;AAIK;IAFL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAM,CAAC,CAAC;IACV,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;6CAQrB;AAIK;IAFL,IAAA,wBAAS,EAAC,qDAAqD,CAAC;IAChE,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,kBAAU,CAAC;IAE1B,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IACvB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAD2B,iBAAS;;mDAkB3C;AAIK;IAFL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAM,CAAC,CAAC;IACZ,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;2CAUnB;AAGK;IADL,IAAA,4BAAa,GAAE;IACF,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAU,oBAAO;;0CAEpC;AAGK;IADL,IAAA,4BAAa,GAAE;IACK,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAU,oBAAO;;iDAE3C;AAGK;IADL,IAAA,4BAAa,GAAE;IACC,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAU,oBAAO;;6CAEvC;AAGK;IADL,IAAA,4BAAa,GAAE;IACA,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAU,oBAAO;;4CAEtC;uBA1FU,YAAY;IADxB,IAAA,uBAAQ,EAAC,oBAAO,CAAC;GACL,YAAY,CA2FxB","sourcesContent":["import { Args, Ctx, Directive, FieldResolver, Query, Resolver, Root } from 'type-graphql'\nimport { SelectQueryBuilder } from 'typeorm'\n\nimport { Domain, DomainList, getRepository, ListParam, getQueryBuilderFromListParams, InheritedValueType } from '@things-factory/shell'\n\nimport { checkUserBelongsDomain } from '../../utils/check-user-belongs-domain.js'\nimport { User } from '../user/user.js'\nimport { Partner } from './partner.js'\nimport { PartnerList } from './partner-types.js'\n\n@Resolver(Partner)\nexport class PartnerQuery {\n @Directive('@privilege(category: \"partner\", privilege: \"query\", domainOwnerGranted: true)')\n @Query(returns => PartnerList)\n async partners(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<PartnerList> {\n if (await checkUserBelongsDomain(context.state.domain, context.state.user)) {\n const { domain } = context.state\n\n const queryBuilder = getQueryBuilderFromListParams({\n domain,\n // this domain's rows only - a parent domain's are another tenant's, whatever `inherited` the caller sent\n params: { ...params, inherited: InheritedValueType.None },\n repository: getRepository(Partner),\n alias: 'partner'\n })\n\n const [items, total] = await queryBuilder.getManyAndCount()\n\n return { items, total }\n } else {\n throw new Error(`User doesn't belong in current domain`)\n }\n }\n\n @Directive('@privilege(category: \"partner\", privilege: \"query\", domainOwnerGranted: true)')\n @Query(returns => [Domain])\n async customers(@Ctx() context: ResolverContext): Promise<Domain[]> {\n const { domain } = context.state\n const partners: Partner[] = await getRepository(Partner).find({\n where: { domain: { id: domain.id } },\n relations: ['partnerDomain']\n })\n\n return partners.map((p: Partner) => p.partnerDomain)\n }\n\n @Directive('@privilege(category: \"partner\", privilege: \"query\")')\n @Query(returns => DomainList)\n async searchCustomers(\n @Args(type => ListParam) params: ListParam,\n @Ctx() context: ResolverContext\n ): Promise<DomainList> {\n const { domain } = context.state\n const partners: Partner[] = await getRepository(Partner).find({\n where: { domain: { id: domain.id } },\n relations: ['partnerDomain']\n })\n\n const qb: SelectQueryBuilder<Domain> = await getQueryBuilderFromListParams({\n repository: getRepository(Domain),\n params,\n searchables: ['name', 'description']\n })\n\n qb.andWhereInIds(partners.map((p: Partner) => p.partnerDomain.id))\n const [items, total] = await qb.getManyAndCount()\n return { items, total }\n }\n\n @Directive('@privilege(category: \"partner\", privilege: \"query\", domainOwnerGranted: true)')\n @Query(returns => [Domain])\n async vendors(@Ctx() context: ResolverContext): Promise<Domain[]> {\n const { domain } = context.state\n const qb: SelectQueryBuilder<Partner> = getRepository(Partner).createQueryBuilder('PARTNER')\n const partners: Partner[] = await qb\n .leftJoinAndSelect('PARTNER.domain', 'DOMAIN')\n .leftJoinAndSelect('PARTNER.partnerDomain', 'P_DOMAIN')\n .where('P_DOMAIN.id = :domainId', { domainId: domain.id })\n .getMany()\n\n return partners.map((p: Partner) => p.domain)\n }\n\n @FieldResolver()\n async domain(@Root() partner: Partner) {\n return await getRepository(Domain).findOneBy({ id: partner.domainId })\n }\n\n @FieldResolver()\n async partnerDomain(@Root() partner: Partner) {\n return await getRepository(Domain).findOneBy({ id: partner.partnerDomainId })\n }\n\n @FieldResolver()\n async requester(@Root() partner: Partner) {\n return await getRepository(User).findOneBy({ id: partner.requesterId })\n }\n\n @FieldResolver()\n async approver(@Root() partner: Partner) {\n return await getRepository(User).findOneBy({ id: partner.approverId })\n }\n}\n"]}
|
|
@@ -5,6 +5,8 @@ import { Role } from './role.js';
|
|
|
5
5
|
import { RoleList, RolePrivilege, UserRole, RoleBrief } from './role-types.js';
|
|
6
6
|
export declare class RoleQuery {
|
|
7
7
|
role(name: string, context: ResolverContext): Promise<Role>;
|
|
8
|
+
/** Open by design: whether the caller may give or take the parent domain's roles here - the user screen locks them otherwise. */
|
|
9
|
+
mayChangeParentRoles(context: ResolverContext): Promise<boolean>;
|
|
8
10
|
roles(params: ListParam, context: ResolverContext): Promise<RoleList>;
|
|
9
11
|
/**
|
|
10
12
|
* 한 역할의 권한 — **전체 목록과 이 역할이 가진 것을 한 번에** 돌려준다.
|
|
@@ -7,6 +7,7 @@ const type_graphql_1 = require("type-graphql");
|
|
|
7
7
|
const shell_1 = require("@things-factory/shell");
|
|
8
8
|
const privilege_js_1 = require("../privilege/privilege.js");
|
|
9
9
|
const user_js_1 = require("../user/user.js");
|
|
10
|
+
const assignable_roles_js_1 = require("../../utils/assignable-roles.js");
|
|
10
11
|
const role_js_1 = require("./role.js");
|
|
11
12
|
const role_types_js_1 = require("./role-types.js");
|
|
12
13
|
let RoleQuery = class RoleQuery {
|
|
@@ -39,6 +40,10 @@ let RoleQuery = class RoleQuery {
|
|
|
39
40
|
}
|
|
40
41
|
return await repository.findOneBy({ domain: { id: domain.parentId }, name });
|
|
41
42
|
}
|
|
43
|
+
/** Open by design: whether the caller may give or take the parent domain's roles here - the user screen locks them otherwise. */
|
|
44
|
+
async mayChangeParentRoles(context) {
|
|
45
|
+
return await (0, assignable_roles_js_1.mayChangeParentRoles)(context.state.user, context.state.domain);
|
|
46
|
+
}
|
|
42
47
|
async roles(params, context) {
|
|
43
48
|
const { domain } = context.state;
|
|
44
49
|
const [items, total] = await (0, shell_1.getQueryBuilderFromListParams)({
|
|
@@ -209,6 +214,13 @@ tslib_1.__decorate([
|
|
|
209
214
|
tslib_1.__metadata("design:paramtypes", [String, Object]),
|
|
210
215
|
tslib_1.__metadata("design:returntype", Promise)
|
|
211
216
|
], RoleQuery.prototype, "role", null);
|
|
217
|
+
tslib_1.__decorate([
|
|
218
|
+
(0, type_graphql_1.Query)(returns => Boolean, { description: "Whether the caller may give or take the parent domain's roles from this domain." }),
|
|
219
|
+
tslib_1.__param(0, (0, type_graphql_1.Ctx)()),
|
|
220
|
+
tslib_1.__metadata("design:type", Function),
|
|
221
|
+
tslib_1.__metadata("design:paramtypes", [Object]),
|
|
222
|
+
tslib_1.__metadata("design:returntype", Promise)
|
|
223
|
+
], RoleQuery.prototype, "mayChangeParentRoles", null);
|
|
212
224
|
tslib_1.__decorate([
|
|
213
225
|
(0, type_graphql_1.Directive)('@privilege(category: "user", privilege: "query", domainOwnerGranted: true, superUserGranted: true)'),
|
|
214
226
|
(0, type_graphql_1.Query)(returns => role_types_js_1.RoleList, { description: 'To fetch multiple users' }),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"role-query.js","sourceRoot":"","sources":["../../../server/service/role/role-query.ts"],"names":[],"mappings":";;;;AAAA,qCAA4B;AAC5B,+CAAmG;AAGnG,iDAAuG;AAEvG,4DAAqD;AACrD,6CAAsC;AACtC,uCAAgC;AAChC,mDAA8E;AAGvE,IAAM,SAAS,GAAf,MAAM,SAAS;IACpB;;;;;;;;;;;;;;;;;;;OAmBG;IAGG,AAAN,KAAK,CAAC,IAAI,CAAc,IAAY,EAAS,OAAwB;QACnE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;QAEtC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QAE3E,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9E,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CAA0B,MAAiB,EAAS,OAAwB;QACrF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,IAAA,qCAA6B,EAAC;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,cAAI,CAAC;YAC/B,MAAM;YACN,MAAM;YACN,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;SACrC,CAAC,CAAC,eAAe,EAAE,CAAA;QAEpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IAGG,AAAN,KAAK,CAAC,cAAc,CAAgB,MAAc,EAAS,OAAwB;QACjF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,mDAAmD;QACnD,MAAM,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAC7C,KAAK,EAAE;gBACL,EAAE,EAAE,MAAM;gBACV,MAAM,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE;aACjE;YACD,SAAS,EAAE,CAAC,YAAY,CAAC;SAC1B,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,CAAA;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAA;QAEhF,OAAO,CAAC,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3F,EAAE;YACF,IAAI;YACJ,QAAQ;YACR,WAAW;YACX,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC,CAAA;IACL,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IAGG,AAAN,KAAK,CAAC,SAAS,CAAgB,MAAc,EAAS,OAAwB;QAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC/F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAElE,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC;YAC3C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE;SAC5E,CAAC,CAAA;QAEF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC1G,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAQ,OAAwB;QAC3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEtC,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC;aACpC,kBAAkB,CAAC,MAAM,CAAC;aAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;aAC9B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;aACtC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aAC/C,QAAQ,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;aACzG,MAAM,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;aAChC,OAAO,EAAE,CAAA;QAEZ,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;;;;;;;;;OAYG;IAGG,AAAN,KAAK,CAAC,MAAM,CAAS,IAAU;QAC7B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IACrE,CAAC;IAED;;;OAGG;IAGG,AAAN,KAAK,CAAC,KAAK,CAAS,IAAU,EAAS,OAAwB;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,OAAO,CAAC;SACrB,CAAC,CAAA;QAEF,OAAO,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAA;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IAEG,AAAN,KAAK,CAAC,cAAc,CAAS,IAAU;QACrC,OAAO,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC;aAClC,kBAAkB,CAAC,WAAW,CAAC;aAC/B,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC;aACpC,KAAK,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aACvC,QAAQ,EAAE,CAAA;IACf,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU,CAAS,IAAU;QACjC,OAAO,CACL,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAChC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,YAAY,CAAC;SAC1B,CAAC,CACH,CAAC,UAAU,CAAA;IACd,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;CACF,CAAA;AAzOY,8BAAS;AAuBd;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC7C,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IAAgB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qCAW3C;AAIK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,wBAAQ,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;IAC1D,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;sCAWrD;AAsBK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6BAAa,CAAC,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;IAC9D,mBAAA,IAAA,kBAAG,EAAC,QAAQ,CAAC,CAAA;IAAkB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;+CAyBzD;AAqBK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,wBAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IACzD,mBAAA,IAAA,kBAAG,EAAC,QAAQ,CAAC,CAAA;IAAkB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0CAWpD;AAGK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,yBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;IAClF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;wCAanB;AAiBK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IAChB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;uCAE9B;AAQK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAI,CAAC,CAAC;IACjB,mBAAA,IAAA,mBAAI,GAAE,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAZ,cAAI;;sCAO7B;AA4BK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,CAAC;IACL,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;+CAMtC;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,wBAAS,CAAC,CAAC;IACjB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;2CAOlC;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;oBAxOU,SAAS;IADrB,IAAA,uBAAQ,EAAC,cAAI,CAAC;GACF,SAAS,CAyOrB","sourcesContent":["import { In } from 'typeorm'\nimport { Arg, Args, Ctx, Directive, FieldResolver, Int, Query, Resolver, Root } from 'type-graphql'\nimport { SelectQueryBuilder } from 'typeorm'\n\nimport { Domain, getQueryBuilderFromListParams, getRepository, ListParam } from '@things-factory/shell'\n\nimport { Privilege } from '../privilege/privilege.js'\nimport { User } from '../user/user.js'\nimport { Role } from './role.js'\nimport { RoleList, RolePrivilege, UserRole, RoleBrief } from './role-types.js'\n\n@Resolver(Role)\nexport class RoleQuery {\n /*\n * A role by name, from this domain or the one it inherits from.\n *\n * ── Why this is two lookups and not one `In(...)` ───────────────────────\n * A name can match twice: the four duplicate checks in `role-mutation.ts` ask only about\n * this domain, so a role may be created with the same name as one that is already visible\n * through the parent. Measured 2026-09-20 — `createRole` accepts it, and both rows then\n * come back from every list.\n *\n * With `In([own, parent])` there is no `ORDER BY`, so which of the two answered was whatever\n * the driver returned first. Not wrong on a particular day, just unruled: the same call could\n * answer the parent's role on one installation and this domain's on another, and a role is\n * what a privilege check reads.\n *\n * This domain's own comes first. Both readings of what a duplicate should mean point the same\n * way — if the platform ends up forbidding the name, the rows that already exist still have\n * to resolve somewhere, and if shadowing becomes the official meaning this is what it means.\n * ⚠ It is **not** a ruling on that (ADR-0062 decision 3, still with the architect). It is the\n * deterministic reading of either.\n */\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => Role, { description: 'To fetch role' })\n async role(@Arg('name') name: string, @Ctx() context: ResolverContext): Promise<Role> {\n const { domain } = context.state\n const repository = getRepository(Role)\n\n const own = await repository.findOneBy({ domain: { id: domain.id }, name })\n\n if (own || !domain.parentId) {\n return own\n }\n\n return await repository.findOneBy({ domain: { id: domain.parentId }, name })\n }\n\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => RoleList, { description: 'To fetch multiple users' })\n async roles(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<RoleList> {\n const { domain } = context.state\n\n const [items, total] = await getQueryBuilderFromListParams({\n repository: getRepository(Role),\n params,\n domain,\n searchables: ['name', 'description']\n }).getManyAndCount()\n\n return { items, total }\n }\n\n /**\n * 한 역할의 권한 — **전체 목록과 이 역할이 가진 것을 한 번에** 돌려준다.\n *\n * 권한 편집 화면이 필요한 것은 「무엇이 있나」와 「이 역할이 무엇을 갖나」 둘인데, 그것을\n * 질의 둘로 가르면 화면이 둘을 짝지어야 하고 그 짝짓기가 역할 **이름**으로 이루어졌다\n * (옛 `role-privilege-editor` — 같은 이름의 부모 도메인 역할과 헷갈렸다). 여기서 `roleId` 로\n * 짝지어 주면 화면이 그 일을 안 한다.\n *\n * ── 원시 SQL 을 걷어냈다 ────────────────────────────────────────────────────\n * 셋을 동시에 잃고 있었다.\n *\n * ① `roleId` 를 문자열로 이어 붙였다. `user:query` 를 가진 사람이 임의의 SQL 을 넣을 수 있다.\n * ② `CASE WHEN … THEN true` 는 방언이다 — MSSQL 에 boolean 리터럴이 없다. 이 저장소는\n * DB 5종을 지원한다.\n * ③ 도메인을 안 봤다. 남의 도메인 역할의 `roleId` 로도 답했다.\n *\n * 권한 마스터는 전체 배포에 84행 규모(도메인마다 늘지 않는다)이므로 관계를 그대로 읽는다.\n */\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => [RolePrivilege], { description: 'To fetch privileges of a role' })\n async rolePrivileges(@Arg('roleId') roleId: string, @Ctx() context: ResolverContext): Promise<RolePrivilege[]> {\n const { domain } = context.state\n\n /* 상속으로 보이는 부모 도메인 역할까지가 범위다 — `role` 질의와 같은 규칙. */\n const role = await getRepository(Role).findOne({\n where: {\n id: roleId,\n domain: { id: In([domain.id, domain.parentId].filter(Boolean)) }\n },\n relations: ['privileges']\n })\n\n if (!role) {\n return []\n }\n\n const assigned = new Set((role.privileges || []).map(privilege => privilege.id))\n\n return (await getRepository(Privilege).find()).map(({ id, name, category, description }) => ({\n id,\n name,\n category,\n description,\n assigned: assigned.has(id)\n }))\n }\n\n /**\n * 한 사람의 역할 — **부여할 수 있는 전체와 이 사람이 가진 것을 한 번에.**\n *\n * `rolePrivileges` 와 같은 모양이고, **같은 결함을 갖고 있었다.** 한 자리를 고쳤으면 두 번째\n * 자리도 재야 한다는 것이 이 파일에서 그대로 났다.\n *\n * ① `UR.users_id` 자리에 `userId` 를 문자열로 이어 붙였다. `user:query` 를 가진\n * 사람이 임의의 SQL 을 넣을 수 있다.\n * ② `CASE WHEN … THEN true` 는 방언이다 — MSSQL 에 boolean 리터럴이 없다(DB 5종 지원).\n * ③ `FROM roles` — **도메인을 안 봤다.** 남의 도메인 역할까지 전부 돌려줬다.\n *\n * ③ 을 고치면서 범위를 `role`·`rolePrivileges` 와 같게 뒀다 — 내 도메인과 부모 1단.\n * 그것이 실제로 부여할 수 있는 범위다.\n *\n * 지금 이 질의를 부르는 화면은 없다(옛 `user-role-editor` 는 `user(email:)` 로 읽었다).\n * 그래서 범위를 좁히는 것이 깨뜨릴 소비처가 없다.\n */\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => [UserRole], { description: 'To fetch roles of a user' })\n async userRoles(@Arg('userId') userId: string, @Ctx() context: ResolverContext): Promise<UserRole[]> {\n const { domain } = context.state\n\n const user = await getRepository(User).findOne({ where: { id: userId }, relations: ['roles'] })\n const assigned = new Set((user?.roles || []).map(role => role.id))\n\n const roles = await getRepository(Role).find({\n where: { domain: { id: In([domain.id, domain.parentId].filter(Boolean)) } }\n })\n\n return roles.map(({ id, name, description }) => ({ id, name, description, assigned: assigned.has(id) }))\n }\n\n @Query(returns => [RoleBrief], { description: 'To fetch roles of current user (id, name only)' })\n async myRoles(@Ctx() context: ResolverContext): Promise<RoleBrief[]> {\n const { user, domain } = context.state\n\n const roles = await getRepository(Role)\n .createQueryBuilder('ROLE')\n .leftJoin('ROLE.users', 'USER')\n .leftJoin('ROLE.domain', 'ROLE_DOMAIN')\n .where('USER.id = :userId', { userId: user.id })\n .andWhere('ROLE_DOMAIN.id In(:...domainIds)', { domainIds: [domain.id, domain.parentId].filter(Boolean) })\n .select(['ROLE.id', 'ROLE.name'])\n .getMany()\n\n return roles\n }\n\n /*\n * `checkRolePreset` stood here and has been removed. It read `config.get('rolePreset')`\n * and returned it unchanged, declared as `[Role]`.\n *\n * Nothing set that config key and nothing called the query, across every repository on\n * this machine — and it carried no `@privilege`, so any signed-in user could read\n * whatever an installation later put there. Empty today, quietly public the day someone\n * fills it. Role templates (`service/role-template/`) do what this was reaching for, as\n * a boot registry rather than a config blob.\n *\n * auth-base ships to npm, so consumers outside this repository cannot be counted. The\n * removal is recorded in the changelog — that is the only channel they have.\n */\n\n @FieldResolver(type => Domain)\n async domain(@Root() role: Role) {\n return await getRepository(Domain).findOneBy({ id: role.domainId })\n }\n\n /**\n * Role의 users 필드를 위한 리졸버\n * 사용자 조회 권한이 있는 경우에만 접근 가능\n */\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @FieldResolver(type => [User])\n async users(@Root() role: Role, @Ctx() context: ResolverContext) {\n const roleData = await getRepository(Role).findOne({\n where: { id: role.id },\n relations: ['users']\n })\n\n return roleData?.users || []\n }\n\n /**\n * 이 역할이 여는 권한이 **몇 개인가.**\n *\n * ── 왜 수만 따로 있나 ──────────────────────────────────────────────────────\n * 목록 화면이 「이 역할이 무엇을 여나」를 말해야 하는데, 그것을 위해 권한 **행**을 받고 있었다.\n *\n * ```\n * [확인함] roles(limit:20) 권한 포함 5,731 bytes · 69ms\n * [확인함] roles(limit:20) 권한 없이 518 bytes · 7ms → 11.1배 · 10배\n * ```\n *\n * 역할 2개에 권한 행 60개를 받아서 화면에는 잘린 코드 용어 셋을 그렸다. 역할 40개 ×\n * 권한 100개면 한 페이지에 4,000행이다. **`privileges` 필드 리졸버가 역할마다 한 번씩 도는\n * 것**까지 함께 없어지는 것이 더 큰 쪽이다.\n *\n * 그래서 목록은 이 칸을 쓴다 — 행을 안 받고 수를 받는다. 권한을 실제로 고치는 화면은\n * `rolePrivileges(roleId:)` 로 따로 읽는다(전체 목록 + 이 역할이 가진 것을 한 번에).\n *\n * ── 왜 관계를 세지 않고 질의로 세나 ────────────────────────────────────────\n * `relation(...).loadMany()` 는 행을 다 읽고 길이를 재는 것이라 여기서 고치려는 것을 그대로\n * 다시 한다. `getCount()` 는 DB 가 센다.\n *\n * 조인 테이블의 주인은 `Privilege` 쪽이지만(`privilege.ts:72` 의 `@JoinTable`), 양쪽이 관계를\n * 선언하고 있으므로 어느 쪽에서 조인해도 같다.\n */\n @FieldResolver(type => Int)\n async privilegeCount(@Root() role: Role): Promise<number> {\n return await getRepository(Privilege)\n .createQueryBuilder('PRIVILEGE')\n .innerJoin('PRIVILEGE.roles', 'ROLE')\n .where('ROLE.id = :id', { id: role.id })\n .getCount()\n }\n\n @FieldResolver(type => [Privilege])\n async privileges(@Root() role: Role) {\n return (\n await getRepository(Role).findOne({\n where: { id: role.id },\n relations: ['privileges']\n })\n ).privileges\n }\n\n @FieldResolver(type => User)\n async updater(@Root() role: Role): Promise<User> {\n return await getRepository(User).findOneBy({ id: role.updaterId })\n }\n\n @FieldResolver(type => User)\n async creator(@Root() role: Role): Promise<User> {\n return await getRepository(User).findOneBy({ id: role.creatorId })\n }\n}\n"]}
|
|
1
|
+
{"version":3,"file":"role-query.js","sourceRoot":"","sources":["../../../server/service/role/role-query.ts"],"names":[],"mappings":";;;;AAAA,qCAA4B;AAC5B,+CAAmG;AAGnG,iDAAuG;AAEvG,4DAAqD;AACrD,6CAAsC;AACtC,yEAAsE;AACtE,uCAAgC;AAChC,mDAA8E;AAGvE,IAAM,SAAS,GAAf,MAAM,SAAS;IACpB;;;;;;;;;;;;;;;;;;;OAmBG;IAGG,AAAN,KAAK,CAAC,IAAI,CAAc,IAAY,EAAS,OAAwB;QACnE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAA;QAEtC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;QAE3E,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5B,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,iIAAiI;IAE3H,AAAN,KAAK,CAAC,oBAAoB,CAAQ,OAAwB;QACxD,OAAO,MAAM,IAAA,0CAAoB,EAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC7E,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CAA0B,MAAiB,EAAS,OAAwB;QACrF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,IAAA,qCAA6B,EAAC;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,cAAI,CAAC;YAC/B,MAAM;YACN,MAAM;YACN,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;SACrC,CAAC,CAAC,eAAe,EAAE,CAAA;QAEpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IAGG,AAAN,KAAK,CAAC,cAAc,CAAgB,MAAc,EAAS,OAAwB;QACjF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,mDAAmD;QACnD,MAAM,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAC7C,KAAK,EAAE;gBACL,EAAE,EAAE,MAAM;gBACV,MAAM,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE;aACjE;YACD,SAAS,EAAE,CAAC,YAAY,CAAC;SAC1B,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,CAAA;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAA;QAEhF,OAAO,CAAC,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3F,EAAE;YACF,IAAI;YACJ,QAAQ;YACR,WAAW;YACX,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC,CAAA;IACL,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IAGG,AAAN,KAAK,CAAC,SAAS,CAAgB,MAAc,EAAS,OAAwB;QAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC/F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAElE,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC;YAC3C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE;SAC5E,CAAC,CAAA;QAEF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC1G,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAQ,OAAwB;QAC3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEtC,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC;aACpC,kBAAkB,CAAC,MAAM,CAAC;aAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;aAC9B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;aACtC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aAC/C,QAAQ,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;aACzG,MAAM,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;aAChC,OAAO,EAAE,CAAA;QAEZ,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;;;;;;;;;OAYG;IAGG,AAAN,KAAK,CAAC,MAAM,CAAS,IAAU;QAC7B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IACrE,CAAC;IAED;;;OAGG;IAGG,AAAN,KAAK,CAAC,KAAK,CAAS,IAAU,EAAS,OAAwB;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,OAAO,CAAC;SACrB,CAAC,CAAA;QAEF,OAAO,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAA;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IAEG,AAAN,KAAK,CAAC,cAAc,CAAS,IAAU;QACrC,OAAO,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC;aAClC,kBAAkB,CAAC,WAAW,CAAC;aAC/B,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC;aACpC,KAAK,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aACvC,QAAQ,EAAE,CAAA;IACf,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU,CAAS,IAAU;QACjC,OAAO,CACL,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAChC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,YAAY,CAAC;SAC1B,CAAC,CACH,CAAC,UAAU,CAAA;IACd,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;CACF,CAAA;AA/OY,8BAAS;AAuBd;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC7C,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IAAgB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qCAW3C;AAIK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,iFAAiF,EAAE,CAAC;IAClG,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qDAEhC;AAIK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,wBAAQ,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;IAC1D,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;sCAWrD;AAsBK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6BAAa,CAAC,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;IAC9D,mBAAA,IAAA,kBAAG,EAAC,QAAQ,CAAC,CAAA;IAAkB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;+CAyBzD;AAqBK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,wBAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IACzD,mBAAA,IAAA,kBAAG,EAAC,QAAQ,CAAC,CAAA;IAAkB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0CAWpD;AAGK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,yBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;IAClF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;wCAanB;AAiBK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IAChB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;uCAE9B;AAQK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAI,CAAC,CAAC;IACjB,mBAAA,IAAA,mBAAI,GAAE,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAZ,cAAI;;sCAO7B;AA4BK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,CAAC;IACL,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;+CAMtC;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,wBAAS,CAAC,CAAC;IACjB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;2CAOlC;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;oBA9OU,SAAS;IADrB,IAAA,uBAAQ,EAAC,cAAI,CAAC;GACF,SAAS,CA+OrB","sourcesContent":["import { In } from 'typeorm'\nimport { Arg, Args, Ctx, Directive, FieldResolver, Int, Query, Resolver, Root } from 'type-graphql'\nimport { SelectQueryBuilder } from 'typeorm'\n\nimport { Domain, getQueryBuilderFromListParams, getRepository, ListParam } from '@things-factory/shell'\n\nimport { Privilege } from '../privilege/privilege.js'\nimport { User } from '../user/user.js'\nimport { mayChangeParentRoles } from '../../utils/assignable-roles.js'\nimport { Role } from './role.js'\nimport { RoleList, RolePrivilege, UserRole, RoleBrief } from './role-types.js'\n\n@Resolver(Role)\nexport class RoleQuery {\n /*\n * A role by name, from this domain or the one it inherits from.\n *\n * ── Why this is two lookups and not one `In(...)` ───────────────────────\n * A name can match twice: the four duplicate checks in `role-mutation.ts` ask only about\n * this domain, so a role may be created with the same name as one that is already visible\n * through the parent. Measured 2026-09-20 — `createRole` accepts it, and both rows then\n * come back from every list.\n *\n * With `In([own, parent])` there is no `ORDER BY`, so which of the two answered was whatever\n * the driver returned first. Not wrong on a particular day, just unruled: the same call could\n * answer the parent's role on one installation and this domain's on another, and a role is\n * what a privilege check reads.\n *\n * This domain's own comes first. Both readings of what a duplicate should mean point the same\n * way — if the platform ends up forbidding the name, the rows that already exist still have\n * to resolve somewhere, and if shadowing becomes the official meaning this is what it means.\n * ⚠ It is **not** a ruling on that (ADR-0062 decision 3, still with the architect). It is the\n * deterministic reading of either.\n */\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => Role, { description: 'To fetch role' })\n async role(@Arg('name') name: string, @Ctx() context: ResolverContext): Promise<Role> {\n const { domain } = context.state\n const repository = getRepository(Role)\n\n const own = await repository.findOneBy({ domain: { id: domain.id }, name })\n\n if (own || !domain.parentId) {\n return own\n }\n\n return await repository.findOneBy({ domain: { id: domain.parentId }, name })\n }\n\n /** Open by design: whether the caller may give or take the parent domain's roles here - the user screen locks them otherwise. */\n @Query(returns => Boolean, { description: \"Whether the caller may give or take the parent domain's roles from this domain.\" })\n async mayChangeParentRoles(@Ctx() context: ResolverContext): Promise<boolean> {\n return await mayChangeParentRoles(context.state.user, context.state.domain)\n }\n\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => RoleList, { description: 'To fetch multiple users' })\n async roles(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<RoleList> {\n const { domain } = context.state\n\n const [items, total] = await getQueryBuilderFromListParams({\n repository: getRepository(Role),\n params,\n domain,\n searchables: ['name', 'description']\n }).getManyAndCount()\n\n return { items, total }\n }\n\n /**\n * 한 역할의 권한 — **전체 목록과 이 역할이 가진 것을 한 번에** 돌려준다.\n *\n * 권한 편집 화면이 필요한 것은 「무엇이 있나」와 「이 역할이 무엇을 갖나」 둘인데, 그것을\n * 질의 둘로 가르면 화면이 둘을 짝지어야 하고 그 짝짓기가 역할 **이름**으로 이루어졌다\n * (옛 `role-privilege-editor` — 같은 이름의 부모 도메인 역할과 헷갈렸다). 여기서 `roleId` 로\n * 짝지어 주면 화면이 그 일을 안 한다.\n *\n * ── 원시 SQL 을 걷어냈다 ────────────────────────────────────────────────────\n * 셋을 동시에 잃고 있었다.\n *\n * ① `roleId` 를 문자열로 이어 붙였다. `user:query` 를 가진 사람이 임의의 SQL 을 넣을 수 있다.\n * ② `CASE WHEN … THEN true` 는 방언이다 — MSSQL 에 boolean 리터럴이 없다. 이 저장소는\n * DB 5종을 지원한다.\n * ③ 도메인을 안 봤다. 남의 도메인 역할의 `roleId` 로도 답했다.\n *\n * 권한 마스터는 전체 배포에 84행 규모(도메인마다 늘지 않는다)이므로 관계를 그대로 읽는다.\n */\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => [RolePrivilege], { description: 'To fetch privileges of a role' })\n async rolePrivileges(@Arg('roleId') roleId: string, @Ctx() context: ResolverContext): Promise<RolePrivilege[]> {\n const { domain } = context.state\n\n /* 상속으로 보이는 부모 도메인 역할까지가 범위다 — `role` 질의와 같은 규칙. */\n const role = await getRepository(Role).findOne({\n where: {\n id: roleId,\n domain: { id: In([domain.id, domain.parentId].filter(Boolean)) }\n },\n relations: ['privileges']\n })\n\n if (!role) {\n return []\n }\n\n const assigned = new Set((role.privileges || []).map(privilege => privilege.id))\n\n return (await getRepository(Privilege).find()).map(({ id, name, category, description }) => ({\n id,\n name,\n category,\n description,\n assigned: assigned.has(id)\n }))\n }\n\n /**\n * 한 사람의 역할 — **부여할 수 있는 전체와 이 사람이 가진 것을 한 번에.**\n *\n * `rolePrivileges` 와 같은 모양이고, **같은 결함을 갖고 있었다.** 한 자리를 고쳤으면 두 번째\n * 자리도 재야 한다는 것이 이 파일에서 그대로 났다.\n *\n * ① `UR.users_id` 자리에 `userId` 를 문자열로 이어 붙였다. `user:query` 를 가진\n * 사람이 임의의 SQL 을 넣을 수 있다.\n * ② `CASE WHEN … THEN true` 는 방언이다 — MSSQL 에 boolean 리터럴이 없다(DB 5종 지원).\n * ③ `FROM roles` — **도메인을 안 봤다.** 남의 도메인 역할까지 전부 돌려줬다.\n *\n * ③ 을 고치면서 범위를 `role`·`rolePrivileges` 와 같게 뒀다 — 내 도메인과 부모 1단.\n * 그것이 실제로 부여할 수 있는 범위다.\n *\n * 지금 이 질의를 부르는 화면은 없다(옛 `user-role-editor` 는 `user(email:)` 로 읽었다).\n * 그래서 범위를 좁히는 것이 깨뜨릴 소비처가 없다.\n */\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @Query(returns => [UserRole], { description: 'To fetch roles of a user' })\n async userRoles(@Arg('userId') userId: string, @Ctx() context: ResolverContext): Promise<UserRole[]> {\n const { domain } = context.state\n\n const user = await getRepository(User).findOne({ where: { id: userId }, relations: ['roles'] })\n const assigned = new Set((user?.roles || []).map(role => role.id))\n\n const roles = await getRepository(Role).find({\n where: { domain: { id: In([domain.id, domain.parentId].filter(Boolean)) } }\n })\n\n return roles.map(({ id, name, description }) => ({ id, name, description, assigned: assigned.has(id) }))\n }\n\n @Query(returns => [RoleBrief], { description: 'To fetch roles of current user (id, name only)' })\n async myRoles(@Ctx() context: ResolverContext): Promise<RoleBrief[]> {\n const { user, domain } = context.state\n\n const roles = await getRepository(Role)\n .createQueryBuilder('ROLE')\n .leftJoin('ROLE.users', 'USER')\n .leftJoin('ROLE.domain', 'ROLE_DOMAIN')\n .where('USER.id = :userId', { userId: user.id })\n .andWhere('ROLE_DOMAIN.id In(:...domainIds)', { domainIds: [domain.id, domain.parentId].filter(Boolean) })\n .select(['ROLE.id', 'ROLE.name'])\n .getMany()\n\n return roles\n }\n\n /*\n * `checkRolePreset` stood here and has been removed. It read `config.get('rolePreset')`\n * and returned it unchanged, declared as `[Role]`.\n *\n * Nothing set that config key and nothing called the query, across every repository on\n * this machine — and it carried no `@privilege`, so any signed-in user could read\n * whatever an installation later put there. Empty today, quietly public the day someone\n * fills it. Role templates (`service/role-template/`) do what this was reaching for, as\n * a boot registry rather than a config blob.\n *\n * auth-base ships to npm, so consumers outside this repository cannot be counted. The\n * removal is recorded in the changelog — that is the only channel they have.\n */\n\n @FieldResolver(type => Domain)\n async domain(@Root() role: Role) {\n return await getRepository(Domain).findOneBy({ id: role.domainId })\n }\n\n /**\n * Role의 users 필드를 위한 리졸버\n * 사용자 조회 권한이 있는 경우에만 접근 가능\n */\n @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n @FieldResolver(type => [User])\n async users(@Root() role: Role, @Ctx() context: ResolverContext) {\n const roleData = await getRepository(Role).findOne({\n where: { id: role.id },\n relations: ['users']\n })\n\n return roleData?.users || []\n }\n\n /**\n * 이 역할이 여는 권한이 **몇 개인가.**\n *\n * ── 왜 수만 따로 있나 ──────────────────────────────────────────────────────\n * 목록 화면이 「이 역할이 무엇을 여나」를 말해야 하는데, 그것을 위해 권한 **행**을 받고 있었다.\n *\n * ```\n * [확인함] roles(limit:20) 권한 포함 5,731 bytes · 69ms\n * [확인함] roles(limit:20) 권한 없이 518 bytes · 7ms → 11.1배 · 10배\n * ```\n *\n * 역할 2개에 권한 행 60개를 받아서 화면에는 잘린 코드 용어 셋을 그렸다. 역할 40개 ×\n * 권한 100개면 한 페이지에 4,000행이다. **`privileges` 필드 리졸버가 역할마다 한 번씩 도는\n * 것**까지 함께 없어지는 것이 더 큰 쪽이다.\n *\n * 그래서 목록은 이 칸을 쓴다 — 행을 안 받고 수를 받는다. 권한을 실제로 고치는 화면은\n * `rolePrivileges(roleId:)` 로 따로 읽는다(전체 목록 + 이 역할이 가진 것을 한 번에).\n *\n * ── 왜 관계를 세지 않고 질의로 세나 ────────────────────────────────────────\n * `relation(...).loadMany()` 는 행을 다 읽고 길이를 재는 것이라 여기서 고치려는 것을 그대로\n * 다시 한다. `getCount()` 는 DB 가 센다.\n *\n * 조인 테이블의 주인은 `Privilege` 쪽이지만(`privilege.ts:72` 의 `@JoinTable`), 양쪽이 관계를\n * 선언하고 있으므로 어느 쪽에서 조인해도 같다.\n */\n @FieldResolver(type => Int)\n async privilegeCount(@Root() role: Role): Promise<number> {\n return await getRepository(Privilege)\n .createQueryBuilder('PRIVILEGE')\n .innerJoin('PRIVILEGE.roles', 'ROLE')\n .where('ROLE.id = :id', { id: role.id })\n .getCount()\n }\n\n @FieldResolver(type => [Privilege])\n async privileges(@Root() role: Role) {\n return (\n await getRepository(Role).findOne({\n where: { id: role.id },\n relations: ['privileges']\n })\n ).privileges\n }\n\n @FieldResolver(type => User)\n async updater(@Root() role: Role): Promise<User> {\n return await getRepository(User).findOneBy({ id: role.updaterId })\n }\n\n @FieldResolver(type => User)\n async creator(@Root() role: Role): Promise<User> {\n return await getRepository(User).findOneBy({ id: role.creatorId })\n }\n}\n"]}
|
|
@@ -3,4 +3,4 @@ import { UserQuery } from './user-query.js';
|
|
|
3
3
|
import { UserMutation } from './user-mutation.js';
|
|
4
4
|
import { DomainQuery } from './domain-query.js';
|
|
5
5
|
export declare const entities: (typeof User)[];
|
|
6
|
-
export declare const resolvers: (typeof
|
|
6
|
+
export declare const resolvers: (typeof UserMutation | typeof UserQuery | typeof DomainQuery)[];
|
|
@@ -344,7 +344,7 @@ let UserMutation = class UserMutation {
|
|
|
344
344
|
throw new Error(`User is not belongs to current domain`);
|
|
345
345
|
}
|
|
346
346
|
/* Found again in this domain's scope - the ids are the client's (utils/assignable-roles.ts, ADR-0103 decision 2). */
|
|
347
|
-
const { user: saved } = await (0, assignable_roles_js_1.assignRoles)(user, { add: selectedRoles.map(role => role.id), remove: availableRoles.map(role => role.id) }, domain, tx);
|
|
347
|
+
const { user: saved } = await (0, assignable_roles_js_1.assignRoles)(user, { add: selectedRoles.map(role => role.id), remove: availableRoles.map(role => role.id) }, domain, tx, context.state.user);
|
|
348
348
|
return saved;
|
|
349
349
|
}
|
|
350
350
|
};
|