@things-factory/auth-base 10.1.141 → 10.1.145

package/dist-server/index.js

@@ -1,8 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const tslib_1 = require("tslib");
-const shell_1 = require("@things-factory/shell");
-const privilege_js_1 = require("./service/privilege/privilege.js");
+const privilege_sync_js_1 = require("./service/privilege/privilege-sync.js");
 const privilege_axis_js_1 = require("./service/privilege/privilege-axis.js");
 const role_template_js_1 = require("./service/role-template/role-template.js");
 require("./routes.js");
@@ -29,13 +28,7 @@ tslib_1.__exportStar(require("./utils/build-auth-url.js"), exports);
 tslib_1.__exportStar(require("./errors/index.js"), exports);
 tslib_1.__exportStar(require("./types.js"), exports);
 process.on('bootstrap-module-start', async ({ app, config, client }) => {
-    const privileges = process['PRIVILEGES'];
-    const privilegeRepository = (0, shell_1.getRepository)(privilege_js_1.Privilege);
-    for (const [category, name] of Object.values(privileges)) {
-        if (0 == (await privilegeRepository.count({ where: { category, name } }))) {
-            await privilegeRepository.save({ category, name });
-        }
-    }
+    await (0, privilege_sync_js_1.synchronizePrivileges)(Object.values(process['PRIVILEGES']));
     console.log('[auth-base:bootstrap] Synchronization for privilege master has just done.');
     /*
      * Templates name privileges by (category, axis), and a category can move. A template

package/dist-server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../server/index.ts"],"names":[],"mappings":";;;AAAA,iDAAqD;AACrD,mEAA4D;AAC5D,6EAA0E;AAC1E,+EAAsF;AAEtF,uBAAoB;AAEpB,6DAAkC;AAClC,uGAAuG;AACvG,6EAAkD;AAClD,yEAA8C;AAE9C,gEAAqC;AAErC,iEAAsC;AACtC,4DAAiC;AACjC,sDAA2B;AAE3B,sEAA2C;AAC3C,sEAA2C;AAC3C,yEAA8C;AAC9C,6EAAkD;AAClD,sEAA2C;AAC3C,gEAAqC;AACrC,+EAAoD;AACpD,yEAA8C;AAC9C,mEAAwC;AACxC,sEAA2C;AAC3C,yEAA8C;AAC9C,oEAAyC;AAEzC,4DAAiC;AAEjC,qDAA0B;AAE1B,OAAO,CAAC,EAAE,CAAC,wBAA+B,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAO,EAAE,EAAE;IACjF,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACxC,MAAM,mBAAmB,GAAG,IAAA,qBAAa,EAAC,wBAAS,CAAC,CAAA;IAEpD,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,UAA8B,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;YAC1E,MAAM,mBAAmB,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;QACpD,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAA;IAExF;;;;;OAKG;IACH,IAAA,8CAA2B,GAAE,CAAA;IAE7B;;;;;OAKG;IACH,IAAA,sCAAkB,GAAE,CAAA;AACtB,CAAC,CAAC,CAAA","sourcesContent":["import { getRepository } from '@things-factory/shell'\nimport { Privilege } from './service/privilege/privilege.js'\nimport { reportDeclaredAxes } from './service/privilege/privilege-axis.js'\nimport { reportUnknownTemplateGrants } from './service/role-template/role-template.js'\n\nimport './routes.js'\n\nexport * from './service/index.js'\n/* AI 입력 declarations - plain data, registered by an application that runs the assistant (ADR-0103). */\nexport * from './ai-entry/access-entry-targets.js'\nexport * from './ai-entry/access-assistant.js'\nexport type { EntryTargetDeclaration as AuthEntryTarget } from './ai-entry/entry-target-shape.js'\nexport * from './migrations/index.js'\n\nexport * from './middlewares/index.js'\nexport * from './router/index.js'\nexport * from './routes.js'\n\nexport * from './utils/get-domain-users.js'\nexport * from './utils/get-user-domains.js'\nexport * from './utils/checkin-domain-rule.js'\nexport * from './utils/can-user-checkin-domain.js'\nexport * from './utils/domain-ownership.js'\nexport * from './utils/get-secret.js'\nexport * from './utils/check-user-belongs-domain.js'\nexport * from './utils/access-token-cookie.js'\nexport * from './utils/encrypt-state.js'\nexport * from './utils/check-permission.js'\nexport * from './utils/check-user-has-role.js'\nexport * from './utils/build-auth-url.js'\n\nexport * from './errors/index.js'\n\nexport * from './types.js'\n\nprocess.on('bootstrap-module-start' as any, async ({ app, config, client }: any) => {\n  const privileges = process['PRIVILEGES']\n  const privilegeRepository = getRepository(Privilege)\n\n  for (const [category, name] of Object.values(privileges as [string, string])) {\n    if (0 == (await privilegeRepository.count({ where: { category, name } }))) {\n      await privilegeRepository.save({ category, name })\n    }\n  }\n\n  console.log('[auth-base:bootstrap] Synchronization for privilege master has just done.')\n\n  /*\n   * Templates name privileges by (category, axis), and a category can move. A template\n   * that survives a rename becomes a role that grants nothing — the administrator picks\n   * \"quality inspector\", gets a role, and no door opens. Check the names once, here, where\n   * the privilege registry has just been filled.\n   */\n  reportUnknownTemplateGrants()\n\n  /*\n   * Say which axis vocabulary this installation ended up with. It cannot go in the SDL —\n   * it differs per installation, which is the whole point — so a boot line is the honest\n   * substitute, and it separates \"nobody declared, these are the defaults\" from \"someone\n   * declared exactly these\".\n   */\n  reportDeclaredAxes()\n})\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../server/index.ts"],"names":[],"mappings":";;;AAAA,6EAA6E;AAC7E,6EAA0E;AAC1E,+EAAsF;AAEtF,uBAAoB;AAEpB,6DAAkC;AAClC,uGAAuG;AACvG,6EAAkD;AAClD,yEAA8C;AAE9C,gEAAqC;AAErC,iEAAsC;AACtC,4DAAiC;AACjC,sDAA2B;AAE3B,sEAA2C;AAC3C,sEAA2C;AAC3C,yEAA8C;AAC9C,6EAAkD;AAClD,sEAA2C;AAC3C,gEAAqC;AACrC,+EAAoD;AACpD,yEAA8C;AAC9C,mEAAwC;AACxC,sEAA2C;AAC3C,yEAA8C;AAC9C,oEAAyC;AAEzC,4DAAiC;AAEjC,qDAA0B;AAE1B,OAAO,CAAC,EAAE,CAAC,wBAA+B,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAO,EAAE,EAAE;IACjF,MAAM,IAAA,yCAAqB,EAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAqC,CAAC,CAAC,CAAA;IAErG,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAA;IAExF;;;;;OAKG;IACH,IAAA,8CAA2B,GAAE,CAAA;IAE7B;;;;;OAKG;IACH,IAAA,sCAAkB,GAAE,CAAA;AACtB,CAAC,CAAC,CAAA","sourcesContent":["import { synchronizePrivileges } from './service/privilege/privilege-sync.js'\nimport { reportDeclaredAxes } from './service/privilege/privilege-axis.js'\nimport { reportUnknownTemplateGrants } from './service/role-template/role-template.js'\n\nimport './routes.js'\n\nexport * from './service/index.js'\n/* AI 입력 declarations - plain data, registered by an application that runs the assistant (ADR-0103). */\nexport * from './ai-entry/access-entry-targets.js'\nexport * from './ai-entry/access-assistant.js'\nexport type { EntryTargetDeclaration as AuthEntryTarget } from './ai-entry/entry-target-shape.js'\nexport * from './migrations/index.js'\n\nexport * from './middlewares/index.js'\nexport * from './router/index.js'\nexport * from './routes.js'\n\nexport * from './utils/get-domain-users.js'\nexport * from './utils/get-user-domains.js'\nexport * from './utils/checkin-domain-rule.js'\nexport * from './utils/can-user-checkin-domain.js'\nexport * from './utils/domain-ownership.js'\nexport * from './utils/get-secret.js'\nexport * from './utils/check-user-belongs-domain.js'\nexport * from './utils/access-token-cookie.js'\nexport * from './utils/encrypt-state.js'\nexport * from './utils/check-permission.js'\nexport * from './utils/check-user-has-role.js'\nexport * from './utils/build-auth-url.js'\n\nexport * from './errors/index.js'\n\nexport * from './types.js'\n\nprocess.on('bootstrap-module-start' as any, async ({ app, config, client }: any) => {\n  await synchronizePrivileges(Object.values(process['PRIVILEGES'] as Record<string, [string, string]>))\n\n  console.log('[auth-base:bootstrap] Synchronization for privilege master has just done.')\n\n  /*\n   * Templates name privileges by (category, axis), and a category can move. A template\n   * that survives a rename becomes a role that grants nothing — the administrator picks\n   * \"quality inspector\", gets a role, and no door opens. Check the names once, here, where\n   * the privilege registry has just been filled.\n   */\n  reportUnknownTemplateGrants()\n\n  /*\n   * Say which axis vocabulary this installation ended up with. It cannot go in the SDL —\n   * it differs per installation, which is the whole point — so a boot line is the honest\n   * substitute, and it separates \"nobody declared, these are the defaults\" from \"someone\n   * declared exactly these\".\n   */\n  reportDeclaredAxes()\n})\n"]}

package/dist-server/service/access-request/index.d.ts

@@ -2,4 +2,4 @@ import { AccessRequest } from './access-request.js';
 import { AccessRequestMutation } from './access-request-mutation.js';
 import { AccessRequestQuery } from './access-request-query.js';
 export declare const entities: (typeof AccessRequest)[];
-export declare const resolvers: (typeof AccessRequestQuery | typeof AccessRequestMutation)[];
+export declare const resolvers: (typeof AccessRequestMutation | typeof AccessRequestQuery)[];

package/dist-server/service/app-binding/index.d.ts

@@ -1,3 +1,3 @@
 import { AppBindingQuery } from './app-binding-query.js';
 import { AppBindingMutation } from './app-binding-mutation.js';
-export declare const resolvers: (typeof AppBindingMutation | typeof AppBindingQuery)[];
+export declare const resolvers: (typeof AppBindingQuery | typeof AppBindingMutation)[];

package/dist-server/service/appliance/index.d.ts

@@ -2,4 +2,4 @@ import { Appliance } from './appliance.js';
 import { ApplianceQuery } from './appliance-query.js';
 import { ApplianceMutation } from './appliance-mutation.js';
 export declare const entities: (typeof Appliance)[];
-export declare const resolvers: (typeof ApplianceMutation | typeof ApplianceQuery)[];
+export declare const resolvers: (typeof ApplianceQuery | typeof ApplianceMutation)[];

package/dist-server/service/application/index.d.ts

@@ -2,4 +2,4 @@ import { Application } from './application.js';
 import { ApplicationQuery } from './application-query.js';
 import { ApplicationMutation } from './application-mutation.js';
 export declare const entities: (typeof Application)[];
-export declare const resolvers: (typeof ApplicationMutation | typeof ApplicationQuery)[];
+export declare const resolvers: (typeof ApplicationQuery | typeof ApplicationMutation)[];

package/dist-server/service/domain-link/index.d.ts

@@ -2,5 +2,5 @@ import { DomainLink } from './domain-link.js';
 import { DomainLinkQuery } from './domain-link-query.js';
 import { DomainLinkMutation } from './domain-link-mutation.js';
 export declare const entities: (typeof DomainLink)[];
-export declare const resolvers: (typeof DomainLinkMutation | typeof DomainLinkQuery)[];
+export declare const resolvers: (typeof DomainLinkQuery | typeof DomainLinkMutation)[];
 export declare const subscribers: any[];

package/dist-server/service/domain-owner/index.d.ts

@@ -2,4 +2,4 @@ import { DomainOwner } from './domain-owner.js';
 import { DomainOwnerQuery } from './domain-owner-query.js';
 import { DomainOwnerMutation } from './domain-owner-mutation.js';
 export declare const entities: (typeof DomainOwner)[];
-export declare const resolvers: (typeof DomainOwnerMutation | typeof DomainOwnerQuery)[];
+export declare const resolvers: (typeof DomainOwnerQuery | typeof DomainOwnerMutation)[];

package/dist-server/service/granted-role/index.d.ts

@@ -2,4 +2,4 @@ import { GrantedRole } from './granted-role.js';
 import { GrantedRoleQuery } from './granted-role-query.js';
 import { GrantedRoleMutation } from './granted-role-mutation.js';
 export declare const entities: (typeof GrantedRole)[];
-export declare const resolvers: (typeof GrantedRoleMutation | typeof GrantedRoleQuery)[];
+export declare const resolvers: (typeof GrantedRoleQuery | typeof GrantedRoleMutation)[];

package/dist-server/service/index.d.ts

@@ -33,7 +33,7 @@ export * from './role/role-types.js';
 export * from './user/user-types.js';
 export * from './domain-link/domain-link-types.js';
 export * from './access-request/access-request-types.js';
-export declare const entities: (typeof import("./invitation/invitation.js").Invitation | typeof import("./domain-link/domain-link.js").DomainLink | typeof import("./user/user.js").User | typeof import("./role/role.js").Role | typeof import("./privilege/privilege.js").Privilege | typeof import("./partner/partner.js").Partner | typeof import("./application/application.js").Application | typeof import("./appliance/appliance.js").Appliance | typeof import("./access-request/access-request.js").AccessRequest | typeof import("./login-history/login-history.js").LoginHistory | typeof import("./verification-token/verification-token.js").VerificationTokenType | typeof import("./verification-token/verification-token.js").VerificationToken | typeof import("./granted-role/granted-role.js").GrantedRole | typeof import("./domain-owner/domain-owner.js").DomainOwner | typeof import("./users-auth-providers/users-auth-providers.js").UsersAuthProviders | typeof import("./auth-provider/auth-provider.js").AuthProvider | typeof import("./web-auth-credential/web-auth-credential.js").WebAuthCredential | typeof import("./password-history/password-history.js").PasswordHistory)[];
+export declare const entities: (typeof import("./web-auth-credential/web-auth-credential.js").WebAuthCredential | typeof import("./user/user.js").User | typeof import("./auth-provider/auth-provider.js").AuthProvider | typeof import("./users-auth-providers/users-auth-providers.js").UsersAuthProviders | typeof import("./domain-owner/domain-owner.js").DomainOwner | typeof import("./granted-role/granted-role.js").GrantedRole | typeof import("./role/role.js").Role | typeof import("./privilege/privilege.js").Privilege | typeof import("./password-history/password-history.js").PasswordHistory | typeof import("./verification-token/verification-token.js").VerificationToken | typeof import("./verification-token/verification-token.js").VerificationTokenType | typeof import("./invitation/invitation.js").Invitation | typeof import("./application/application.js").Application | typeof import("./login-history/login-history.js").LoginHistory | typeof import("./access-request/access-request.js").AccessRequest | typeof import("./appliance/appliance.js").Appliance | typeof import("./partner/partner.js").Partner | typeof import("./domain-link/domain-link.js").DomainLink)[];
 export declare const schema: {
     typeDefs: {
         privilegeDirectiveTypeDefs: import("graphql").DocumentNode;

package/dist-server/service/invitation/index.d.ts

@@ -2,4 +2,4 @@ import { Invitation } from './invitation.js';
 import { InvitationQuery } from './invitation-query.js';
 import { InvitationMutation } from './invitation-mutation.js';
 export declare const entities: (typeof Invitation)[];
-export declare const resolvers: (typeof InvitationMutation | typeof InvitationQuery)[];
+export declare const resolvers: (typeof InvitationQuery | typeof InvitationMutation)[];

package/dist-server/service/partner/index.d.ts

@@ -2,4 +2,4 @@ import { Partner } from './partner.js';
 import { PartnerQuery } from './partner-query.js';
 import { PartnerMutation } from './partner-mutation.js';
 export declare const entities: (typeof Partner)[];
-export declare const resolvers: (typeof PartnerMutation | typeof PartnerQuery)[];
+export declare const resolvers: (typeof PartnerQuery | typeof PartnerMutation)[];

package/dist-server/service/privilege/index.d.ts

@@ -2,4 +2,4 @@ import { Privilege } from './privilege.js';
 import { PrivilegeQuery } from './privilege-query.js';
 import { PrivilegeMutation } from './privilege-mutation.js';
 export declare const entities: (typeof Privilege)[];
-export declare const resolvers: (typeof PrivilegeMutation | typeof PrivilegeQuery)[];
+export declare const resolvers: (typeof PrivilegeQuery | typeof PrivilegeMutation)[];

package/dist-server/service/privilege/privilege-sync.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Writes the privileges the loaded modules declare and the table does not have yet. Returns the ones it
+ * added.
+ *
+ * It takes its turn among the boot-time writers (shell `inBootTurn`). On sqlite every transaction shares
+ * one connection: run beside another module's boot transaction, its insert started in the same tick as
+ * that one ("cannot start a transaction within a transaction") or rode inside it and went when it rolled
+ * back. The privilege was then missing again at the next boot, and the collision repeated every boot.
+ */
+export declare function synchronizePrivileges(declared: Iterable<[string, string]>): Promise<string[]>;

package/dist-server/service/privilege/privilege-sync.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.synchronizePrivileges = synchronizePrivileges;
+const shell_1 = require("@things-factory/shell");
+const privilege_js_1 = require("./privilege.js");
+/**
+ * Writes the privileges the loaded modules declare and the table does not have yet. Returns the ones it
+ * added.
+ *
+ * It takes its turn among the boot-time writers (shell `inBootTurn`). On sqlite every transaction shares
+ * one connection: run beside another module's boot transaction, its insert started in the same tick as
+ * that one ("cannot start a transaction within a transaction") or rode inside it and went when it rolled
+ * back. The privilege was then missing again at the next boot, and the collision repeated every boot.
+ */
+async function synchronizePrivileges(declared) {
+    return await (0, shell_1.inBootTurn)(async () => {
+        const repository = (0, shell_1.getRepository)(privilege_js_1.Privilege);
+        const added = [];
+        for (const [category, name] of declared) {
+            if (0 == (await repository.count({ where: { category, name } }))) {
+                await repository.save({ category, name });
+                added.push(`${category}/${name}`);
+            }
+        }
+        return added;
+    });
+}
+//# sourceMappingURL=privilege-sync.js.map

package/dist-server/service/privilege/privilege-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privilege-sync.js","sourceRoot":"","sources":["../../../server/service/privilege/privilege-sync.ts"],"names":[],"mappings":";;AAaA,sDAcC;AA3BD,iDAAiE;AAEjE,iDAA0C;AAE1C;;;;;;;;GAQG;AACI,KAAK,UAAU,qBAAqB,CAAC,QAAoC;IAC9E,OAAO,MAAM,IAAA,kBAAU,EAAC,KAAK,IAAI,EAAE;QACjC,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,wBAAS,CAAC,CAAA;QAC3C,MAAM,KAAK,GAAa,EAAE,CAAA;QAE1B,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;gBACjE,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;gBACzC,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAA;YACnC,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC,CAAC,CAAA;AACJ,CAAC","sourcesContent":["import { getRepository, inBootTurn } from '@things-factory/shell'\n\nimport { Privilege } from './privilege.js'\n\n/**\n * Writes the privileges the loaded modules declare and the table does not have yet. Returns the ones it\n * added.\n *\n * It takes its turn among the boot-time writers (shell `inBootTurn`). On sqlite every transaction shares\n * one connection: run beside another module's boot transaction, its insert started in the same tick as\n * that one (\"cannot start a transaction within a transaction\") or rode inside it and went when it rolled\n * back. The privilege was then missing again at the next boot, and the collision repeated every boot.\n */\nexport async function synchronizePrivileges(declared: Iterable<[string, string]>): Promise<string[]> {\n  return await inBootTurn(async () => {\n    const repository = getRepository(Privilege)\n    const added: string[] = []\n\n    for (const [category, name] of declared) {\n      if (0 == (await repository.count({ where: { category, name } }))) {\n        await repository.save({ category, name })\n        added.push(`${category}/${name}`)\n      }\n    }\n\n    return added\n  })\n}\n"]}

package/dist-server/service/role/index.d.ts

@@ -3,4 +3,4 @@ import { RoleQuery } from './role-query.js';
 import { RoleMutation } from './role-mutation.js';
 import { RolePrivilegeQuery } from './role-privilege-query.js';
 export declare const entities: (typeof Role)[];
-export declare const resolvers: (typeof RoleMutation | typeof RoleQuery | typeof RolePrivilegeQuery)[];
+export declare const resolvers: (typeof RoleQuery | typeof RoleMutation | typeof RolePrivilegeQuery)[];

package/dist-server/service/role-template/index.d.ts

@@ -2,4 +2,4 @@ import { RoleTemplateGapResolver } from './role-template-gap-resolver.js';
 import { RoleTemplateMutation } from './role-template-mutation.js';
 import { RoleTemplateQuery } from './role-template-query.js';
 export declare const entities: any[];
-export declare const resolvers: (typeof RoleTemplateQuery | typeof RoleTemplateMutation | typeof RoleTemplateGapResolver)[];
+export declare const resolvers: (typeof RoleTemplateGapResolver | typeof RoleTemplateMutation | typeof RoleTemplateQuery)[];

package/dist-server/service/user/index.d.ts

@@ -3,4 +3,4 @@ import { UserQuery } from './user-query.js';
 import { UserMutation } from './user-mutation.js';
 import { DomainQuery } from './domain-query.js';
 export declare const entities: (typeof User)[];
-export declare const resolvers: (typeof DomainQuery | typeof UserMutation | typeof UserQuery)[];
+export declare const resolvers: (typeof UserQuery | typeof UserMutation | typeof DomainQuery)[];

package/dist-server/service/verification-token/index.d.ts

@@ -1,2 +1,2 @@
 import { VerificationToken, VerificationTokenType } from './verification-token.js';
-export declare const entities: (typeof VerificationTokenType | typeof VerificationToken)[];
+export declare const entities: (typeof VerificationToken | typeof VerificationTokenType)[];