@things-factory/auth-base 10.1.188 → 10.1.198

package/dist-server/service/audit/audit-subscriber.js

@@ -0,0 +1,191 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditSubscribers = exports.WebAuthCredentialAuditSubscriber = exports.InvitationAuditSubscriber = exports.DomainOwnerAuditSubscriber = exports.UserAuditSubscriber = exports.GrantAuditSubscriber = void 0;
+const tslib_1 = require("tslib");
+const typeorm_1 = require("typeorm");
+const domain_owner_js_1 = require("../domain-owner/domain-owner.js");
+const invitation_js_1 = require("../invitation/invitation.js");
+const privilege_js_1 = require("../privilege/privilege.js");
+const role_js_1 = require("../role/role.js");
+const user_js_1 = require("../user/user.js");
+const web_auth_credential_js_1 = require("../web-auth-credential/web-auth-credential.js");
+const audit_recorder_js_1 = require("./audit-recorder.js");
+/**
+ * ── Who may do what, recorded where it is saved (ADR-0141 §3.3 · §4-1) ───────
+ *
+ * A role is granted in a dozen places - the user screen, an access request, an invitation, a
+ * template, Office's role plan. Each saves through TypeORM, so the change is caught here, once, and
+ * written in the same transaction as the save: the grant and its record stand or fall together.
+ *
+ * A write that bypasses the entity manager's events (a query builder, `delete()`) is not seen here;
+ * those few paths record themselves.
+ */
+const idOf = (one) => (typeof one === 'string' ? one : one?.id);
+/** The id a junction row holds for `target`, read from what the event carries. */
+function junctionIdOf(event, target) {
+    const source = event.entityId ?? event.entity ?? event.databaseEntity;
+    if (!source)
+        return undefined;
+    const column = event.metadata.columns.find(one => one.referencedColumn?.entityMetadata.target === target);
+    if (!column)
+        return undefined;
+    const value = column.getEntityValue(source) ?? source[column.propertyName] ?? source[column.databaseName];
+    return idOf(value);
+}
+/** The domain of a role, read in the same transaction - a role being deleted has none left to read. */
+async function domainOfRole(event, roleId) {
+    const role = await event.manager.getRepository(role_js_1.Role).findOne({ where: { id: roleId }, relations: ['domain'] });
+    return role?.domain?.id;
+}
+/**
+ * ── Grants are junction rows ──────────────────────────────────────────────
+ *
+ * A role given to a user is a `users_roles` row; a privilege given to a role, a `roles_privileges`
+ * row. When only those change, TypeORM updates no entity and sends no update event - it inserts and
+ * removes junction rows, and those it does announce. So grants are read here, from the junction, for
+ * every path that saves a user's roles or a role's privileges, a new user's or role's included.
+ *
+ * This listens to every entity (a junction has no class to name) and leaves at once on anything
+ * that is not one of the two junctions.
+ */
+let GrantAuditSubscriber = class GrantAuditSubscriber {
+    async afterInsert(event) {
+        await this.record(event, 'insert');
+    }
+    async afterRemove(event) {
+        await this.record(event, 'remove');
+    }
+    async record(event, change) {
+        if (!event.metadata.isJunction)
+            return;
+        const roleId = junctionIdOf(event, role_js_1.Role);
+        const userId = junctionIdOf(event, user_js_1.User);
+        const privilegeId = junctionIdOf(event, privilege_js_1.Privilege);
+        if (!roleId)
+            return;
+        const domainId = await domainOfRole(event, roleId);
+        const where = { manager: event.manager, ...(domainId ? { domainId } : {}) };
+        if (userId) {
+            await (0, audit_recorder_js_1.recordAuditAction)({
+                kind: change === 'insert' ? 'role.grant' : 'role.revoke',
+                targetKind: 'User',
+                targetIds: [userId],
+                targetRole: 'handled',
+                objectKind: 'Role',
+                objectId: roleId
+            }, where);
+        }
+        else if (privilegeId) {
+            await (0, audit_recorder_js_1.recordAuditAction)({
+                kind: change === 'insert' ? 'role.privilege.add' : 'role.privilege.remove',
+                targetKind: 'Role',
+                targetIds: [roleId],
+                targetRole: 'handled',
+                objectKind: 'Privilege',
+                objectId: privilegeId
+            }, where);
+        }
+    }
+};
+exports.GrantAuditSubscriber = GrantAuditSubscriber;
+exports.GrantAuditSubscriber = GrantAuditSubscriber = tslib_1.__decorate([
+    (0, typeorm_1.EventSubscriber)()
+], GrantAuditSubscriber);
+let UserAuditSubscriber = class UserAuditSubscriber {
+    listenTo() {
+        return user_js_1.User;
+    }
+    async afterUpdate(event) {
+        const user = event.entity;
+        const before = event.databaseEntity;
+        const userId = user?.id ?? before?.id;
+        if (!user || !before || !userId)
+            return;
+        const target = { targetKind: 'User', targetIds: [userId], targetRole: 'handled' };
+        if (user.status !== undefined && user.status !== before.status) {
+            await (0, audit_recorder_js_1.recordAuditAction)({ kind: 'user.status', ...target, detail: { from: before.status ?? null, to: user.status } }, { manager: event.manager });
+        }
+        if (user.password !== undefined && user.password !== before.password) {
+            /* One's own change, or somebody else setting it - the actor tells which. */
+            const actorId = (0, audit_recorder_js_1.currentAuditScope)()?.context?.state?.user?.id;
+            const kind = actorId && actorId !== userId ? 'password.reset-by-admin' : 'password.change';
+            await (0, audit_recorder_js_1.recordAuditAction)({ kind, ...target }, { manager: event.manager });
+        }
+        if (user.credentialSerial !== undefined && user.credentialSerial !== before.credentialSerial) {
+            await (0, audit_recorder_js_1.recordAuditAction)({ kind: 'credential.issue', ...target }, { manager: event.manager });
+        }
+    }
+};
+exports.UserAuditSubscriber = UserAuditSubscriber;
+exports.UserAuditSubscriber = UserAuditSubscriber = tslib_1.__decorate([
+    (0, typeorm_1.EventSubscriber)()
+], UserAuditSubscriber);
+let DomainOwnerAuditSubscriber = class DomainOwnerAuditSubscriber {
+    listenTo() {
+        return domain_owner_js_1.DomainOwner;
+    }
+    async afterInsert(event) {
+        const owner = event.entity;
+        const userId = idOf(owner?.user);
+        const domainId = idOf(owner?.domain);
+        if (!userId)
+            return;
+        await (0, audit_recorder_js_1.recordAuditAction)({ kind: 'domain.owner.add', targetKind: 'User', targetIds: [userId], targetRole: 'handled' }, { manager: event.manager, ...(domainId ? { domainId } : {}) });
+    }
+};
+exports.DomainOwnerAuditSubscriber = DomainOwnerAuditSubscriber;
+exports.DomainOwnerAuditSubscriber = DomainOwnerAuditSubscriber = tslib_1.__decorate([
+    (0, typeorm_1.EventSubscriber)()
+], DomainOwnerAuditSubscriber);
+let InvitationAuditSubscriber = class InvitationAuditSubscriber {
+    listenTo() {
+        return invitation_js_1.Invitation;
+    }
+    async afterInsert(event) {
+        const invitation = event.entity;
+        if (!invitation?.id)
+            return;
+        const domainId = idOf(invitation.domain);
+        await (0, audit_recorder_js_1.recordAuditAction)({ kind: 'invitation.create', targetKind: 'Invitation', targetIds: [invitation.id], targetRole: 'handled' }, { manager: event.manager, ...(domainId ? { domainId } : {}) });
+    }
+    async afterUpdate(event) {
+        const invitation = event.entity;
+        const before = event.databaseEntity;
+        if (!invitation?.id || !before || invitation.status === undefined || invitation.status === before.status)
+            return;
+        await (0, audit_recorder_js_1.recordAuditAction)({
+            kind: 'invitation.status',
+            targetKind: 'Invitation',
+            targetIds: [invitation.id],
+            targetRole: 'handled',
+            detail: { from: before.status ?? null, to: invitation.status }
+        }, { manager: event.manager });
+    }
+};
+exports.InvitationAuditSubscriber = InvitationAuditSubscriber;
+exports.InvitationAuditSubscriber = InvitationAuditSubscriber = tslib_1.__decorate([
+    (0, typeorm_1.EventSubscriber)()
+], InvitationAuditSubscriber);
+let WebAuthCredentialAuditSubscriber = class WebAuthCredentialAuditSubscriber {
+    listenTo() {
+        return web_auth_credential_js_1.WebAuthCredential;
+    }
+    async afterInsert(event) {
+        const userId = idOf(event.entity?.user);
+        if (!userId)
+            return;
+        await (0, audit_recorder_js_1.recordAuditAction)({ kind: 'webauthn.register', targetKind: 'User', targetIds: [userId], targetRole: 'handled' }, { manager: event.manager, actorId: userId });
+    }
+};
+exports.WebAuthCredentialAuditSubscriber = WebAuthCredentialAuditSubscriber;
+exports.WebAuthCredentialAuditSubscriber = WebAuthCredentialAuditSubscriber = tslib_1.__decorate([
+    (0, typeorm_1.EventSubscriber)()
+], WebAuthCredentialAuditSubscriber);
+exports.auditSubscribers = [
+    GrantAuditSubscriber,
+    UserAuditSubscriber,
+    DomainOwnerAuditSubscriber,
+    InvitationAuditSubscriber,
+    WebAuthCredentialAuditSubscriber
+];
+//# sourceMappingURL=audit-subscriber.js.map

package/dist-server/service/audit/audit-subscriber.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-subscriber.js","sourceRoot":"","sources":["../../../server/service/audit/audit-subscriber.ts"],"names":[],"mappings":";;;;AAAA,qCAA2G;AAE3G,qEAA6D;AAC7D,+DAAwD;AACxD,4DAAqD;AACrD,6CAAsC;AACtC,6CAAsC;AACtC,0FAAiF;AACjF,2DAA0E;AAE1E;;;;;;;;;GASG;AAEH,MAAM,IAAI,GAAG,CAAC,GAAQ,EAAsB,EAAE,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;AAExF,kFAAkF;AAClF,SAAS,YAAY,CAAC,KAA0C,EAAE,MAAgB;IAChF,MAAM,MAAM,GAAI,KAAa,CAAC,QAAQ,IAAI,KAAK,CAAC,MAAM,IAAK,KAA0B,CAAC,cAAc,CAAA;IACpG,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,EAAE,cAAc,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;IACzG,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAA;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACzG,OAAO,IAAI,CAAC,KAAK,CAAC,CAAA;AACpB,CAAC;AAED,uGAAuG;AACvG,KAAK,UAAU,YAAY,CAAC,KAA0C,EAAE,MAAc;IACpF,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,cAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC9G,OAAO,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,KAAK,CAAC,WAAW,CAAC,KAAuB;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACpC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAuB;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACpC,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,KAA0C,EAAE,MAA2B;QAC1F,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU;YAAE,OAAM;QAEtC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,cAAI,CAAC,CAAA;QACxC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,cAAI,CAAC,CAAA;QACxC,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,EAAE,wBAAS,CAAC,CAAA;QAClD,IAAI,CAAC,MAAM;YAAE,OAAM;QAEnB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QAClD,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;QAE3E,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAA,qCAAiB,EACrB;gBACE,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa;gBACxD,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,CAAC,MAAM,CAAC;gBACnB,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,MAAM;gBAClB,QAAQ,EAAE,MAAM;aACjB,EACD,KAAK,CACN,CAAA;QACH,CAAC;aAAM,IAAI,WAAW,EAAE,CAAC;YACvB,MAAM,IAAA,qCAAiB,EACrB;gBACE,IAAI,EAAE,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,uBAAuB;gBAC1E,UAAU,EAAE,MAAM;gBAClB,SAAS,EAAE,CAAC,MAAM,CAAC;gBACnB,UAAU,EAAE,SAAS;gBACrB,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,WAAW;aACtB,EACD,KAAK,CACN,CAAA;QACH,CAAC;IACH,CAAC;CACF,CAAA;AA9CY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,yBAAe,GAAE;GACL,oBAAoB,CA8ChC;AAGM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,QAAQ;QACN,OAAO,cAAI,CAAA;IACb,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAwB;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,MAA0B,CAAA;QAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,cAAkC,CAAA;QACvD,MAAM,MAAM,GAAG,IAAI,EAAE,EAAE,IAAI,MAAM,EAAE,EAAE,CAAA;QACrC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM;YAAE,OAAM;QAEvC,MAAM,MAAM,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAkB,EAAE,CAAA;QAE1F,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC/D,MAAM,IAAA,qCAAiB,EACrB,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAC5F,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAC3B,CAAA;QACH,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrE,4EAA4E;YAC5E,MAAM,OAAO,GAAG,IAAA,qCAAiB,GAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAA;YAC7D,MAAM,IAAI,GAAG,OAAO,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,iBAAiB,CAAA;YAC1F,MAAM,IAAA,qCAAiB,EAAC,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QAC1E,CAAC;QAED,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC7F,MAAM,IAAA,qCAAiB,EAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;QAC9F,CAAC;IACH,CAAC;CACF,CAAA;AA/BY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,yBAAe,GAAE;GACL,mBAAmB,CA+B/B;AAGM,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,QAAQ;QACN,OAAO,6BAAW,CAAA;IACpB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA+B;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAA;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;QACpC,IAAI,CAAC,MAAM;YAAE,OAAM;QAEnB,MAAM,IAAA,qCAAiB,EACrB,EAAE,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,EAC5F,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAC9D,CAAA;IACH,CAAC;CACF,CAAA;AAhBY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,yBAAe,GAAE;GACL,0BAA0B,CAgBtC;AAGM,IAAM,yBAAyB,GAA/B,MAAM,yBAAyB;IACpC,QAAQ;QACN,OAAO,0BAAU,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA8B;QAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAA;QAC/B,IAAI,CAAC,UAAU,EAAE,EAAE;YAAE,OAAM;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAE,UAAkB,CAAC,MAAM,CAAC,CAAA;QAEjD,MAAM,IAAA,qCAAiB,EACrB,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,EAC1G,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAC9D,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA8B;QAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,MAAgC,CAAA;QACzD,MAAM,MAAM,GAAG,KAAK,CAAC,cAAwC,CAAA;QAC7D,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,OAAM;QAEhH,MAAM,IAAA,qCAAiB,EACrB;YACE,IAAI,EAAE,mBAAmB;YACzB,UAAU,EAAE,YAAY;YACxB,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1B,UAAU,EAAE,SAAS;YACrB,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,EAAE;SAC/D,EACD,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAC3B,CAAA;IACH,CAAC;CACF,CAAA;AAhCY,8DAAyB;oCAAzB,yBAAyB;IADrC,IAAA,yBAAe,GAAE;GACL,yBAAyB,CAgCrC;AAGM,IAAM,gCAAgC,GAAtC,MAAM,gCAAgC;IAC3C,QAAQ;QACN,OAAO,0CAAiB,CAAA;IAC1B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAqC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACvC,IAAI,CAAC,MAAM;YAAE,OAAM;QAEnB,MAAM,IAAA,qCAAiB,EACrB,EAAE,IAAI,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,EAC7F,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAC5C,CAAA;IACH,CAAC;CACF,CAAA;AAdY,4EAAgC;2CAAhC,gCAAgC;IAD5C,IAAA,yBAAe,GAAE;GACL,gCAAgC,CAc5C;AAEY,QAAA,gBAAgB,GAAG;IAC9B,oBAAoB;IACpB,mBAAmB;IACnB,0BAA0B;IAC1B,yBAAyB;IACzB,gCAAgC;CACjC,CAAA","sourcesContent":["import { EntitySubscriberInterface, EventSubscriber, InsertEvent, RemoveEvent, UpdateEvent } from 'typeorm'\n\nimport { DomainOwner } from '../domain-owner/domain-owner.js'\nimport { Invitation } from '../invitation/invitation.js'\nimport { Privilege } from '../privilege/privilege.js'\nimport { Role } from '../role/role.js'\nimport { User } from '../user/user.js'\nimport { WebAuthCredential } from '../web-auth-credential/web-auth-credential.js'\nimport { currentAuditScope, recordAuditAction } from './audit-recorder.js'\n\n/**\n * ── Who may do what, recorded where it is saved (ADR-0141 §3.3 · §4-1) ───────\n *\n * A role is granted in a dozen places - the user screen, an access request, an invitation, a\n * template, Office's role plan. Each saves through TypeORM, so the change is caught here, once, and\n * written in the same transaction as the save: the grant and its record stand or fall together.\n *\n * A write that bypasses the entity manager's events (a query builder, `delete()`) is not seen here;\n * those few paths record themselves.\n */\n\nconst idOf = (one: any): string | undefined => (typeof one === 'string' ? one : one?.id)\n\n/** The id a junction row holds for `target`, read from what the event carries. */\nfunction junctionIdOf(event: InsertEvent<any> | RemoveEvent<any>, target: Function): string | undefined {\n  const source = (event as any).entityId ?? event.entity ?? (event as RemoveEvent<any>).databaseEntity\n  if (!source) return undefined\n  const column = event.metadata.columns.find(one => one.referencedColumn?.entityMetadata.target === target)\n  if (!column) return undefined\n  const value = column.getEntityValue(source) ?? source[column.propertyName] ?? source[column.databaseName]\n  return idOf(value)\n}\n\n/** The domain of a role, read in the same transaction - a role being deleted has none left to read. */\nasync function domainOfRole(event: InsertEvent<any> | RemoveEvent<any>, roleId: string) {\n  const role = await event.manager.getRepository(Role).findOne({ where: { id: roleId }, relations: ['domain'] })\n  return role?.domain?.id\n}\n\n/**\n * ── Grants are junction rows ──────────────────────────────────────────────\n *\n * A role given to a user is a `users_roles` row; a privilege given to a role, a `roles_privileges`\n * row. When only those change, TypeORM updates no entity and sends no update event - it inserts and\n * removes junction rows, and those it does announce. So grants are read here, from the junction, for\n * every path that saves a user's roles or a role's privileges, a new user's or role's included.\n *\n * This listens to every entity (a junction has no class to name) and leaves at once on anything\n * that is not one of the two junctions.\n */\n@EventSubscriber()\nexport class GrantAuditSubscriber implements EntitySubscriberInterface<any> {\n  async afterInsert(event: InsertEvent<any>) {\n    await this.record(event, 'insert')\n  }\n\n  async afterRemove(event: RemoveEvent<any>) {\n    await this.record(event, 'remove')\n  }\n\n  private async record(event: InsertEvent<any> | RemoveEvent<any>, change: 'insert' | 'remove') {\n    if (!event.metadata.isJunction) return\n\n    const roleId = junctionIdOf(event, Role)\n    const userId = junctionIdOf(event, User)\n    const privilegeId = junctionIdOf(event, Privilege)\n    if (!roleId) return\n\n    const domainId = await domainOfRole(event, roleId)\n    const where = { manager: event.manager, ...(domainId ? { domainId } : {}) }\n\n    if (userId) {\n      await recordAuditAction(\n        {\n          kind: change === 'insert' ? 'role.grant' : 'role.revoke',\n          targetKind: 'User',\n          targetIds: [userId],\n          targetRole: 'handled',\n          objectKind: 'Role',\n          objectId: roleId\n        },\n        where\n      )\n    } else if (privilegeId) {\n      await recordAuditAction(\n        {\n          kind: change === 'insert' ? 'role.privilege.add' : 'role.privilege.remove',\n          targetKind: 'Role',\n          targetIds: [roleId],\n          targetRole: 'handled',\n          objectKind: 'Privilege',\n          objectId: privilegeId\n        },\n        where\n      )\n    }\n  }\n}\n\n@EventSubscriber()\nexport class UserAuditSubscriber implements EntitySubscriberInterface<User> {\n  listenTo() {\n    return User\n  }\n\n  async afterUpdate(event: UpdateEvent<User>) {\n    const user = event.entity as User | undefined\n    const before = event.databaseEntity as User | undefined\n    const userId = user?.id ?? before?.id\n    if (!user || !before || !userId) return\n\n    const target = { targetKind: 'User', targetIds: [userId], targetRole: 'handled' as const }\n\n    if (user.status !== undefined && user.status !== before.status) {\n      await recordAuditAction(\n        { kind: 'user.status', ...target, detail: { from: before.status ?? null, to: user.status } },\n        { manager: event.manager }\n      )\n    }\n\n    if (user.password !== undefined && user.password !== before.password) {\n      /* One's own change, or somebody else setting it - the actor tells which. */\n      const actorId = currentAuditScope()?.context?.state?.user?.id\n      const kind = actorId && actorId !== userId ? 'password.reset-by-admin' : 'password.change'\n      await recordAuditAction({ kind, ...target }, { manager: event.manager })\n    }\n\n    if (user.credentialSerial !== undefined && user.credentialSerial !== before.credentialSerial) {\n      await recordAuditAction({ kind: 'credential.issue', ...target }, { manager: event.manager })\n    }\n  }\n}\n\n@EventSubscriber()\nexport class DomainOwnerAuditSubscriber implements EntitySubscriberInterface<DomainOwner> {\n  listenTo() {\n    return DomainOwner\n  }\n\n  async afterInsert(event: InsertEvent<DomainOwner>) {\n    const owner = event.entity\n    const userId = idOf(owner?.user)\n    const domainId = idOf(owner?.domain)\n    if (!userId) return\n\n    await recordAuditAction(\n      { kind: 'domain.owner.add', targetKind: 'User', targetIds: [userId], targetRole: 'handled' },\n      { manager: event.manager, ...(domainId ? { domainId } : {}) }\n    )\n  }\n}\n\n@EventSubscriber()\nexport class InvitationAuditSubscriber implements EntitySubscriberInterface<Invitation> {\n  listenTo() {\n    return Invitation\n  }\n\n  async afterInsert(event: InsertEvent<Invitation>) {\n    const invitation = event.entity\n    if (!invitation?.id) return\n    const domainId = idOf((invitation as any).domain)\n\n    await recordAuditAction(\n      { kind: 'invitation.create', targetKind: 'Invitation', targetIds: [invitation.id], targetRole: 'handled' },\n      { manager: event.manager, ...(domainId ? { domainId } : {}) }\n    )\n  }\n\n  async afterUpdate(event: UpdateEvent<Invitation>) {\n    const invitation = event.entity as Invitation | undefined\n    const before = event.databaseEntity as Invitation | undefined\n    if (!invitation?.id || !before || invitation.status === undefined || invitation.status === before.status) return\n\n    await recordAuditAction(\n      {\n        kind: 'invitation.status',\n        targetKind: 'Invitation',\n        targetIds: [invitation.id],\n        targetRole: 'handled',\n        detail: { from: before.status ?? null, to: invitation.status }\n      },\n      { manager: event.manager }\n    )\n  }\n}\n\n@EventSubscriber()\nexport class WebAuthCredentialAuditSubscriber implements EntitySubscriberInterface<WebAuthCredential> {\n  listenTo() {\n    return WebAuthCredential\n  }\n\n  async afterInsert(event: InsertEvent<WebAuthCredential>) {\n    const userId = idOf(event.entity?.user)\n    if (!userId) return\n\n    await recordAuditAction(\n      { kind: 'webauthn.register', targetKind: 'User', targetIds: [userId], targetRole: 'handled' },\n      { manager: event.manager, actorId: userId }\n    )\n  }\n}\n\nexport const auditSubscribers = [\n  GrantAuditSubscriber,\n  UserAuditSubscriber,\n  DomainOwnerAuditSubscriber,\n  InvitationAuditSubscriber,\n  WebAuthCredentialAuditSubscriber\n]\n"]}

package/dist-server/service/audit/audit-target.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `@auditTarget(kind: "User", arg: "id")` - which argument of a door names what it acts on
+ * (ADR-0141 §3.3). The server declares it beside the field; the audit does not guess from argument
+ * names. What it reads is the **requested** target: what the caller named. What a service actually
+ * handled - an id created, a set changed in bulk - the service records itself.
+ *
+ * Read by the `@privilege` wrapper, so it only means something on a field that carries `@privilege`.
+ */
+export declare const auditTargetDirectiveTypeDefs: import("graphql").DocumentNode;
+/** Ids named by `args[arg]`: a string, a list of strings, an object with `id`, or a list of those. */
+export declare function targetIdsOf(args: Record<string, any> | undefined, arg: string): string[];
+/** How many items a list answer holds: an array, or `{ items }`. Not a list - nothing to count. */
+export declare function returnedCountOf(result: any): number | undefined;
+/**
+ * A fixed code for an error - never its message (ADR-0141 §3.4). Codes are the names a program gave
+ * in a code field (`FORBIDDEN`, `password-not-matched`, `user not found`, `SQLITE_CONSTRAINT`); the
+ * message is never read, and a code field that does not look like a name is `error`.
+ */
+export declare function errorCodeOf(error: any): string;

package/dist-server/service/audit/audit-target.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditTargetDirectiveTypeDefs = void 0;
+exports.targetIdsOf = targetIdsOf;
+exports.returnedCountOf = returnedCountOf;
+exports.errorCodeOf = errorCodeOf;
+const tslib_1 = require("tslib");
+const graphql_tag_1 = tslib_1.__importDefault(require("graphql-tag"));
+/**
+ * `@auditTarget(kind: "User", arg: "id")` - which argument of a door names what it acts on
+ * (ADR-0141 §3.3). The server declares it beside the field; the audit does not guess from argument
+ * names. What it reads is the **requested** target: what the caller named. What a service actually
+ * handled - an id created, a set changed in bulk - the service records itself.
+ *
+ * Read by the `@privilege` wrapper, so it only means something on a field that carries `@privilege`.
+ */
+exports.auditTargetDirectiveTypeDefs = (0, graphql_tag_1.default) `
+  directive @auditTarget(kind: String!, arg: String!) on FIELD_DEFINITION
+`;
+/** Ids named by `args[arg]`: a string, a list of strings, an object with `id`, or a list of those. */
+function targetIdsOf(args, arg) {
+    const value = args?.[arg];
+    const values = Array.isArray(value) ? value : value === undefined || value === null ? [] : [value];
+    return values
+        .map(one => (typeof one === 'string' || typeof one === 'number' ? String(one) : one?.id ? String(one.id) : null))
+        .filter((id) => !!id);
+}
+/** How many items a list answer holds: an array, or `{ items }`. Not a list - nothing to count. */
+function returnedCountOf(result) {
+    if (Array.isArray(result))
+        return result.length;
+    if (result && Array.isArray(result.items))
+        return result.items.length;
+    return undefined;
+}
+/**
+ * A fixed code for an error - never its message (ADR-0141 §3.4). Codes are the names a program gave
+ * in a code field (`FORBIDDEN`, `password-not-matched`, `user not found`, `SQLITE_CONSTRAINT`); the
+ * message is never read, and a code field that does not look like a name is `error`.
+ */
+function errorCodeOf(error) {
+    const candidates = [error?.errorCode, error?.extensions?.code, error?.code];
+    const code = candidates.find(one => typeof one === 'string' && /^[A-Za-z][A-Za-z0-9 _.-]{0,63}$/.test(one));
+    return code ?? 'error';
+}
+//# sourceMappingURL=audit-target.js.map

package/dist-server/service/audit/audit-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-target.js","sourceRoot":"","sources":["../../../server/service/audit/audit-target.ts"],"names":[],"mappings":";;;AAeA,kCAOC;AAGD,0CAIC;AAOD,kCAIC;;AAxCD,sEAA6B;AAE7B;;;;;;;GAOG;AACU,QAAA,4BAA4B,GAAG,IAAA,qBAAG,EAAA;;CAE9C,CAAA;AAED,sGAAsG;AACtG,SAAgB,WAAW,CAAC,IAAqC,EAAE,GAAW;IAC5E,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,CAAA;IACzB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAElG,OAAO,MAAM;SACV,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;SAChH,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AACvC,CAAC;AAED,mGAAmG;AACnG,SAAgB,eAAe,CAAC,MAAW;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAA;IAC/C,IAAI,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAA;IACrE,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAgB,WAAW,CAAC,KAAU;IACpC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;IAC3E,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,iCAAiC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IAC3G,OAAO,IAAI,IAAI,OAAO,CAAA;AACxB,CAAC","sourcesContent":["import gql from 'graphql-tag'\n\n/**\n * `@auditTarget(kind: \"User\", arg: \"id\")` - which argument of a door names what it acts on\n * (ADR-0141 §3.3). The server declares it beside the field; the audit does not guess from argument\n * names. What it reads is the **requested** target: what the caller named. What a service actually\n * handled - an id created, a set changed in bulk - the service records itself.\n *\n * Read by the `@privilege` wrapper, so it only means something on a field that carries `@privilege`.\n */\nexport const auditTargetDirectiveTypeDefs = gql`\n  directive @auditTarget(kind: String!, arg: String!) on FIELD_DEFINITION\n`\n\n/** Ids named by `args[arg]`: a string, a list of strings, an object with `id`, or a list of those. */\nexport function targetIdsOf(args: Record<string, any> | undefined, arg: string): string[] {\n  const value = args?.[arg]\n  const values = Array.isArray(value) ? value : value === undefined || value === null ? [] : [value]\n\n  return values\n    .map(one => (typeof one === 'string' || typeof one === 'number' ? String(one) : one?.id ? String(one.id) : null))\n    .filter((id): id is string => !!id)\n}\n\n/** How many items a list answer holds: an array, or `{ items }`. Not a list - nothing to count. */\nexport function returnedCountOf(result: any): number | undefined {\n  if (Array.isArray(result)) return result.length\n  if (result && Array.isArray(result.items)) return result.items.length\n  return undefined\n}\n\n/**\n * A fixed code for an error - never its message (ADR-0141 §3.4). Codes are the names a program gave\n * in a code field (`FORBIDDEN`, `password-not-matched`, `user not found`, `SQLITE_CONSTRAINT`); the\n * message is never read, and a code field that does not look like a name is `error`.\n */\nexport function errorCodeOf(error: any): string {\n  const candidates = [error?.errorCode, error?.extensions?.code, error?.code]\n  const code = candidates.find(one => typeof one === 'string' && /^[A-Za-z][A-Za-z0-9 _.-]{0,63}$/.test(one))\n  return code ?? 'error'\n}\n"]}

package/dist-server/service/audit/audit-types.d.ts

@@ -0,0 +1,44 @@
+import { User } from '../user/user.js';
+import { AuditAction } from './audit-action.js';
+import { AuditRequest } from './audit-request.js';
+export declare class AuditRecordFilter {
+    from: Date;
+    to: Date;
+    actorId?: string;
+    door?: string;
+    kind?: string;
+    outcome?: string;
+    page?: number;
+    limit?: number;
+}
+export declare class AuditRecord {
+    request: AuditRequest;
+    actions: AuditAction[];
+}
+export declare class AuditRecordList {
+    items: AuditRecord[];
+    total: number;
+}
+export declare class AuditPerson {
+    user: User;
+    roles: string[];
+    lastCheckinAt?: Date;
+    checkins: number;
+    failedSignins: number;
+    granted: number;
+    denied: number;
+}
+export declare class AuditDoor {
+    door: string;
+    category?: string;
+    privilege?: string;
+    people: number;
+    granted: number;
+    denied: number;
+}
+export declare class AuditHealth {
+    since: Date;
+    failures: number;
+    firstFailedAt?: Date;
+    lastFailedAt?: Date;
+}

package/dist-server/service/audit/audit-types.js

@@ -0,0 +1,161 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditHealth = exports.AuditDoor = exports.AuditPerson = exports.AuditRecordList = exports.AuditRecord = exports.AuditRecordFilter = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+const user_js_1 = require("../user/user.js");
+const audit_action_js_1 = require("./audit-action.js");
+const audit_request_js_1 = require("./audit-request.js");
+let AuditRecordFilter = class AuditRecordFilter {
+};
+exports.AuditRecordFilter = AuditRecordFilter;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'From this moment.' }),
+    tslib_1.__metadata("design:type", Date)
+], AuditRecordFilter.prototype, "from", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'Up to this moment.' }),
+    tslib_1.__metadata("design:type", Date)
+], AuditRecordFilter.prototype, "to", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'Only requests by this user.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditRecordFilter.prototype, "actorId", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'Only requests that passed through this door (category:privilege).' }),
+    tslib_1.__metadata("design:type", String)
+], AuditRecordFilter.prototype, "door", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'Only requests with an action of this kind.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditRecordFilter.prototype, "kind", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'denied, error or failed - only requests where that happened.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditRecordFilter.prototype, "outcome", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { nullable: true, description: 'Page, from 1.' }),
+    tslib_1.__metadata("design:type", Number)
+], AuditRecordFilter.prototype, "page", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { nullable: true, description: 'Rows per page, up to 200.' }),
+    tslib_1.__metadata("design:type", Number)
+], AuditRecordFilter.prototype, "limit", void 0);
+exports.AuditRecordFilter = AuditRecordFilter = tslib_1.__decorate([
+    (0, type_graphql_1.InputType)({ description: 'What to narrow the audit records to.' })
+], AuditRecordFilter);
+let AuditRecord = class AuditRecord {
+};
+exports.AuditRecord = AuditRecord;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => audit_request_js_1.AuditRequest, { description: 'The request.' }),
+    tslib_1.__metadata("design:type", audit_request_js_1.AuditRequest)
+], AuditRecord.prototype, "request", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => [audit_action_js_1.AuditAction], { description: 'Its actions in this domain.' }),
+    tslib_1.__metadata("design:type", Array)
+], AuditRecord.prototype, "actions", void 0);
+exports.AuditRecord = AuditRecord = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'A request with what was done in it.' })
+], AuditRecord);
+let AuditRecordList = class AuditRecordList {
+};
+exports.AuditRecordList = AuditRecordList;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => [AuditRecord], { description: 'The records on this page.' }),
+    tslib_1.__metadata("design:type", Array)
+], AuditRecordList.prototype, "items", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'How many requests match.' }),
+    tslib_1.__metadata("design:type", Number)
+], AuditRecordList.prototype, "total", void 0);
+exports.AuditRecordList = AuditRecordList = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'A page of audit records.' })
+], AuditRecordList);
+let AuditPerson = class AuditPerson {
+};
+exports.AuditPerson = AuditPerson;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => user_js_1.User, { description: 'The member.' }),
+    tslib_1.__metadata("design:type", user_js_1.User)
+], AuditPerson.prototype, "user", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => [String], { description: 'Names of the roles held in this domain.' }),
+    tslib_1.__metadata("design:type", Array)
+], AuditPerson.prototype, "roles", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The last check-in to this domain, at any time.' }),
+    tslib_1.__metadata("design:type", Date)
+], AuditPerson.prototype, "lastCheckinAt", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'Check-ins in the period.' }),
+    tslib_1.__metadata("design:type", Number)
+], AuditPerson.prototype, "checkins", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'Failed sign-ins in the period.' }),
+    tslib_1.__metadata("design:type", Number)
+], AuditPerson.prototype, "failedSignins", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'Door checks passed in the period, audit reads left out.' }),
+    tslib_1.__metadata("design:type", Number)
+], AuditPerson.prototype, "granted", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'Door checks refused in the period.' }),
+    tslib_1.__metadata("design:type", Number)
+], AuditPerson.prototype, "denied", void 0);
+exports.AuditPerson = AuditPerson = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: "One member's audit summary over a period." })
+], AuditPerson);
+let AuditDoor = class AuditDoor {
+};
+exports.AuditDoor = AuditDoor;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'The door, as category:privilege - or owner / super.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditDoor.prototype, "door", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The category, when the door names a privilege.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditDoor.prototype, "category", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The privilege, when the door names one.' }),
+    tslib_1.__metadata("design:type", String)
+], AuditDoor.prototype, "privilege", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'People who passed or were refused here in the period.' }),
+    tslib_1.__metadata("design:type", Number)
+], AuditDoor.prototype, "people", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'Checks passed in the period.' }),
+    tslib_1.__metadata("design:type", Number)
+], AuditDoor.prototype, "granted", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'Checks refused in the period.' }),
+    tslib_1.__metadata("design:type", Number)
+], AuditDoor.prototype, "denied", void 0);
+exports.AuditDoor = AuditDoor = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: "One door's audit summary over a period." })
+], AuditDoor);
+let AuditHealth = class AuditHealth {
+};
+exports.AuditHealth = AuditHealth;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'When this process started counting.' }),
+    tslib_1.__metadata("design:type", Date)
+], AuditHealth.prototype, "since", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'Writes that failed since then. Writes never attempted are not counted.' }),
+    tslib_1.__metadata("design:type", Number)
+], AuditHealth.prototype, "failures", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The first failure.' }),
+    tslib_1.__metadata("design:type", Date)
+], AuditHealth.prototype, "firstFailedAt", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The last failure.' }),
+    tslib_1.__metadata("design:type", Date)
+], AuditHealth.prototype, "lastFailedAt", void 0);
+exports.AuditHealth = AuditHealth = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'Audit writes this server process failed, counted apart from the audit store.' })
+], AuditHealth);
+//# sourceMappingURL=audit-types.js.map

package/dist-server/service/audit/audit-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-types.js","sourceRoot":"","sources":["../../../server/service/audit/audit-types.ts"],"names":[],"mappings":";;;;AAAA,+CAAgE;AAEhE,6CAAsC;AACtC,uDAA+C;AAC/C,yDAAiD;AAG1C,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAwB7B,CAAA;AAxBY,8CAAiB;AAE5B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;sCACtC,IAAI;+CAAA;AAGV;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;sCACzC,IAAI;6CAAA;AAGR;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;;kDACtD;AAGhB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,mEAAmE,EAAE,CAAC;;+CAC/F;AAGb;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;;+CACxE;AAGb;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC;;kDACvF;AAGhB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;;+CACxD;AAGb;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;;gDACnE;4BAvBH,iBAAiB;IAD7B,IAAA,wBAAS,EAAC,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;GACtD,iBAAiB,CAwB7B;AAGM,IAAM,WAAW,GAAjB,MAAM,WAAW;CAMvB,CAAA;AANY,kCAAW;AAEtB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,+BAAY,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;sCACpD,+BAAY;4CAAA;AAGrB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,6BAAW,CAAC,EAAE,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;;4CACvD;sBALX,WAAW;IADvB,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;GACtD,WAAW,CAMvB;AAGM,IAAM,eAAe,GAArB,MAAM,eAAe;CAM3B,CAAA;AANY,0CAAe;AAE1B;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;;8CACvD;AAGpB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;;8CACnD;0BALF,eAAe;IAD3B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;GAC3C,eAAe,CAM3B;AAGM,IAAM,WAAW,GAAjB,MAAM,WAAW;CAqBvB,CAAA;AArBY,kCAAW;AAEtB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;sCAC9C,cAAI;yCAAA;AAGV;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;0CACrE;AAGf;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;sCACzE,IAAI;kDAAA;AAGpB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;;6CAChD;AAGhB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;;kDACjD;AAGrB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;;4CAChF;AAGf;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;;2CAC5D;sBApBH,WAAW;IADvB,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;GAC5D,WAAW,CAqBvB;AAGM,IAAM,SAAS,GAAf,MAAM,SAAS;CAkBrB,CAAA;AAlBY,8BAAS;AAEpB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;;uCAClE;AAGZ;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;;2CACxE;AAGjB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;;4CAChE;AAGlB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,uDAAuD,EAAE,CAAC;;yCAC/E;AAGd;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;;0CACrD;AAGf;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;;yCACvD;oBAjBH,SAAS;IADrB,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;GAC1D,SAAS,CAkBrB;AAGM,IAAM,WAAW,GAAjB,MAAM,WAAW;CAYvB,CAAA;AAZY,kCAAW;AAEtB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;sCACvD,IAAI;0CAAA;AAGX;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,wEAAwE,EAAE,CAAC;;6CAC9F;AAGhB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;sCAC7C,IAAI;kDAAA;AAGpB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;sCAC7C,IAAI;iDAAA;sBAXR,WAAW;IADvB,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,8EAA8E,EAAE,CAAC;GAC/F,WAAW,CAYvB","sourcesContent":["import { Field, InputType, Int, ObjectType } from 'type-graphql'\n\nimport { User } from '../user/user.js'\nimport { AuditAction } from './audit-action.js'\nimport { AuditRequest } from './audit-request.js'\n\n@InputType({ description: 'What to narrow the audit records to.' })\nexport class AuditRecordFilter {\n  @Field({ description: 'From this moment.' })\n  from: Date\n\n  @Field({ description: 'Up to this moment.' })\n  to: Date\n\n  @Field({ nullable: true, description: 'Only requests by this user.' })\n  actorId?: string\n\n  @Field({ nullable: true, description: 'Only requests that passed through this door (category:privilege).' })\n  door?: string\n\n  @Field({ nullable: true, description: 'Only requests with an action of this kind.' })\n  kind?: string\n\n  @Field({ nullable: true, description: 'denied, error or failed - only requests where that happened.' })\n  outcome?: string\n\n  @Field(type => Int, { nullable: true, description: 'Page, from 1.' })\n  page?: number\n\n  @Field(type => Int, { nullable: true, description: 'Rows per page, up to 200.' })\n  limit?: number\n}\n\n@ObjectType({ description: 'A request with what was done in it.' })\nexport class AuditRecord {\n  @Field(type => AuditRequest, { description: 'The request.' })\n  request: AuditRequest\n\n  @Field(type => [AuditAction], { description: 'Its actions in this domain.' })\n  actions: AuditAction[]\n}\n\n@ObjectType({ description: 'A page of audit records.' })\nexport class AuditRecordList {\n  @Field(type => [AuditRecord], { description: 'The records on this page.' })\n  items: AuditRecord[]\n\n  @Field(type => Int, { description: 'How many requests match.' })\n  total: number\n}\n\n@ObjectType({ description: \"One member's audit summary over a period.\" })\nexport class AuditPerson {\n  @Field(type => User, { description: 'The member.' })\n  user: User\n\n  @Field(type => [String], { description: 'Names of the roles held in this domain.' })\n  roles: string[]\n\n  @Field({ nullable: true, description: 'The last check-in to this domain, at any time.' })\n  lastCheckinAt?: Date\n\n  @Field(type => Int, { description: 'Check-ins in the period.' })\n  checkins: number\n\n  @Field(type => Int, { description: 'Failed sign-ins in the period.' })\n  failedSignins: number\n\n  @Field(type => Int, { description: 'Door checks passed in the period, audit reads left out.' })\n  granted: number\n\n  @Field(type => Int, { description: 'Door checks refused in the period.' })\n  denied: number\n}\n\n@ObjectType({ description: \"One door's audit summary over a period.\" })\nexport class AuditDoor {\n  @Field({ description: 'The door, as category:privilege - or owner / super.' })\n  door: string\n\n  @Field({ nullable: true, description: 'The category, when the door names a privilege.' })\n  category?: string\n\n  @Field({ nullable: true, description: 'The privilege, when the door names one.' })\n  privilege?: string\n\n  @Field(type => Int, { description: 'People who passed or were refused here in the period.' })\n  people: number\n\n  @Field(type => Int, { description: 'Checks passed in the period.' })\n  granted: number\n\n  @Field(type => Int, { description: 'Checks refused in the period.' })\n  denied: number\n}\n\n@ObjectType({ description: 'Audit writes this server process failed, counted apart from the audit store.' })\nexport class AuditHealth {\n  @Field({ description: 'When this process started counting.' })\n  since: Date\n\n  @Field(type => Int, { description: 'Writes that failed since then. Writes never attempted are not counted.' })\n  failures: number\n\n  @Field({ nullable: true, description: 'The first failure.' })\n  firstFailedAt?: Date\n\n  @Field({ nullable: true, description: 'The last failure.' })\n  lastFailedAt?: Date\n}\n"]}

package/dist-server/service/audit/index.d.ts

@@ -0,0 +1,6 @@
+import { AuditAction } from './audit-action.js';
+import { AuditQuery } from './audit-query.js';
+import { AuditRequest } from './audit-request.js';
+export declare const entities: (typeof AuditRequest | typeof AuditAction)[];
+export declare const resolvers: (typeof AuditQuery)[];
+export declare const subscribers: (typeof import("./audit-subscriber.js").GrantAuditSubscriber | typeof import("./audit-subscriber.js").UserAuditSubscriber | typeof import("./audit-subscriber.js").DomainOwnerAuditSubscriber | typeof import("./audit-subscriber.js").InvitationAuditSubscriber | typeof import("./audit-subscriber.js").WebAuthCredentialAuditSubscriber)[];

package/dist-server/service/audit/index.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.subscribers = exports.resolvers = exports.entities = void 0;
+const audit_action_js_1 = require("./audit-action.js");
+const audit_query_js_1 = require("./audit-query.js");
+const audit_request_js_1 = require("./audit-request.js");
+const audit_subscriber_js_1 = require("./audit-subscriber.js");
+exports.entities = [audit_request_js_1.AuditRequest, audit_action_js_1.AuditAction];
+exports.resolvers = [audit_query_js_1.AuditQuery];
+exports.subscribers = audit_subscriber_js_1.auditSubscribers;
+//# sourceMappingURL=index.js.map

package/dist-server/service/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/service/audit/index.ts"],"names":[],"mappings":";;;AAAA,uDAA+C;AAC/C,qDAA6C;AAC7C,yDAAiD;AACjD,+DAAwD;AAE3C,QAAA,QAAQ,GAAG,CAAC,+BAAY,EAAE,6BAAW,CAAC,CAAA;AACtC,QAAA,SAAS,GAAG,CAAC,2BAAU,CAAC,CAAA;AACxB,QAAA,WAAW,GAAG,sCAAgB,CAAA","sourcesContent":["import { AuditAction } from './audit-action.js'\nimport { AuditQuery } from './audit-query.js'\nimport { AuditRequest } from './audit-request.js'\nimport { auditSubscribers } from './audit-subscriber.js'\n\nexport const entities = [AuditRequest, AuditAction]\nexport const resolvers = [AuditQuery]\nexport const subscribers = auditSubscribers\n"]}

package/dist-server/service/domain-owner/domain-owner-mutation.js

@@ -6,6 +6,7 @@ const type_graphql_1 = require("type-graphql");
 const shell_1 = require("@things-factory/shell");
 const domain_owner_js_1 = require("./domain-owner.js");
 const user_js_1 = require("../user/user.js");
+const audit_recorder_js_1 = require("../audit/audit-recorder.js");
 let DomainOwnerMutation = class DomainOwnerMutation {
     /**
      * 현재 도메인에 새 owner를 추가한다. 기존 도메인 오너 또는 수퍼유저만 호출 가능.
@@ -111,6 +112,8 @@ let DomainOwnerMutation = class DomainOwnerMutation {
             if (entry) {
                 await ownerRepo.delete(entry.id);
             }
+            /* `delete()` passes no subscriber - the removal records itself, in the same transaction (ADR-0141 §4-1). */
+            await (0, audit_recorder_js_1.recordAuditAction)({ kind: 'domain.owner.remove', targetKind: 'User', targetIds: [targetUser.id], targetRole: 'handled' }, { manager: tx, domainId: domain.id });
             if (hasLegacyOwner) {
                 // 캐시 재설정: 남은 DomainOwner 중 가장 먼저 추가된 사람
                 const next = await ownerRepo

package/dist-server/service/domain-owner/domain-owner-mutation.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain-owner-mutation.js","sourceRoot":"","sources":["../../../server/service/domain-owner/domain-owner-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAsE;AACtE,iDAA6D;AAE7D,uDAA+C;AAC/C,6CAAsC;AAG/B,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B;;;;OAIG;IAGG,AAAN,KAAK,CAAC,cAAc,CACD,QAAgB,EAC1B,OAAY,EACgB,MAAe;QAElD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE7C,OAAQ,IAAA,qBAAa,EAAC,cAAM,CAAS,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAO,EAAE,EAAE;YAC1E,MAAM,QAAQ,GAAG,EAAE,CAAC,aAAa,CAAC,cAAI,CAAC,CAAA;YACvC,MAAM,SAAS,GAAG,EAAE,CAAC,aAAa,CAAC,6BAAW,CAAC,CAAA;YAC/C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,cAAM,CAAC,CAAA;YAE3C,iDAAiD;YACjD,+DAA+D;YAC/D,0CAA0C;YAC1C,MAAM,UAAU,GAAG,MAAM,QAAQ;iBAC9B,kBAAkB,CAAC,GAAG,CAAC;iBACvB,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC;iBAC3B,KAAK,CAAC,4DAA4D,EAAE;gBACnE,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM,CAAC,EAAE;aACpB,CAAC;iBACD,MAAM,EAAE,CAAA;YACX,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,mCAAmC,CAAC,CAAA;YACvE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC;gBACvC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE;aAClE,CAAC,CAAA;YACF,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,uCAAuC,CAAC,CAAA;YAC3E,CAAC;YAED,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC;gBAC7B,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAY;gBACnC,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAU;gBACnC,SAAS,EAAE,KAAK;gBAChB,MAAM;aACP,CAAC,CAAA;YACF,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAEzC,oCAAoC;YACpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;YAC9D,CAAC;YAED,oCAAoC;YACpC,oEAAoE;YACpE,iDAAiD;YACjD,OAAO,SAAS,CAAC,aAAa,CAAC;gBAC7B,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;gBACvB,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;aAC3C,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IAGG,AAAN,KAAK,CAAC,iBAAiB,CACJ,QAAgB,EAC1B,OAAY,EACgB,OAAgB;QAEnD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,OAAQ,IAAA,qBAAa,EAAC,cAAM,CAAS,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAO,EAAE,EAAE;YAC1E,MAAM,QAAQ,GAAG,EAAE,CAAC,aAAa,CAAC,cAAI,CAAC,CAAA;YACvC,MAAM,SAAS,GAAG,EAAE,CAAC,aAAa,CAAC,6BAAW,CAAC,CAAA;YAC/C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,cAAM,CAAC,CAAA;YAE3C,kDAAkD;YAClD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;gBACxC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;aAC3C,CAAC,CAAA;YACF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,cAAc,CAAC,CAAA;YAClD,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC;gBACpC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE;aAClE,CAAC,CAAA;YACF,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC,EAAE,CAAA;YAErD,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,mCAAmC,CAAC,CAAA;YACvE,CAAC;YAED,2DAA2D;YAC3D,MAAM,UAAU,GAAG,MAAM,SAAS;iBAC/B,kBAAkB,CAAC,IAAI,CAAC;iBACxB,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;iBAC5C,QAAQ,EAAE,CAAA;YAEb,iBAAiB;YACjB,kDAAkD;YAClD,+CAA+C;YAC/C,IAAI,SAAS,GAAG,UAAU,CAAA;YAC1B,IAAI,KAAK;gBAAE,SAAS,IAAI,CAAC,CAAA;YACzB,4DAA4D;YAC5D,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnD,yCAAyC;gBACzC,MAAM,aAAa,GAAG,MAAM,SAAS;qBAClC,kBAAkB,CAAC,IAAI,CAAC;qBACxB,KAAK,CAAC,uCAAuC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;qBACjF,SAAS,EAAE,CAAA;gBACd,IAAI,CAAC,aAAa;oBAAE,SAAS,IAAI,CAAC,CAAA;YACpC,CAAC;YAED,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAA;YACH,CAAC;YAED,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAClC,CAAC;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,wCAAwC;gBACxC,MAAM,IAAI,GAAG,MAAM,SAAS;qBACzB,kBAAkB,CAAC,IAAI,CAAC;qBACxB,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;qBAC5C,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC;qBAC9B,MAAM,EAAE,CAAA;gBACX,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAAA;YACrE,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC;CACF,CAAA;AAlJY,kDAAmB;AAQxB;IAFL,IAAA,wBAAS,EAAC,8DAA8D,CAAC;IACzE,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,6BAAW,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;IAE7F,mBAAA,IAAA,kBAAG,EAAC,UAAU,CAAC,CAAA;IACf,mBAAA,IAAA,kBAAG,GAAE,CAAA;IACL,mBAAA,IAAA,kBAAG,EAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;;;;yDAoDnC;AAUK;IAFL,IAAA,wBAAS,EAAC,8DAA8D,CAAC;IACzE,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC;IAEnG,mBAAA,IAAA,kBAAG,EAAC,UAAU,CAAC,CAAA;IACf,mBAAA,IAAA,kBAAG,GAAE,CAAA;IACL,mBAAA,IAAA,kBAAG,EAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;;;;4DAqEnC;8BAjJU,mBAAmB;IAD/B,IAAA,uBAAQ,EAAC,EAAE,CAAC,EAAE,CAAC,6BAAW,CAAC;GACf,mBAAmB,CAkJ/B","sourcesContent":["import { Resolver, Mutation, Arg, Ctx, Directive } from 'type-graphql'\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { DomainOwner } from './domain-owner.js'\nimport { User } from '../user/user.js'\n\n@Resolver(of => DomainOwner)\nexport class DomainOwnerMutation {\n  /**\n   * 현재 도메인에 새 owner를 추가한다. 기존 도메인 오너 또는 수퍼유저만 호출 가능.\n   *\n   * 하위 호환: `Domain.owner` 캐시 필드가 비어 있으면 추가된 user를 세팅한다.\n   */\n  @Directive('@privilege(domainOwnerGranted: true, superUserGranted: true)')\n  @Mutation(returns => DomainOwner, { description: 'Add a user as owner of the current domain.' })\n  async addDomainOwner(\n    @Arg('username') username: string,\n    @Ctx() context: any,\n    @Arg('reason', { nullable: true }) reason?: string\n  ): Promise<DomainOwner> {\n    const { domain, user: actor } = context.state\n\n    return (getRepository(Domain) as any).manager.transaction(async (tx: any) => {\n      const userRepo = tx.getRepository(User)\n      const ownerRepo = tx.getRepository(DomainOwner)\n      const domainRepo = tx.getRepository(Domain)\n\n      // username 컬럼이 nullable — 사용자는 username 을 가지지 않고\n      // email 만 갖는 경우가 많음. User.get username() 도 `username || email`\n      // 을 리턴하므로 UI 가 email 을 보낼 수 있음. 둘 다 매칭한다.\n      const targetUser = await userRepo\n        .createQueryBuilder('u')\n        .innerJoin('u.domains', 'd')\n        .where('(u.username = :key OR u.email = :key) AND d.id = :domainId', {\n          key: username,\n          domainId: domain.id\n        })\n        .getOne()\n      if (!targetUser) {\n        throw new Error(`User '${username}' is not a member of this domain.`)\n      }\n\n      const existing = await ownerRepo.findOne({\n        where: { domain: { id: domain.id }, user: { id: targetUser.id } }\n      })\n      if (existing) {\n        throw new Error(`User '${username}' is already an owner of this domain.`)\n      }\n\n      const entry = ownerRepo.create({\n        domain: { id: domain.id } as Domain,\n        user: { id: targetUser.id } as User,\n        grantedBy: actor,\n        reason\n      })\n      const saved = await ownerRepo.save(entry)\n\n      // 하위 호환 캐시: domain.owner가 비어 있으면 세팅\n      if (!domain.owner) {\n        await domainRepo.update(domain.id, { owner: targetUser.id })\n      }\n\n      // GraphQL 응답을 위해 relations 포함해 재조회.\n      // (save() 반환값은 { user: {id}, grantedBy: actor } 인데 user/grantedBy 의\n      //  non-nullable 필드 email 등이 채워져 있지 않아 직렬화 에러 발생)\n      return ownerRepo.findOneOrFail({\n        where: { id: saved.id },\n        relations: ['user', 'grantedBy', 'domain']\n      })\n    })\n  }\n\n  /**\n   * 현재 도메인의 owner를 제거한다.\n   * - 기존 도메인 오너 또는 수퍼유저만 호출 가능\n   * - 마지막 남은 owner는 제거 불가 (최소 1명 유지)\n   * - `Domain.owner` 캐시가 제거되는 user였다면, 남은 owner 중 하나로 재설정\n   */\n  @Directive('@privilege(domainOwnerGranted: true, superUserGranted: true)')\n  @Mutation(returns => Boolean, { description: 'Remove a user from the owners of the current domain.' })\n  async removeDomainOwner(\n    @Arg('username') username: string,\n    @Ctx() context: any,\n    @Arg('reason', { nullable: true }) _reason?: string\n  ): Promise<boolean> {\n    const { domain } = context.state\n\n    return (getRepository(Domain) as any).manager.transaction(async (tx: any) => {\n      const userRepo = tx.getRepository(User)\n      const ownerRepo = tx.getRepository(DomainOwner)\n      const domainRepo = tx.getRepository(Domain)\n\n      // username 또는 email 둘 다 허용 — addDomainOwner 와 대칭.\n      const targetUser = await userRepo.findOne({\n        where: [{ username }, { email: username }]\n      })\n      if (!targetUser) {\n        throw new Error(`User '${username}' not found.`)\n      }\n\n      const entry = await ownerRepo.findOne({\n        where: { domain: { id: domain.id }, user: { id: targetUser.id } }\n      })\n      const hasLegacyOwner = domain.owner === targetUser.id\n\n      if (!entry && !hasLegacyOwner) {\n        throw new Error(`User '${username}' is not an owner of this domain.`)\n      }\n\n      // 마지막 1인 보호: DomainOwner 테이블 기준 count + legacy owner 포함 여부\n      const ownerCount = await ownerRepo\n        .createQueryBuilder('ow')\n        .where('ow.domain_id = :d', { d: domain.id })\n        .getCount()\n\n      // 남을 owner 수 계산:\n      //   - DomainOwner 테이블에서 제거 대상이 있으면 ownerCount - 1\n      //   - legacy owner가 별도로 있고 DomainOwner에 없다면 +1\n      let remaining = ownerCount\n      if (entry) remaining -= 1\n      // legacy owner가 지금 제거 대상과 다른 user라면, 그 user도 하나의 owner로 카운트\n      if (domain.owner && domain.owner !== targetUser.id) {\n        // legacy owner가 DomainOwner 테이블에도 이미 있는지\n        const legacyInTable = await ownerRepo\n          .createQueryBuilder('ow')\n          .where('ow.domain_id = :d AND ow.user_id = :u', { d: domain.id, u: domain.owner })\n          .getExists()\n        if (!legacyInTable) remaining += 1\n      }\n\n      if (remaining < 1) {\n        throw new Error(\n          'Cannot remove the last owner of a domain. Add another owner first.'\n        )\n      }\n\n      if (entry) {\n        await ownerRepo.delete(entry.id)\n      }\n\n      if (hasLegacyOwner) {\n        // 캐시 재설정: 남은 DomainOwner 중 가장 먼저 추가된 사람\n        const next = await ownerRepo\n          .createQueryBuilder('ow')\n          .where('ow.domain_id = :d', { d: domain.id })\n          .orderBy('ow.grantedAt', 'ASC')\n          .getOne()\n        await domainRepo.update(domain.id, { owner: next?.userId ?? null })\n      }\n\n      return true\n    })\n  }\n}\n"]}
+{"version":3,"file":"domain-owner-mutation.js","sourceRoot":"","sources":["../../../server/service/domain-owner/domain-owner-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAsE;AACtE,iDAA6D;AAE7D,uDAA+C;AAC/C,6CAAsC;AACtC,kEAA8D;AAGvD,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B;;;;OAIG;IAGG,AAAN,KAAK,CAAC,cAAc,CACD,QAAgB,EAC1B,OAAY,EACgB,MAAe;QAElD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE7C,OAAQ,IAAA,qBAAa,EAAC,cAAM,CAAS,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAO,EAAE,EAAE;YAC1E,MAAM,QAAQ,GAAG,EAAE,CAAC,aAAa,CAAC,cAAI,CAAC,CAAA;YACvC,MAAM,SAAS,GAAG,EAAE,CAAC,aAAa,CAAC,6BAAW,CAAC,CAAA;YAC/C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,cAAM,CAAC,CAAA;YAE3C,iDAAiD;YACjD,+DAA+D;YAC/D,0CAA0C;YAC1C,MAAM,UAAU,GAAG,MAAM,QAAQ;iBAC9B,kBAAkB,CAAC,GAAG,CAAC;iBACvB,SAAS,CAAC,WAAW,EAAE,GAAG,CAAC;iBAC3B,KAAK,CAAC,4DAA4D,EAAE;gBACnE,GAAG,EAAE,QAAQ;gBACb,QAAQ,EAAE,MAAM,CAAC,EAAE;aACpB,CAAC;iBACD,MAAM,EAAE,CAAA;YACX,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,mCAAmC,CAAC,CAAA;YACvE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC;gBACvC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE;aAClE,CAAC,CAAA;YACF,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,uCAAuC,CAAC,CAAA;YAC3E,CAAC;YAED,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC;gBAC7B,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAY;gBACnC,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAU;gBACnC,SAAS,EAAE,KAAK;gBAChB,MAAM;aACP,CAAC,CAAA;YACF,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAEzC,oCAAoC;YACpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAA;YAC9D,CAAC;YAED,oCAAoC;YACpC,oEAAoE;YACpE,iDAAiD;YACjD,OAAO,SAAS,CAAC,aAAa,CAAC;gBAC7B,KAAK,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;gBACvB,SAAS,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,CAAC;aAC3C,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED;;;;;OAKG;IAGG,AAAN,KAAK,CAAC,iBAAiB,CACJ,QAAgB,EAC1B,OAAY,EACgB,OAAgB;QAEnD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,OAAQ,IAAA,qBAAa,EAAC,cAAM,CAAS,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,EAAE,EAAO,EAAE,EAAE;YAC1E,MAAM,QAAQ,GAAG,EAAE,CAAC,aAAa,CAAC,cAAI,CAAC,CAAA;YACvC,MAAM,SAAS,GAAG,EAAE,CAAC,aAAa,CAAC,6BAAW,CAAC,CAAA;YAC/C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,cAAM,CAAC,CAAA;YAE3C,kDAAkD;YAClD,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC;gBACxC,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;aAC3C,CAAC,CAAA;YACF,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,cAAc,CAAC,CAAA;YAClD,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC;gBACpC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE;aAClE,CAAC,CAAA;YACF,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC,EAAE,CAAA;YAErD,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,SAAS,QAAQ,mCAAmC,CAAC,CAAA;YACvE,CAAC;YAED,2DAA2D;YAC3D,MAAM,UAAU,GAAG,MAAM,SAAS;iBAC/B,kBAAkB,CAAC,IAAI,CAAC;iBACxB,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;iBAC5C,QAAQ,EAAE,CAAA;YAEb,iBAAiB;YACjB,kDAAkD;YAClD,+CAA+C;YAC/C,IAAI,SAAS,GAAG,UAAU,CAAA;YAC1B,IAAI,KAAK;gBAAE,SAAS,IAAI,CAAC,CAAA;YACzB,4DAA4D;YAC5D,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnD,yCAAyC;gBACzC,MAAM,aAAa,GAAG,MAAM,SAAS;qBAClC,kBAAkB,CAAC,IAAI,CAAC;qBACxB,KAAK,CAAC,uCAAuC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;qBACjF,SAAS,EAAE,CAAA;gBACd,IAAI,CAAC,aAAa;oBAAE,SAAS,IAAI,CAAC,CAAA;YACpC,CAAC;YAED,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAA;YACH,CAAC;YAED,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAClC,CAAC;YAED,4GAA4G;YAC5G,MAAM,IAAA,qCAAiB,EACrB,EAAE,IAAI,EAAE,qBAAqB,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,EACtG,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CACrC,CAAA;YAED,IAAI,cAAc,EAAE,CAAC;gBACnB,wCAAwC;gBACxC,MAAM,IAAI,GAAG,MAAM,SAAS;qBACzB,kBAAkB,CAAC,IAAI,CAAC;qBACxB,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;qBAC5C,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC;qBAC9B,MAAM,EAAE,CAAA;gBACX,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC,CAAA;YACrE,CAAC;YAED,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;IACJ,CAAC;CACF,CAAA;AAxJY,kDAAmB;AAQxB;IAFL,IAAA,wBAAS,EAAC,8DAA8D,CAAC;IACzE,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,6BAAW,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;IAE7F,mBAAA,IAAA,kBAAG,EAAC,UAAU,CAAC,CAAA;IACf,mBAAA,IAAA,kBAAG,GAAE,CAAA;IACL,mBAAA,IAAA,kBAAG,EAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;;;;yDAoDnC;AAUK;IAFL,IAAA,wBAAS,EAAC,8DAA8D,CAAC;IACzE,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC;IAEnG,mBAAA,IAAA,kBAAG,EAAC,UAAU,CAAC,CAAA;IACf,mBAAA,IAAA,kBAAG,GAAE,CAAA;IACL,mBAAA,IAAA,kBAAG,EAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;;;;4DA2EnC;8BAvJU,mBAAmB;IAD/B,IAAA,uBAAQ,EAAC,EAAE,CAAC,EAAE,CAAC,6BAAW,CAAC;GACf,mBAAmB,CAwJ/B","sourcesContent":["import { Resolver, Mutation, Arg, Ctx, Directive } from 'type-graphql'\nimport { Domain, getRepository } from '@things-factory/shell'\n\nimport { DomainOwner } from './domain-owner.js'\nimport { User } from '../user/user.js'\nimport { recordAuditAction } from '../audit/audit-recorder.js'\n\n@Resolver(of => DomainOwner)\nexport class DomainOwnerMutation {\n  /**\n   * 현재 도메인에 새 owner를 추가한다. 기존 도메인 오너 또는 수퍼유저만 호출 가능.\n   *\n   * 하위 호환: `Domain.owner` 캐시 필드가 비어 있으면 추가된 user를 세팅한다.\n   */\n  @Directive('@privilege(domainOwnerGranted: true, superUserGranted: true)')\n  @Mutation(returns => DomainOwner, { description: 'Add a user as owner of the current domain.' })\n  async addDomainOwner(\n    @Arg('username') username: string,\n    @Ctx() context: any,\n    @Arg('reason', { nullable: true }) reason?: string\n  ): Promise<DomainOwner> {\n    const { domain, user: actor } = context.state\n\n    return (getRepository(Domain) as any).manager.transaction(async (tx: any) => {\n      const userRepo = tx.getRepository(User)\n      const ownerRepo = tx.getRepository(DomainOwner)\n      const domainRepo = tx.getRepository(Domain)\n\n      // username 컬럼이 nullable — 사용자는 username 을 가지지 않고\n      // email 만 갖는 경우가 많음. User.get username() 도 `username || email`\n      // 을 리턴하므로 UI 가 email 을 보낼 수 있음. 둘 다 매칭한다.\n      const targetUser = await userRepo\n        .createQueryBuilder('u')\n        .innerJoin('u.domains', 'd')\n        .where('(u.username = :key OR u.email = :key) AND d.id = :domainId', {\n          key: username,\n          domainId: domain.id\n        })\n        .getOne()\n      if (!targetUser) {\n        throw new Error(`User '${username}' is not a member of this domain.`)\n      }\n\n      const existing = await ownerRepo.findOne({\n        where: { domain: { id: domain.id }, user: { id: targetUser.id } }\n      })\n      if (existing) {\n        throw new Error(`User '${username}' is already an owner of this domain.`)\n      }\n\n      const entry = ownerRepo.create({\n        domain: { id: domain.id } as Domain,\n        user: { id: targetUser.id } as User,\n        grantedBy: actor,\n        reason\n      })\n      const saved = await ownerRepo.save(entry)\n\n      // 하위 호환 캐시: domain.owner가 비어 있으면 세팅\n      if (!domain.owner) {\n        await domainRepo.update(domain.id, { owner: targetUser.id })\n      }\n\n      // GraphQL 응답을 위해 relations 포함해 재조회.\n      // (save() 반환값은 { user: {id}, grantedBy: actor } 인데 user/grantedBy 의\n      //  non-nullable 필드 email 등이 채워져 있지 않아 직렬화 에러 발생)\n      return ownerRepo.findOneOrFail({\n        where: { id: saved.id },\n        relations: ['user', 'grantedBy', 'domain']\n      })\n    })\n  }\n\n  /**\n   * 현재 도메인의 owner를 제거한다.\n   * - 기존 도메인 오너 또는 수퍼유저만 호출 가능\n   * - 마지막 남은 owner는 제거 불가 (최소 1명 유지)\n   * - `Domain.owner` 캐시가 제거되는 user였다면, 남은 owner 중 하나로 재설정\n   */\n  @Directive('@privilege(domainOwnerGranted: true, superUserGranted: true)')\n  @Mutation(returns => Boolean, { description: 'Remove a user from the owners of the current domain.' })\n  async removeDomainOwner(\n    @Arg('username') username: string,\n    @Ctx() context: any,\n    @Arg('reason', { nullable: true }) _reason?: string\n  ): Promise<boolean> {\n    const { domain } = context.state\n\n    return (getRepository(Domain) as any).manager.transaction(async (tx: any) => {\n      const userRepo = tx.getRepository(User)\n      const ownerRepo = tx.getRepository(DomainOwner)\n      const domainRepo = tx.getRepository(Domain)\n\n      // username 또는 email 둘 다 허용 — addDomainOwner 와 대칭.\n      const targetUser = await userRepo.findOne({\n        where: [{ username }, { email: username }]\n      })\n      if (!targetUser) {\n        throw new Error(`User '${username}' not found.`)\n      }\n\n      const entry = await ownerRepo.findOne({\n        where: { domain: { id: domain.id }, user: { id: targetUser.id } }\n      })\n      const hasLegacyOwner = domain.owner === targetUser.id\n\n      if (!entry && !hasLegacyOwner) {\n        throw new Error(`User '${username}' is not an owner of this domain.`)\n      }\n\n      // 마지막 1인 보호: DomainOwner 테이블 기준 count + legacy owner 포함 여부\n      const ownerCount = await ownerRepo\n        .createQueryBuilder('ow')\n        .where('ow.domain_id = :d', { d: domain.id })\n        .getCount()\n\n      // 남을 owner 수 계산:\n      //   - DomainOwner 테이블에서 제거 대상이 있으면 ownerCount - 1\n      //   - legacy owner가 별도로 있고 DomainOwner에 없다면 +1\n      let remaining = ownerCount\n      if (entry) remaining -= 1\n      // legacy owner가 지금 제거 대상과 다른 user라면, 그 user도 하나의 owner로 카운트\n      if (domain.owner && domain.owner !== targetUser.id) {\n        // legacy owner가 DomainOwner 테이블에도 이미 있는지\n        const legacyInTable = await ownerRepo\n          .createQueryBuilder('ow')\n          .where('ow.domain_id = :d AND ow.user_id = :u', { d: domain.id, u: domain.owner })\n          .getExists()\n        if (!legacyInTable) remaining += 1\n      }\n\n      if (remaining < 1) {\n        throw new Error(\n          'Cannot remove the last owner of a domain. Add another owner first.'\n        )\n      }\n\n      if (entry) {\n        await ownerRepo.delete(entry.id)\n      }\n\n      /* `delete()` passes no subscriber - the removal records itself, in the same transaction (ADR-0141 §4-1). */\n      await recordAuditAction(\n        { kind: 'domain.owner.remove', targetKind: 'User', targetIds: [targetUser.id], targetRole: 'handled' },\n        { manager: tx, domainId: domain.id }\n      )\n\n      if (hasLegacyOwner) {\n        // 캐시 재설정: 남은 DomainOwner 중 가장 먼저 추가된 사람\n        const next = await ownerRepo\n          .createQueryBuilder('ow')\n          .where('ow.domain_id = :d', { d: domain.id })\n          .orderBy('ow.grantedAt', 'ASC')\n          .getOne()\n        await domainRepo.update(domain.id, { owner: next?.userId ?? null })\n      }\n\n      return true\n    })\n  }\n}\n"]}