@things-factory/auth-base 10.1.31 → 10.1.33

package/dist-server/service/auth-provider/auth-provider-mutation.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-provider-mutation.js","sourceRoot":"","sources":["../../../server/service/auth-provider/auth-provider-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAsE;AACtE,qCAA4B;AAE5B,yDAAiD;AACjD,mEAA4E;AAGrE,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAGzB,AAAN,KAAK,CAAC,kBAAkB,CACD,YAA6B,EAC3C,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,OAAO,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,IAAI,CAAC;YAC/C,GAAG,YAAY;YACf,MAAM;YACN,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI;SACd,CAAC,CAAA;IACJ,CAAC;IAIK,AAAN,KAAK,CAAC,kBAAkB,CACX,EAAU,EACP,KAAwB,EAC/B,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAA;QACjD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;SACzC,CAAC,CAAA;QAEF,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC;YAC3B,GAAG,YAAY;YACf,GAAG,KAAK;YACR,OAAO,EAAE,IAAI;SACd,CAAC,CAAA;IACJ,CAAC;IAIK,AAAN,KAAK,CAAC,0BAA0B,CACe,OAA4B,EAClE,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,IAAI,OAAO,GAAG,EAAE,CAAA;QAChB,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAA;QAC3E,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAA;QAEzF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;gBAEnC,IAAI,iBAAiB,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,OAAO,CAAC;oBACnE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;iBAC3D,CAAC,CAAA;gBAEF,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;gBAClD,CAAC;gBAED,MAAM,MAAM,GAAiB,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,IAAI,CAAC;oBACrE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,IAAI;oBACb,GAAG,SAAS;iBACb,CAAC,CAAA;gBAEF,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,MAAM,aAAa,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;gBACvC,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,OAAO,CAAC;oBAChE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE;iBAC3D,CAAC,CAAA;gBAEF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,IAAI,CAAC;oBACvD,GAAG,YAAY;oBACf,GAAG,aAAa;oBAChB,OAAO,EAAE,IAAI;iBACd,CAAC,CAAA;gBAEF,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAIK,AAAN,KAAK,CAAC,kBAAkB,CAAY,EAAU,EAAS,OAAwB;QAC7E,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEpC,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAE9E,OAAO,IAAI,CAAA;IACb,CAAC;IAIK,AAAN,KAAK,CAAC,mBAAmB,CACO,GAAa,EACpC,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,IAAI,CAAC;YAC9D,KAAK,EAAE;gBACL,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;gBACzB,EAAE,EAAE,IAAA,YAAE,EAAC,GAAG,CAAC;aACZ;SACF,CAAC,CAAA;QAEF,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,YAA0B,EAAE,EAAE;YACrD,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,IAAI,CAAC;gBACxC,GAAG,YAAY;gBACf,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;QACJ,CAAC,CAAC,CACH,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAKK,AAAN,KAAK,CAAC,4BAA4B,CAAY,EAAU,EAAS,OAAwB;QACvF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAA;QACjD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;YACxC,SAAS,EAAE,CAAC,QAAQ,CAAC;SACtB,CAAC,CAAA;QAEF,MAAM,EAAE,IAAI,EAAE,GAAG,YAAY,CAAA;QAC7B,MAAM,EAAE,gBAAgB,EAAE,GAAG,+BAAY,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QAEzE,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,MAAM,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QACtD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;CACF,CAAA;AAvJY,oDAAoB;AAGzB;IAFL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,+BAAY,EAAE,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;IAE9E,mBAAA,IAAA,kBAAG,EAAC,cAAc,CAAC,CAAA;IACnB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAD6B,uCAAe;;8DAWnD;AAIK;IAFL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,+BAAY,EAAE,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IAEtF,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IACT,mBAAA,IAAA,kBAAG,EAAC,OAAO,CAAC,CAAA;IACZ,mBAAA,IAAA,kBAAG,GAAE,CAAA;;qDADe,yCAAiB;;8DAevC;AAIK;IAFL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,+BAAY,CAAC,CAAC;IAEjC,mBAAA,IAAA,kBAAG,EAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,yCAAiB,CAAC,CAAC,CAAA;IAC3C,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;sEAiDP;AAIK;IAFL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;IAC9C,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;8DAMrD;AAIK;IAFL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC;IAE1B,mBAAA,IAAA,kBAAG,EAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAC5B,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;+DAqBP;AAKK;IAHL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,mCAAmC,CAAC;IAC9C,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;IACjD,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;wEAiB/D;+BAtJU,oBAAoB;IADhC,IAAA,uBAAQ,EAAC,+BAAY,CAAC;GACV,oBAAoB,CAuJhC","sourcesContent":["import { Resolver, Mutation, Arg, Ctx, Directive } from 'type-graphql'\nimport { In } from 'typeorm'\n\nimport { AuthProvider } from './auth-provider.js'\nimport { NewAuthProvider, AuthProviderPatch } from './auth-provider-type.js'\n\n@Resolver(AuthProvider)\nexport class AuthProviderMutation {\n  @Directive('@transaction')\n  @Mutation(returns => AuthProvider, { description: 'To create new AuthProvider' })\n  async createAuthProvider(\n    @Arg('authProvider') authProvider: NewAuthProvider,\n    @Ctx() context: ResolverContext\n  ): Promise<AuthProvider> {\n    const { domain, user, tx } = context.state\n\n    return await tx.getRepository(AuthProvider).save({\n      ...authProvider,\n      domain,\n      creator: user,\n      updater: user\n    })\n  }\n\n  @Directive('@transaction')\n  @Mutation(returns => AuthProvider, { description: 'To modify AuthProvider information' })\n  async updateAuthProvider(\n    @Arg('id') id: string,\n    @Arg('patch') patch: AuthProviderPatch,\n    @Ctx() context: ResolverContext\n  ): Promise<AuthProvider> {\n    const { domain, user, tx } = context.state\n\n    const repository = tx.getRepository(AuthProvider)\n    const authProvider = await repository.findOne({\n      where: { domain: { id: domain.id }, id }\n    })\n\n    return await repository.save({\n      ...authProvider,\n      ...patch,\n      updater: user\n    })\n  }\n\n  @Directive('@transaction')\n  @Mutation(returns => [AuthProvider])\n  async updateMultipleAuthProvider(\n    @Arg('patches', type => [AuthProviderPatch]) patches: AuthProviderPatch[],\n    @Ctx() context: ResolverContext\n  ): Promise<AuthProvider[]> {\n    const { domain, user, tx } = context.state\n\n    let results = []\n    const _createRecords = patches.filter((patch: any) => patch.cuFlag === '+')\n    const _updateRecords = patches.filter((patch: any) => patch.cuFlag.toUpperCase() === 'M')\n\n    if (_createRecords.length > 0) {\n      for (let i = 0; i < _createRecords.length; i++) {\n        const newRecord = _createRecords[i]\n\n        let foundAuthProvider = await tx.getRepository(AuthProvider).findOne({\n          where: { domain: { id: domain.id }, type: newRecord.type }\n        })\n\n        if (foundAuthProvider) {\n          throw new Error('Duplicated authProvider found')\n        }\n\n        const result: AuthProvider = await tx.getRepository(AuthProvider).save({\n          domain: domain,\n          creator: user,\n          updater: user,\n          ...newRecord\n        })\n\n        results.push({ ...result, cuFlag: '+' })\n      }\n    }\n\n    if (_updateRecords.length > 0) {\n      for (let i = 0; i < _updateRecords.length; i++) {\n        const updatedRecord = _updateRecords[i]\n        const authProvider = await tx.getRepository(AuthProvider).findOne({\n          where: { domain: { id: domain.id }, id: updatedRecord.id }\n        })\n\n        const result = await tx.getRepository(AuthProvider).save({\n          ...authProvider,\n          ...updatedRecord,\n          updater: user\n        })\n\n        results.push({ ...result, cuFlag: 'M' })\n      }\n    }\n\n    return results\n  }\n\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, { description: 'To delete AuthProvider' })\n  async deleteAuthProvider(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<boolean> {\n    const { domain, tx } = context.state\n\n    await tx.getRepository(AuthProvider).delete({ domain: { id: domain.id }, id })\n\n    return true\n  }\n\n  @Directive('@transaction')\n  @Mutation(returns => Boolean)\n  async deleteAuthProviders(\n    @Arg('ids', type => [String]) ids: string[],\n    @Ctx() context: ResolverContext\n  ): Promise<Boolean> {\n    const { domain, user, tx } = context.state\n\n    const authProviders = await tx.getRepository(AuthProvider).find({\n      where: {\n        domain: { id: domain.id },\n        id: In(ids)\n      }\n    })\n\n    await Promise.all(\n      authProviders.map(async (authProvider: AuthProvider) => {\n        await tx.getRepository(AuthProvider).save({\n          ...authProvider,\n          deletedAt: new Date(),\n          updater: user\n        })\n      })\n    )\n    return true\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(superUserGranted:true)')\n  @Mutation(returns => Boolean, { description: 'To synchronize auth-providers users' })\n  async synchronizeAuthProviderUsers(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<boolean> {\n    const { domain, user, tx } = context.state\n\n    const repository = tx.getRepository(AuthProvider)\n    const authProvider = await repository.findOne({\n      where: { domain: { id: domain.id }, id },\n      relations: ['domain']\n    })\n\n    const { type } = authProvider\n    const { synchronizeUsers } = AuthProvider.getAuthProviderImpl(type) || {}\n\n    if (synchronizeUsers) {\n      return await synchronizeUsers(authProvider, context)\n    } else {\n      throw new Error(`No AuthProviderImpl for the type '${type}'`)\n    }\n  }\n}\n"]}
+{"version":3,"file":"auth-provider-mutation.js","sourceRoot":"","sources":["../../../server/service/auth-provider/auth-provider-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAsE;AACtE,qCAA4B;AAE5B,yDAAiD;AACjD,mEAA4E;AAGrE,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAIzB,AAAN,KAAK,CAAC,kBAAkB,CACD,YAA6B,EAC3C,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,OAAO,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,IAAI,CAAC;YAC/C,GAAG,YAAY;YACf,MAAM;YACN,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,IAAI;SACd,CAAC,CAAA;IACJ,CAAC;IAKK,AAAN,KAAK,CAAC,kBAAkB,CACX,EAAU,EACP,KAAwB,EAC/B,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAA;QACjD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;SACzC,CAAC,CAAA;QAEF,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC;YAC3B,GAAG,YAAY;YACf,GAAG,KAAK;YACR,OAAO,EAAE,IAAI;SACd,CAAC,CAAA;IACJ,CAAC;IAKK,AAAN,KAAK,CAAC,0BAA0B,CACe,OAA4B,EAClE,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,IAAI,OAAO,GAAG,EAAE,CAAA;QAChB,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,CAAA;QAC3E,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAA;QAEzF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,MAAM,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;gBAEnC,IAAI,iBAAiB,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,OAAO,CAAC;oBACnE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;iBAC3D,CAAC,CAAA;gBAEF,IAAI,iBAAiB,EAAE,CAAC;oBACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;gBAClD,CAAC;gBAED,MAAM,MAAM,GAAiB,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,IAAI,CAAC;oBACrE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,IAAI;oBACb,OAAO,EAAE,IAAI;oBACb,GAAG,SAAS;iBACb,CAAC,CAAA;gBAEF,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,MAAM,aAAa,GAAG,cAAc,CAAC,CAAC,CAAC,CAAA;gBACvC,MAAM,YAAY,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,OAAO,CAAC;oBAChE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE;iBAC3D,CAAC,CAAA;gBAEF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,IAAI,CAAC;oBACvD,GAAG,YAAY;oBACf,GAAG,aAAa;oBAChB,OAAO,EAAE,IAAI;iBACd,CAAC,CAAA;gBAEF,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC1C,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAA;IAChB,CAAC;IAKK,AAAN,KAAK,CAAC,kBAAkB,CAAY,EAAU,EAAS,OAAwB;QAC7E,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEpC,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAA;QAE9E,OAAO,IAAI,CAAA;IACb,CAAC;IAKK,AAAN,KAAK,CAAC,mBAAmB,CACO,GAAa,EACpC,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,IAAI,CAAC;YAC9D,KAAK,EAAE;gBACL,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE;gBACzB,EAAE,EAAE,IAAA,YAAE,EAAC,GAAG,CAAC;aACZ;SACF,CAAC,CAAA;QAEF,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,YAA0B,EAAE,EAAE;YACrD,MAAM,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAC,IAAI,CAAC;gBACxC,GAAG,YAAY;gBACf,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,OAAO,EAAE,IAAI;aACd,CAAC,CAAA;QACJ,CAAC,CAAC,CACH,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAKK,AAAN,KAAK,CAAC,4BAA4B,CAAY,EAAU,EAAS,OAAwB;QACvF,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,MAAM,UAAU,GAAG,EAAE,CAAC,aAAa,CAAC,+BAAY,CAAC,CAAA;QACjD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YAC5C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE;YACxC,SAAS,EAAE,CAAC,QAAQ,CAAC;SACtB,CAAC,CAAA;QAEF,MAAM,EAAE,IAAI,EAAE,GAAG,YAAY,CAAA;QAC7B,MAAM,EAAE,gBAAgB,EAAE,GAAG,+BAAY,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;QAEzE,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,MAAM,gBAAgB,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QACtD,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,GAAG,CAAC,CAAA;QAC/D,CAAC;IACH,CAAC;CACF,CAAA;AA5JY,oDAAoB;AAIzB;IAHL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,+BAAY,EAAE,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC;IAE9E,mBAAA,IAAA,kBAAG,EAAC,cAAc,CAAC,CAAA;IACnB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAD6B,uCAAe;;8DAWnD;AAKK;IAHL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,+BAAY,EAAE,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IAEtF,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IACT,mBAAA,IAAA,kBAAG,EAAC,OAAO,CAAC,CAAA;IACZ,mBAAA,IAAA,kBAAG,GAAE,CAAA;;qDADe,yCAAiB;;8DAevC;AAKK;IAHL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,+BAAY,CAAC,CAAC;IAEjC,mBAAA,IAAA,kBAAG,EAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,yCAAiB,CAAC,CAAC,CAAA;IAC3C,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;sEAiDP;AAKK;IAHL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;IAC9C,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;8DAMrD;AAKK;IAHL,IAAA,wBAAS,EAAC,+EAA+E,CAAC;IAC1F,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC;IAE1B,mBAAA,IAAA,kBAAG,EAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAC5B,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;+DAqBP;AAKK;IAHL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,wBAAS,EAAC,mCAAmC,CAAC;IAC9C,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;IACjD,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;wEAiB/D;+BA3JU,oBAAoB;IADhC,IAAA,uBAAQ,EAAC,+BAAY,CAAC;GACV,oBAAoB,CA4JhC","sourcesContent":["import { Resolver, Mutation, Arg, Ctx, Directive } from 'type-graphql'\nimport { In } from 'typeorm'\n\nimport { AuthProvider } from './auth-provider.js'\nimport { NewAuthProvider, AuthProviderPatch } from './auth-provider-type.js'\n\n@Resolver(AuthProvider)\nexport class AuthProviderMutation {\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => AuthProvider, { description: 'To create new AuthProvider' })\n  async createAuthProvider(\n    @Arg('authProvider') authProvider: NewAuthProvider,\n    @Ctx() context: ResolverContext\n  ): Promise<AuthProvider> {\n    const { domain, user, tx } = context.state\n\n    return await tx.getRepository(AuthProvider).save({\n      ...authProvider,\n      domain,\n      creator: user,\n      updater: user\n    })\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => AuthProvider, { description: 'To modify AuthProvider information' })\n  async updateAuthProvider(\n    @Arg('id') id: string,\n    @Arg('patch') patch: AuthProviderPatch,\n    @Ctx() context: ResolverContext\n  ): Promise<AuthProvider> {\n    const { domain, user, tx } = context.state\n\n    const repository = tx.getRepository(AuthProvider)\n    const authProvider = await repository.findOne({\n      where: { domain: { id: domain.id }, id }\n    })\n\n    return await repository.save({\n      ...authProvider,\n      ...patch,\n      updater: user\n    })\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => [AuthProvider])\n  async updateMultipleAuthProvider(\n    @Arg('patches', type => [AuthProviderPatch]) patches: AuthProviderPatch[],\n    @Ctx() context: ResolverContext\n  ): Promise<AuthProvider[]> {\n    const { domain, user, tx } = context.state\n\n    let results = []\n    const _createRecords = patches.filter((patch: any) => patch.cuFlag === '+')\n    const _updateRecords = patches.filter((patch: any) => patch.cuFlag.toUpperCase() === 'M')\n\n    if (_createRecords.length > 0) {\n      for (let i = 0; i < _createRecords.length; i++) {\n        const newRecord = _createRecords[i]\n\n        let foundAuthProvider = await tx.getRepository(AuthProvider).findOne({\n          where: { domain: { id: domain.id }, type: newRecord.type }\n        })\n\n        if (foundAuthProvider) {\n          throw new Error('Duplicated authProvider found')\n        }\n\n        const result: AuthProvider = await tx.getRepository(AuthProvider).save({\n          domain: domain,\n          creator: user,\n          updater: user,\n          ...newRecord\n        })\n\n        results.push({ ...result, cuFlag: '+' })\n      }\n    }\n\n    if (_updateRecords.length > 0) {\n      for (let i = 0; i < _updateRecords.length; i++) {\n        const updatedRecord = _updateRecords[i]\n        const authProvider = await tx.getRepository(AuthProvider).findOne({\n          where: { domain: { id: domain.id }, id: updatedRecord.id }\n        })\n\n        const result = await tx.getRepository(AuthProvider).save({\n          ...authProvider,\n          ...updatedRecord,\n          updater: user\n        })\n\n        results.push({ ...result, cuFlag: 'M' })\n      }\n    }\n\n    return results\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, { description: 'To delete AuthProvider' })\n  async deleteAuthProvider(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<boolean> {\n    const { domain, tx } = context.state\n\n    await tx.getRepository(AuthProvider).delete({ domain: { id: domain.id }, id })\n\n    return true\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Boolean)\n  async deleteAuthProviders(\n    @Arg('ids', type => [String]) ids: string[],\n    @Ctx() context: ResolverContext\n  ): Promise<Boolean> {\n    const { domain, user, tx } = context.state\n\n    const authProviders = await tx.getRepository(AuthProvider).find({\n      where: {\n        domain: { id: domain.id },\n        id: In(ids)\n      }\n    })\n\n    await Promise.all(\n      authProviders.map(async (authProvider: AuthProvider) => {\n        await tx.getRepository(AuthProvider).save({\n          ...authProvider,\n          deletedAt: new Date(),\n          updater: user\n        })\n      })\n    )\n    return true\n  }\n\n  @Directive('@transaction')\n  @Directive('@privilege(superUserGranted:true)')\n  @Mutation(returns => Boolean, { description: 'To synchronize auth-providers users' })\n  async synchronizeAuthProviderUsers(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<boolean> {\n    const { domain, user, tx } = context.state\n\n    const repository = tx.getRepository(AuthProvider)\n    const authProvider = await repository.findOne({\n      where: { domain: { id: domain.id }, id },\n      relations: ['domain']\n    })\n\n    const { type } = authProvider\n    const { synchronizeUsers } = AuthProvider.getAuthProviderImpl(type) || {}\n\n    if (synchronizeUsers) {\n      return await synchronizeUsers(authProvider, context)\n    } else {\n      throw new Error(`No AuthProviderImpl for the type '${type}'`)\n    }\n  }\n}\n"]}

package/dist-server/service/domain-generator/domain-generator-mutation.js

@@ -26,6 +26,8 @@ let DomainGeneratorMutation = class DomainGeneratorMutation {
         await (0, domain_ownership_js_1.setPrimaryDomainOwner)(newDomain, user.id, user);
         return await domainRepo.findOneBy({ id: newDomain.id });
     }
+    /* `domainRegister` beside it makes a domain and is super-user only. This makes a domain,
+       its roles and its users, and carried nothing at all. */
     async domainUserRoleRegister(newDomainInfo, context) {
         const { tx } = context.state;
         // 도메인 생성
@@ -94,6 +96,7 @@ tslib_1.__decorate([
     tslib_1.__metadata("design:returntype", Promise)
 ], DomainGeneratorMutation.prototype, "domainRegister", null);
 tslib_1.__decorate([
+    (0, type_graphql_1.Directive)('@privilege(superUserGranted: true)'),
     (0, type_graphql_1.Directive)('@transaction'),
     (0, type_graphql_1.Mutation)(returns => shell_1.Domain),
     tslib_1.__param(0, (0, type_graphql_1.Arg)('newDomainInfo')),

package/dist-server/service/domain-generator/domain-generator-mutation.js.map

@@ -1 +1 @@
-{"version":3,"file":"domain-generator-mutation.js","sourceRoot":"","sources":["../../../server/service/domain-generator/domain-generator-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAsE;AACtE,qCAA+C;AAE/C,iDAA6D;AAC7D,iDAA+C;AAE/C,yEAAuE;AACvE,4DAAqD;AACrD,6CAAsC;AACtC,6CAAsC;AACtC,2EAAuF;AAGhF,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAI5B,AAAN,KAAK,CAAC,cAAc,CACE,WAAiC,EAC9C,OAAwB;QAE/B,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAC9B,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,CAAA;QACzC,MAAM,UAAU,GAAuB,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAA;QAC5D,MAAM,SAAS,GAAW,IAAA,eAAO,EAAC,IAAI,CAAC,CAAA;QAEvC,MAAM,MAAM,GAAW,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAChE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACzC,CAAC;QAED,MAAM,SAAS,GAAW,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAA;QAEjF,mEAAmE;QACnE,MAAM,IAAA,2CAAqB,EAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAErD,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAA;IACzD,CAAC;IAIK,AAAN,KAAK,CAAC,sBAAsB,CACJ,aAAkC,EACjD,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAC5B,SAAS;QACT,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,aAAa,CAAA;QAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAA;QAE3D,MAAM,gBAAgB,GAAuB,EAAE,CAAC,aAAa,CAAC,cAAM,CAAC,CAAA;QACrE,MAAM,cAAc,GAAqB,EAAE,CAAC,aAAa,CAAC,cAAI,CAAC,CAAA;QAC/D,MAAM,cAAc,GAAqB,EAAE,CAAC,aAAa,CAAC,cAAI,CAAC,CAAA;QAC/D,MAAM,mBAAmB,GAA0B,EAAE,CAAC,aAAa,CAAC,wBAAS,CAAC,CAAA;QAE9E,MAAM,SAAS,GAAW,IAAA,eAAO,EAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAE9C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC;YAC5C,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS;SACV,CAAC,CAAA;QAEF,QAAQ;QACR,MAAM,QAAQ,GAAW,MAAM,OAAO,CAAC,GAAG,CACxC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAU,EAAE,EAAE;YAC7B,IAAI,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;gBAC5B,MAAM,YAAY,GAAa,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;gBAC1E,IAAI,CAAC,UAAU,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC;oBACjD,EAAE,EAAE,IAAA,YAAE,EAAC,YAAY,CAAC;iBACrB,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;YACvB,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,CAAC,CAAC,CACH,CAAA;QAED,SAAS;QACT,IAAI,WAAW,GAAG,EAAE,CAAA;QACpB,IAAI,WAAW,GAAG,EAAE,CAAA;QACpB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAEzF,cAAc;QACd,MAAM,OAAO,CAAC,GAAG,CACf,WAAW,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YAC3B,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,CAAA;YAC1B,IAAI,CAAC,QAAQ,GAAG,cAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACrD,IAAI,CAAC,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;YAC/B,IAAI,CAAC,iBAAiB,GAAG,IAAI,IAAI,EAAE,CAAA;YACnC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAA;YACtB,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YAElD,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,CAAC,CAAC,CACH,CAAA;QAED,cAAc;QACd,MAAM,OAAO,CAAC,GAAG,CACf,WAAW,CAAC,GAAG,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE;YACjC,MAAM,IAAI,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;gBAC9C,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE;gBAClC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,CAAC,CAAA;YAEF,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;YAC3C,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAA;YAE5E,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,CAAC,CAAC,CACH,CAAA;QAED,uDAAuD;QACvD,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAC3F,MAAM,IAAA,2CAAqB,EAAC,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAElE,OAAO,MAAM,gBAAgB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/D,CAAC;CACF,CAAA;AAzGY,0DAAuB;AAI5B;IAHL,IAAA,wBAAS,EAAC,oCAAoC,CAAC;IAC/C,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAM,CAAC;IAEzB,mBAAA,IAAA,kBAAG,EAAC,aAAa,CAAC,CAAA;IAClB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAD2B,gDAAoB;;6DAmBtD;AAIK;IAFL,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAM,CAAC;IAEzB,mBAAA,IAAA,kBAAG,EAAC,eAAe,CAAC,CAAA;IACpB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAD+B,+CAAmB;;qEA2EzD;kCAxGU,uBAAuB;IADnC,IAAA,uBAAQ,GAAE;GACE,uBAAuB,CAyGnC;AAED,SAAS,eAAe,CAAC,SAAiB,EAAE,QAAgB;IAC1D,MAAM,aAAa,GAAa,SAAS,CAAC,GAAG,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAClE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACzE,CAAC","sourcesContent":["import { Arg, Ctx, Directive, Mutation, Resolver } from 'type-graphql'\nimport { ILike, In, Repository } from 'typeorm'\n\nimport { Domain, getRepository } from '@things-factory/shell'\nimport { slugger } from '@things-factory/utils'\n\nimport { setPrimaryDomainOwner } from '../../utils/domain-ownership.js'\nimport { Privilege } from '../privilege/privilege.js'\nimport { Role } from '../role/role.js'\nimport { User } from '../user/user.js'\nimport { DomainGeneratorInput, DomainUserRoleInput } from './domain-generator-types.js'\n\n@Resolver()\nexport class DomainGeneratorMutation {\n  @Directive('@privilege(superUserGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Domain)\n  async domainRegister(\n    @Arg('domainInput') domainInput: DomainGeneratorInput,\n    @Ctx() context: ResolverContext\n  ): Promise<Domain> {\n    const { user } = context.state\n    const { name, description } = domainInput\n    const domainRepo: Repository<Domain> = getRepository(Domain)\n    const subdomain: string = slugger(name)\n\n    const domain: Domain = await domainRepo.findOneBy({ subdomain })\n    if (domain) {\n      throw new Error('domain is duplicated')\n    }\n\n    const newDomain: Domain = await domainRepo.save({ name, description, subdomain })\n\n    /* 대표 오너 컬럼과 `DomainOwner` 테이블을 함께 세팅한다 (컬럼만 쓰면 오너 목록에 나오지 않는다). */\n    await setPrimaryDomainOwner(newDomain, user.id, user)\n\n    return await domainRepo.findOneBy({ id: newDomain.id })\n  }\n\n  @Directive('@transaction')\n  @Mutation(returns => Domain)\n  async domainUserRoleRegister(\n    @Arg('newDomainInfo') newDomainInfo: DomainUserRoleInput,\n    @Ctx() context: ResolverContext\n  ): Promise<Domain> {\n    const { tx } = context.state\n    // 도메인 생성\n    const { domain, users, roles } = newDomainInfo\n    const domainOwner = users.find(user => user.owner === true)\n\n    const domainRepository: Repository<Domain> = tx.getRepository(Domain)\n    const roleRepository: Repository<Role> = tx.getRepository(Role)\n    const userRepository: Repository<User> = tx.getRepository(User)\n    const privilegeRepository: Repository<Privilege> = tx.getRepository(Privilege)\n\n    const subdomain: string = slugger(domain.name)\n\n    const newDomain = await domainRepository.save({\n      name: domain.name,\n      description: domain.description,\n      subdomain\n    })\n\n    // 역할 생성\n    const newRoles: Role[] = await Promise.all(\n      roles.map(async (role: Role) => {\n        if (role.privileges?.length) {\n          const privilegeIds: string[] = role.privileges.map((p: Privilege) => p.id)\n          role.privileges = await privilegeRepository.findBy({\n            id: In(privilegeIds)\n          })\n        }\n\n        role.domain = newDomain\n        return await roleRepository.save(role)\n      })\n    )\n\n    // 사용자 생성\n    let inviteUsers = []\n    let createUsers = []\n    users.forEach(user => (user.isInvitee ? inviteUsers.push(user) : createUsers.push(user)))\n\n    // create user\n    await Promise.all(\n      createUsers.map(async user => {\n        user.domains = [newDomain]\n        user.password = User.encode(user.password, user.salt)\n        user.salt = User.generateSalt()\n        user.passwordUpdatedAt = new Date()\n        user.userType = 'user'\n        user.roles = filterUserRoles(user.roles, newRoles)\n\n        return await userRepository.save(user)\n      })\n    )\n\n    // invite user\n    await Promise.all(\n      inviteUsers.map(async inviteUser => {\n        const user: User = await userRepository.findOne({\n          where: { email: inviteUser.email },\n          relations: ['domains', 'roles']\n        })\n\n        user.domains = [...user.domains, newDomain]\n        user.roles = [...user.roles, ...filterUserRoles(inviteUser.roles, newRoles)]\n\n        return await userRepository.save(user)\n      })\n    )\n\n    // domain owner — 대표 오너 컬럼과 `DomainOwner` 테이블을 함께 세팅한다.\n    const { id } = await userRepository.findOne({ where: { email: ILike(domainOwner.email) } })\n    await setPrimaryDomainOwner(newDomain, id, context.state.user, tx)\n\n    return await domainRepository.findOneBy({ id: newDomain.id })\n  }\n}\n\nfunction filterUserRoles(userRoles: Role[], newRoles: Role[]): Role[] {\n  const userRoleNames: string[] = userRoles.map((r: Role) => r.name)\n  return newRoles.filter((r: Role) => userRoleNames.indexOf(r.name) >= 0)\n}\n"]}
+{"version":3,"file":"domain-generator-mutation.js","sourceRoot":"","sources":["../../../server/service/domain-generator/domain-generator-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAsE;AACtE,qCAA+C;AAE/C,iDAA6D;AAC7D,iDAA+C;AAE/C,yEAAuE;AACvE,4DAAqD;AACrD,6CAAsC;AACtC,6CAAsC;AACtC,2EAAuF;AAGhF,IAAM,uBAAuB,GAA7B,MAAM,uBAAuB;IAI5B,AAAN,KAAK,CAAC,cAAc,CACE,WAAiC,EAC9C,OAAwB;QAE/B,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAC9B,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,WAAW,CAAA;QACzC,MAAM,UAAU,GAAuB,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAA;QAC5D,MAAM,SAAS,GAAW,IAAA,eAAO,EAAC,IAAI,CAAC,CAAA;QAEvC,MAAM,MAAM,GAAW,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAA;QAChE,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACzC,CAAC;QAED,MAAM,SAAS,GAAW,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAA;QAEjF,mEAAmE;QACnE,MAAM,IAAA,2CAAqB,EAAC,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;QAErD,OAAO,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAA;IACzD,CAAC;IAED;8DAC0D;IAIpD,AAAN,KAAK,CAAC,sBAAsB,CACJ,aAAkC,EACjD,OAAwB;QAE/B,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAC5B,SAAS;QACT,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,aAAa,CAAA;QAC9C,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,CAAA;QAE3D,MAAM,gBAAgB,GAAuB,EAAE,CAAC,aAAa,CAAC,cAAM,CAAC,CAAA;QACrE,MAAM,cAAc,GAAqB,EAAE,CAAC,aAAa,CAAC,cAAI,CAAC,CAAA;QAC/D,MAAM,cAAc,GAAqB,EAAE,CAAC,aAAa,CAAC,cAAI,CAAC,CAAA;QAC/D,MAAM,mBAAmB,GAA0B,EAAE,CAAC,aAAa,CAAC,wBAAS,CAAC,CAAA;QAE9E,MAAM,SAAS,GAAW,IAAA,eAAO,EAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAE9C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC;YAC5C,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS;SACV,CAAC,CAAA;QAEF,QAAQ;QACR,MAAM,QAAQ,GAAW,MAAM,OAAO,CAAC,GAAG,CACxC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAU,EAAE,EAAE;YAC7B,IAAI,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;gBAC5B,MAAM,YAAY,GAAa,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;gBAC1E,IAAI,CAAC,UAAU,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC;oBACjD,EAAE,EAAE,IAAA,YAAE,EAAC,YAAY,CAAC;iBACrB,CAAC,CAAA;YACJ,CAAC;YAED,IAAI,CAAC,MAAM,GAAG,SAAS,CAAA;YACvB,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,CAAC,CAAC,CACH,CAAA;QAED,SAAS;QACT,IAAI,WAAW,GAAG,EAAE,CAAA;QACpB,IAAI,WAAW,GAAG,EAAE,CAAA;QACpB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAEzF,cAAc;QACd,MAAM,OAAO,CAAC,GAAG,CACf,WAAW,CAAC,GAAG,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE;YAC3B,IAAI,CAAC,OAAO,GAAG,CAAC,SAAS,CAAC,CAAA;YAC1B,IAAI,CAAC,QAAQ,GAAG,cAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YACrD,IAAI,CAAC,IAAI,GAAG,cAAI,CAAC,YAAY,EAAE,CAAA;YAC/B,IAAI,CAAC,iBAAiB,GAAG,IAAI,IAAI,EAAE,CAAA;YACnC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAA;YACtB,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;YAElD,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,CAAC,CAAC,CACH,CAAA;QAED,cAAc;QACd,MAAM,OAAO,CAAC,GAAG,CACf,WAAW,CAAC,GAAG,CAAC,KAAK,EAAC,UAAU,EAAC,EAAE;YACjC,MAAM,IAAI,GAAS,MAAM,cAAc,CAAC,OAAO,CAAC;gBAC9C,KAAK,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE;gBAClC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;aAChC,CAAC,CAAA;YAEF,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;YAC3C,IAAI,CAAC,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,eAAe,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAA;YAE5E,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,CAAC,CAAC,CACH,CAAA;QAED,uDAAuD;QACvD,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAA,eAAK,EAAC,WAAW,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAC3F,MAAM,IAAA,2CAAqB,EAAC,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QAElE,OAAO,MAAM,gBAAgB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/D,CAAC;CACF,CAAA;AA5GY,0DAAuB;AAI5B;IAHL,IAAA,wBAAS,EAAC,oCAAoC,CAAC;IAC/C,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAM,CAAC;IAEzB,mBAAA,IAAA,kBAAG,EAAC,aAAa,CAAC,CAAA;IAClB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAD2B,gDAAoB;;6DAmBtD;AAOK;IAHL,IAAA,wBAAS,EAAC,oCAAoC,CAAC;IAC/C,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAM,CAAC;IAEzB,mBAAA,IAAA,kBAAG,EAAC,eAAe,CAAC,CAAA;IACpB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAD+B,+CAAmB;;qEA2EzD;kCA3GU,uBAAuB;IADnC,IAAA,uBAAQ,GAAE;GACE,uBAAuB,CA4GnC;AAED,SAAS,eAAe,CAAC,SAAiB,EAAE,QAAgB;IAC1D,MAAM,aAAa,GAAa,SAAS,CAAC,GAAG,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAClE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AACzE,CAAC","sourcesContent":["import { Arg, Ctx, Directive, Mutation, Resolver } from 'type-graphql'\nimport { ILike, In, Repository } from 'typeorm'\n\nimport { Domain, getRepository } from '@things-factory/shell'\nimport { slugger } from '@things-factory/utils'\n\nimport { setPrimaryDomainOwner } from '../../utils/domain-ownership.js'\nimport { Privilege } from '../privilege/privilege.js'\nimport { Role } from '../role/role.js'\nimport { User } from '../user/user.js'\nimport { DomainGeneratorInput, DomainUserRoleInput } from './domain-generator-types.js'\n\n@Resolver()\nexport class DomainGeneratorMutation {\n  @Directive('@privilege(superUserGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Domain)\n  async domainRegister(\n    @Arg('domainInput') domainInput: DomainGeneratorInput,\n    @Ctx() context: ResolverContext\n  ): Promise<Domain> {\n    const { user } = context.state\n    const { name, description } = domainInput\n    const domainRepo: Repository<Domain> = getRepository(Domain)\n    const subdomain: string = slugger(name)\n\n    const domain: Domain = await domainRepo.findOneBy({ subdomain })\n    if (domain) {\n      throw new Error('domain is duplicated')\n    }\n\n    const newDomain: Domain = await domainRepo.save({ name, description, subdomain })\n\n    /* 대표 오너 컬럼과 `DomainOwner` 테이블을 함께 세팅한다 (컬럼만 쓰면 오너 목록에 나오지 않는다). */\n    await setPrimaryDomainOwner(newDomain, user.id, user)\n\n    return await domainRepo.findOneBy({ id: newDomain.id })\n  }\n\n  /* `domainRegister` beside it makes a domain and is super-user only. This makes a domain,\n     its roles and its users, and carried nothing at all. */\n  @Directive('@privilege(superUserGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Domain)\n  async domainUserRoleRegister(\n    @Arg('newDomainInfo') newDomainInfo: DomainUserRoleInput,\n    @Ctx() context: ResolverContext\n  ): Promise<Domain> {\n    const { tx } = context.state\n    // 도메인 생성\n    const { domain, users, roles } = newDomainInfo\n    const domainOwner = users.find(user => user.owner === true)\n\n    const domainRepository: Repository<Domain> = tx.getRepository(Domain)\n    const roleRepository: Repository<Role> = tx.getRepository(Role)\n    const userRepository: Repository<User> = tx.getRepository(User)\n    const privilegeRepository: Repository<Privilege> = tx.getRepository(Privilege)\n\n    const subdomain: string = slugger(domain.name)\n\n    const newDomain = await domainRepository.save({\n      name: domain.name,\n      description: domain.description,\n      subdomain\n    })\n\n    // 역할 생성\n    const newRoles: Role[] = await Promise.all(\n      roles.map(async (role: Role) => {\n        if (role.privileges?.length) {\n          const privilegeIds: string[] = role.privileges.map((p: Privilege) => p.id)\n          role.privileges = await privilegeRepository.findBy({\n            id: In(privilegeIds)\n          })\n        }\n\n        role.domain = newDomain\n        return await roleRepository.save(role)\n      })\n    )\n\n    // 사용자 생성\n    let inviteUsers = []\n    let createUsers = []\n    users.forEach(user => (user.isInvitee ? inviteUsers.push(user) : createUsers.push(user)))\n\n    // create user\n    await Promise.all(\n      createUsers.map(async user => {\n        user.domains = [newDomain]\n        user.password = User.encode(user.password, user.salt)\n        user.salt = User.generateSalt()\n        user.passwordUpdatedAt = new Date()\n        user.userType = 'user'\n        user.roles = filterUserRoles(user.roles, newRoles)\n\n        return await userRepository.save(user)\n      })\n    )\n\n    // invite user\n    await Promise.all(\n      inviteUsers.map(async inviteUser => {\n        const user: User = await userRepository.findOne({\n          where: { email: inviteUser.email },\n          relations: ['domains', 'roles']\n        })\n\n        user.domains = [...user.domains, newDomain]\n        user.roles = [...user.roles, ...filterUserRoles(inviteUser.roles, newRoles)]\n\n        return await userRepository.save(user)\n      })\n    )\n\n    // domain owner — 대표 오너 컬럼과 `DomainOwner` 테이블을 함께 세팅한다.\n    const { id } = await userRepository.findOne({ where: { email: ILike(domainOwner.email) } })\n    await setPrimaryDomainOwner(newDomain, id, context.state.user, tx)\n\n    return await domainRepository.findOneBy({ id: newDomain.id })\n  }\n}\n\nfunction filterUserRoles(userRoles: Role[], newRoles: Role[]): Role[] {\n  const userRoleNames: string[] = userRoles.map((r: Role) => r.name)\n  return newRoles.filter((r: Role) => userRoleNames.indexOf(r.name) >= 0)\n}\n"]}

package/dist-server/service/invitation/invitation-mutation.d.ts

@@ -1,18 +1,20 @@
-import { User } from '../../service/user/user.js';
 import { Invitation } from './invitation.js';
 export declare class InvitationMutation {
-    cancelInvitation(email: string, reference: string, type: string): Promise<boolean>;
-    sendInvitation(email: string, reference: string, type: string, context: ResolverContext): Promise<{
-        email: string;
-        reference: string;
-        type: string;
-        updater: User;
-        id: string;
-        token: string;
-        createdAt: Date;
-        updatedAt: Date;
-        creator: User;
-        creatorId: string;
-        updaterId: string;
-    } & Invitation>;
+    /**
+     * Invite somebody into this domain by email.
+     *
+     * ⚠ The domain is the caller's own, never an argument. It used to be `reference`, a string the
+     * caller passed, which is how a door that reads by `{ email, reference, type }` ends up
+     * answering about other tenants. The domain comes from the request now.
+     */
+    sendInvitation(email: string, context: ResolverContext, roleIds?: string[]): Promise<Invitation>;
+    /** Send the mail again for an invitation that is still open. A new token, a new expiry. */
+    resendInvitation(id: string, context: ResolverContext): Promise<boolean>;
+    /**
+     * Withdraw a pending invitation.
+     *
+     * The row stays and says it was cancelled. It used to be deleted by `{ email, reference, type }`
+     * — which erased the fact that anybody had been invited, and took an id from any tenant.
+     */
+    cancelInvitation(id: string, context: ResolverContext): Promise<boolean>;
 }

package/dist-server/service/invitation/invitation-mutation.js

@@ -2,81 +2,108 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.InvitationMutation = void 0;
 const tslib_1 = require("tslib");
-const typeorm_1 = require("typeorm");
 const type_graphql_1 = require("type-graphql");
-const graphql_scalars_1 = require("graphql-scalars");
+const typeorm_1 = require("typeorm");
 const shell_1 = require("@things-factory/shell");
-const user_js_1 = require("../../service/user/user.js");
 const invitation_js_1 = require("../../controllers/invitation.js");
+const invitation_state_js_1 = require("../../utils/invitation-state.js");
+const role_js_1 = require("../role/role.js");
 const invitation_js_2 = require("./invitation.js");
+/* Both doors carry what the user screens ask for — inviting somebody is changing who is here. */
+const ADMIN = '@privilege(category: "user", privilege: "mutation", domainOwnerGranted: true)';
 let InvitationMutation = class InvitationMutation {
-    async cancelInvitation(email, reference, type) {
-        const repository = (0, shell_1.getRepository)(invitation_js_2.Invitation);
-        await repository.delete({
-            email,
-            reference,
-            type
-        });
-        return true;
+    /**
+     * Invite somebody into this domain by email.
+     *
+     * ⚠ The domain is the caller's own, never an argument. It used to be `reference`, a string the
+     * caller passed, which is how a door that reads by `{ email, reference, type }` ends up
+     * answering about other tenants. The domain comes from the request now.
+     */
+    async sendInvitation(email, context, roleIds) {
+        const { domain, user, tx } = context.state;
+        /*
+         * Roles are looked up inside this domain and its parent — the same reach a role picker
+         * offers. An id from anywhere else simply does not match, so a role cannot be smuggled in.
+         */
+        const roles = roleIds?.length
+            ? await (0, shell_1.getRepository)(role_js_1.Role, tx).find({
+                where: {
+                    id: (0, typeorm_1.In)(roleIds),
+                    domain: { id: (0, typeorm_1.In)([domain.id, domain.parentId].filter(Boolean)) }
+                }
+            })
+            : [];
+        return await (0, invitation_js_1.inviteByEmail)({ email, domain, roles, user, context, tx });
     }
-    async sendInvitation(email, reference, type, context) {
-        const { user: updater } = context.state;
-        const invitationRepository = (0, shell_1.getRepository)(invitation_js_2.Invitation);
-        var user = await (0, shell_1.getRepository)(user_js_1.User).findOne({
-            where: {
-                email: (0, typeorm_1.ILike)(email),
-                status: user_js_1.UserStatus.ACTIVATED
-            }
+    /** Send the mail again for an invitation that is still open. A new token, a new expiry. */
+    async resendInvitation(id, context) {
+        const { domain, user, tx } = context.state;
+        const invitation = await (0, shell_1.getRepository)(invitation_js_2.Invitation, tx).findOne({
+            where: { id, domain: { id: domain.id } },
+            relations: ['domain']
         });
-        if (!user) {
-            throw new Error(`user not found: ${email}`);
+        if (!invitation || !(0, invitation_state_js_1.mayAccept)(invitation)) {
+            return false;
         }
-        await (0, invitation_js_1.sendInvitationEmail)({
-            invitation: {
-                email,
-                reference,
-                type
-            },
+        /*
+         * A fresh token. Re-mailing the old one would leave two live links for one invitation, and
+         * the older mail is the one more likely to have been forwarded.
+         */
+        const reissued = await (0, invitation_js_1.inviteByEmail)({
+            email: invitation.email,
+            domain: invitation.domain,
+            roles: invitation.roles,
             user,
-            context
-        });
-        const oldone = await invitationRepository.findOneBy({
-            email,
-            type,
-            reference
-        });
-        // update or create
-        return await invitationRepository.save({
-            creator: updater,
-            ...oldone, // take only id from oldone for update
-            email,
-            reference,
-            type,
-            updater: updater
+            context,
+            tx
         });
+        return !!reissued;
+    }
+    /**
+     * Withdraw a pending invitation.
+     *
+     * The row stays and says it was cancelled. It used to be deleted by `{ email, reference, type }`
+     * — which erased the fact that anybody had been invited, and took an id from any tenant.
+     */
+    async cancelInvitation(id, context) {
+        const { domain, user, tx } = context.state;
+        return await (0, invitation_js_1.cancelInvitation)(id, domain, user, tx);
     }
 };
 exports.InvitationMutation = InvitationMutation;
 tslib_1.__decorate([
-    (0, type_graphql_1.Mutation)(returns => Boolean),
-    tslib_1.__param(0, (0, type_graphql_1.Arg)('email', type => graphql_scalars_1.GraphQLEmailAddress)),
-    tslib_1.__param(1, (0, type_graphql_1.Arg)('reference')),
-    tslib_1.__param(2, (0, type_graphql_1.Arg)('type')),
+    (0, type_graphql_1.Directive)(ADMIN),
+    (0, type_graphql_1.Directive)('@transaction'),
+    (0, type_graphql_1.Mutation)(returns => invitation_js_2.Invitation, { description: "To invite someone into this domain by email" }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('email')),
+    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
+    tslib_1.__param(2, (0, type_graphql_1.Arg)('roleIds', type => [String], { nullable: true })),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [String, String, String]),
+    tslib_1.__metadata("design:paramtypes", [String, Object, Array]),
     tslib_1.__metadata("design:returntype", Promise)
-], InvitationMutation.prototype, "cancelInvitation", null);
+], InvitationMutation.prototype, "sendInvitation", null);
 tslib_1.__decorate([
-    (0, type_graphql_1.Mutation)(returns => invitation_js_2.Invitation),
-    tslib_1.__param(0, (0, type_graphql_1.Arg)('email', type => graphql_scalars_1.GraphQLEmailAddress)),
-    tslib_1.__param(1, (0, type_graphql_1.Arg)('reference')),
-    tslib_1.__param(2, (0, type_graphql_1.Arg)('type')),
-    tslib_1.__param(3, (0, type_graphql_1.Ctx)()),
+    (0, type_graphql_1.Directive)(ADMIN),
+    (0, type_graphql_1.Directive)('@transaction'),
+    (0, type_graphql_1.Mutation)(returns => Boolean, { description: 'To send a pending invitation again' }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('id')),
+    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [String, String, String, Object]),
+    tslib_1.__metadata("design:paramtypes", [String, Object]),
     tslib_1.__metadata("design:returntype", Promise)
-], InvitationMutation.prototype, "sendInvitation", null);
+], InvitationMutation.prototype, "resendInvitation", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)(ADMIN),
+    (0, type_graphql_1.Directive)('@transaction'),
+    (0, type_graphql_1.Mutation)(returns => Boolean, { description: 'To withdraw a pending invitation' }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('id')),
+    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], InvitationMutation.prototype, "cancelInvitation", null);
 exports.InvitationMutation = InvitationMutation = tslib_1.__decorate([
-    (0, type_graphql_1.Resolver)(invitation_js_2.Invitation)
+    (0, type_graphql_1.Resolver)(invitation_js_2.Invitation),
+    (0, type_graphql_1.UseMiddleware)(shell_1.SpeakRefusals)
 ], InvitationMutation);
 //# sourceMappingURL=invitation-mutation.js.map

package/dist-server/service/invitation/invitation-mutation.js.map

@@ -1 +1 @@
-{"version":3,"file":"invitation-mutation.js","sourceRoot":"","sources":["../../../server/service/invitation/invitation-mutation.ts"],"names":[],"mappings":";;;;AAAA,qCAA+B;AAE/B,+CAA2D;AAC3D,qDAAqD;AAErD,iDAAqD;AAErD,wDAA6D;AAC7D,mEAAqE;AACrE,mDAA4C;AAGrC,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAEvB,AAAN,KAAK,CAAC,gBAAgB,CACuB,KAAa,EACtC,SAAiB,EACtB,IAAY;QAEzB,MAAM,UAAU,GAAG,IAAA,qBAAa,EAAC,0BAAU,CAAC,CAAA;QAE5C,MAAM,UAAU,CAAC,MAAM,CAAC;YACtB,KAAK;YACL,SAAS;YACT,IAAI;SACL,CAAC,CAAA;QAEF,OAAO,IAAI,CAAA;IACb,CAAC;IAGK,AAAN,KAAK,CAAC,cAAc,CACyB,KAAa,EACtC,SAAiB,EACtB,IAAY,EAClB,OAAwB;QAE/B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACvC,MAAM,oBAAoB,GAAG,IAAA,qBAAa,EAAC,0BAAU,CAAC,CAAA;QAEtD,IAAI,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAC3C,KAAK,EAAE;gBACL,KAAK,EAAE,IAAA,eAAK,EAAC,KAAK,CAAC;gBACnB,MAAM,EAAE,oBAAU,CAAC,SAAS;aAC7B;SACF,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAA;QAC7C,CAAC;QAED,MAAM,IAAA,mCAAmB,EAAC;YACxB,UAAU,EAAE;gBACV,KAAK;gBACL,SAAS;gBACT,IAAI;aACL;YACD,IAAI;YACJ,OAAO;SACR,CAAC,CAAA;QAEF,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC;YAClD,KAAK;YACL,IAAI;YACJ,SAAS;SACV,CAAC,CAAA;QAEF,mBAAmB;QACnB,OAAO,MAAM,oBAAoB,CAAC,IAAI,CAAC;YACrC,OAAO,EAAE,OAAO;YAChB,GAAG,MAAM,EAAE,sCAAsC;YACjD,KAAK;YACL,SAAS;YACT,IAAI;YACJ,OAAO,EAAE,OAAO;SACjB,CAAC,CAAA;IACJ,CAAC;CACF,CAAA;AAjEY,gDAAkB;AAEvB;IADL,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC;IAE1B,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,qCAAmB,CAAC,CAAA;IACzC,mBAAA,IAAA,kBAAG,EAAC,WAAW,CAAC,CAAA;IAChB,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;;;;0DAWb;AAGK;IADL,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,0BAAU,CAAC;IAE7B,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,qCAAmB,CAAC,CAAA;IACzC,mBAAA,IAAA,kBAAG,EAAC,WAAW,CAAC,CAAA;IAChB,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IACX,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;wDAyCP;6BAhEU,kBAAkB;IAD9B,IAAA,uBAAQ,EAAC,0BAAU,CAAC;GACR,kBAAkB,CAiE9B","sourcesContent":["import { ILike } from 'typeorm'\n\nimport { Arg, Ctx, Mutation, Resolver } from 'type-graphql'\nimport { GraphQLEmailAddress } from 'graphql-scalars'\n\nimport { getRepository } from '@things-factory/shell'\n\nimport { User, UserStatus } from '../../service/user/user.js'\nimport { sendInvitationEmail } from '../../controllers/invitation.js'\nimport { Invitation } from './invitation.js'\n\n@Resolver(Invitation)\nexport class InvitationMutation {\n  @Mutation(returns => Boolean)\n  async cancelInvitation(\n    @Arg('email', type => GraphQLEmailAddress) email: string,\n    @Arg('reference') reference: string,\n    @Arg('type') type: string\n  ) {\n    const repository = getRepository(Invitation)\n\n    await repository.delete({\n      email,\n      reference,\n      type\n    })\n\n    return true\n  }\n\n  @Mutation(returns => Invitation)\n  async sendInvitation(\n    @Arg('email', type => GraphQLEmailAddress) email: string,\n    @Arg('reference') reference: string,\n    @Arg('type') type: string,\n    @Ctx() context: ResolverContext\n  ) {\n    const { user: updater } = context.state\n    const invitationRepository = getRepository(Invitation)\n\n    var user = await getRepository(User).findOne({\n      where: {\n        email: ILike(email),\n        status: UserStatus.ACTIVATED\n      }\n    })\n\n    if (!user) {\n      throw new Error(`user not found: ${email}`)\n    }\n\n    await sendInvitationEmail({\n      invitation: {\n        email,\n        reference,\n        type\n      },\n      user,\n      context\n    })\n\n    const oldone = await invitationRepository.findOneBy({\n      email,\n      type,\n      reference\n    })\n\n    // update or create\n    return await invitationRepository.save({\n      creator: updater,\n      ...oldone, // take only id from oldone for update\n      email,\n      reference,\n      type,\n      updater: updater\n    })\n  }\n}\n"]}
+{"version":3,"file":"invitation-mutation.js","sourceRoot":"","sources":["../../../server/service/invitation/invitation-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAqF;AACrF,qCAA4B;AAE5B,iDAAoE;AAEpE,mEAAiG;AACjG,yEAA6E;AAC7E,6CAAsC;AACtC,mDAA4C;AAE5C,iGAAiG;AACjG,MAAM,KAAK,GAAG,+EAA+E,CAAA;AAItF,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAC7B;;;;;;OAMG;IAIG,AAAN,KAAK,CAAC,cAAc,CACJ,KAAa,EACpB,OAAwB,EACuB,OAAkB;QAExE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C;;;WAGG;QACH,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM;YAC3B,CAAC,CAAC,MAAM,IAAA,qBAAa,EAAC,cAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC;gBACjC,KAAK,EAAE;oBACL,EAAE,EAAE,IAAA,YAAE,EAAC,OAAO,CAAC;oBACf,MAAM,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE;iBACjE;aACF,CAAC;YACJ,CAAC,CAAC,EAAE,CAAA;QAEN,OAAO,MAAM,IAAA,6BAAa,EAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAA;IACzE,CAAC;IAED,2FAA2F;IAIrF,AAAN,KAAK,CAAC,gBAAgB,CAAY,EAAU,EAAS,OAAwB;QAC3E,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,MAAM,UAAU,GAAG,MAAM,IAAA,qBAAa,EAAC,0BAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;YAC7D,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE;YACxC,SAAS,EAAE,CAAC,QAAQ,CAAC;SACtB,CAAC,CAAA;QAEF,IAAI,CAAC,UAAU,IAAI,CAAC,IAAA,+BAAS,EAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAA;QACd,CAAC;QAED;;;WAGG;QACH,MAAM,QAAQ,GAAG,MAAM,IAAA,6BAAa,EAAC;YACnC,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,IAAI;YACJ,OAAO;YACP,EAAE;SACH,CAAC,CAAA;QAEF,OAAO,CAAC,CAAC,QAAQ,CAAA;IACnB,CAAC;IAED;;;;;OAKG;IAIG,AAAN,KAAK,CAAC,gBAAgB,CAAY,EAAU,EAAS,OAAwB;QAC3E,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,OAAO,MAAM,IAAA,gCAAgB,EAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAA;IACrD,CAAC;CACF,CAAA;AAhFY,gDAAkB;AAWvB;IAHL,IAAA,wBAAS,EAAC,KAAK,CAAC;IAChB,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,0BAAU,EAAE,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;IAE7F,mBAAA,IAAA,kBAAG,EAAC,OAAO,CAAC,CAAA;IACZ,mBAAA,IAAA,kBAAG,GAAE,CAAA;IACL,mBAAA,IAAA,kBAAG,EAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;;;;wDAkBtD;AAMK;IAHL,IAAA,wBAAS,EAAC,KAAK,CAAC;IAChB,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IAC5D,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0DA0BnD;AAWK;IAHL,IAAA,wBAAS,EAAC,KAAK,CAAC;IAChB,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAC1D,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0DAInD;6BA/EU,kBAAkB;IAF9B,IAAA,uBAAQ,EAAC,0BAAU,CAAC;IACpB,IAAA,4BAAa,EAAC,qBAAa,CAAC;GAChB,kBAAkB,CAgF9B","sourcesContent":["import { Arg, Ctx, Directive, Mutation, Resolver, UseMiddleware } from 'type-graphql'\nimport { In } from 'typeorm'\n\nimport { getRepository, SpeakRefusals } from '@things-factory/shell'\n\nimport { cancelInvitation, inviteByEmail, mailInvitation } from '../../controllers/invitation.js'\nimport { InvitationStatus, mayAccept } from '../../utils/invitation-state.js'\nimport { Role } from '../role/role.js'\nimport { Invitation } from './invitation.js'\n\n/* Both doors carry what the user screens ask for — inviting somebody is changing who is here. */\nconst ADMIN = '@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)'\n\n@Resolver(Invitation)\n@UseMiddleware(SpeakRefusals)\nexport class InvitationMutation {\n  /**\n   * Invite somebody into this domain by email.\n   *\n   * ⚠ The domain is the caller's own, never an argument. It used to be `reference`, a string the\n   * caller passed, which is how a door that reads by `{ email, reference, type }` ends up\n   * answering about other tenants. The domain comes from the request now.\n   */\n  @Directive(ADMIN)\n  @Directive('@transaction')\n  @Mutation(returns => Invitation, { description: \"To invite someone into this domain by email\" })\n  async sendInvitation(\n    @Arg('email') email: string,\n    @Ctx() context: ResolverContext,\n    @Arg('roleIds', type => [String], { nullable: true }) roleIds?: string[]\n  ): Promise<Invitation> {\n    const { domain, user, tx } = context.state\n\n    /*\n     * Roles are looked up inside this domain and its parent — the same reach a role picker\n     * offers. An id from anywhere else simply does not match, so a role cannot be smuggled in.\n     */\n    const roles = roleIds?.length\n      ? await getRepository(Role, tx).find({\n          where: {\n            id: In(roleIds),\n            domain: { id: In([domain.id, domain.parentId].filter(Boolean)) }\n          }\n        })\n      : []\n\n    return await inviteByEmail({ email, domain, roles, user, context, tx })\n  }\n\n  /** Send the mail again for an invitation that is still open. A new token, a new expiry. */\n  @Directive(ADMIN)\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, { description: 'To send a pending invitation again' })\n  async resendInvitation(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<boolean> {\n    const { domain, user, tx } = context.state\n\n    const invitation = await getRepository(Invitation, tx).findOne({\n      where: { id, domain: { id: domain.id } },\n      relations: ['domain']\n    })\n\n    if (!invitation || !mayAccept(invitation)) {\n      return false\n    }\n\n    /*\n     * A fresh token. Re-mailing the old one would leave two live links for one invitation, and\n     * the older mail is the one more likely to have been forwarded.\n     */\n    const reissued = await inviteByEmail({\n      email: invitation.email,\n      domain: invitation.domain,\n      roles: invitation.roles,\n      user,\n      context,\n      tx\n    })\n\n    return !!reissued\n  }\n\n  /**\n   * Withdraw a pending invitation.\n   *\n   * The row stays and says it was cancelled. It used to be deleted by `{ email, reference, type }`\n   * — which erased the fact that anybody had been invited, and took an id from any tenant.\n   */\n  @Directive(ADMIN)\n  @Directive('@transaction')\n  @Mutation(returns => Boolean, { description: 'To withdraw a pending invitation' })\n  async cancelInvitation(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<boolean> {\n    const { domain, user, tx } = context.state\n\n    return await cancelInvitation(id, domain, user, tx)\n  }\n}\n"]}

package/dist-server/service/invitation/invitation-query.d.ts

@@ -1,8 +1,23 @@
+import { ListParam } from '@things-factory/shell';
 import { Invitation } from './invitation.js';
+import { InvitationList } from './invitation-types.js';
 export declare class InvitationQuery {
-    invitation(email: string, reference: string, type: string): Promise<Invitation>;
-    invitations(reference: string, type: string): Promise<{
-        items: Invitation[];
-        total: number;
-    }>;
+    invitation(id: string, context: ResolverContext): Promise<Invitation>;
+    /**
+     * Who was invited to this domain, by whom, when, and whether they came in.
+     *
+     * ⚠ This is why the rows are kept. Accepting used to delete the row, so the moment somebody
+     * joined, the fact that they had been invited stopped existing — there was nothing to put on a
+     * screen, so no screen was built, so nothing called any of this.
+     */
+    invitations(params: ListParam, context: ResolverContext): Promise<InvitationList>;
+    /**
+     * What state this invitation is in, read against the clock.
+     *
+     * ⚠ Not the stored column on its own. A pending row whose expiry has passed **is** expired
+     * whether or not anything has been round to write that down — otherwise the list would show a
+     * live invitation for a token that no longer opens anything, which is the more dangerous of
+     * the two ways to be wrong here.
+     */
+    state(invitation: Invitation): Promise<string>;
 }

package/dist-server/service/invitation/invitation-query.js

@@ -2,45 +2,86 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.InvitationQuery = void 0;
 const tslib_1 = require("tslib");
-const graphql_scalars_1 = require("graphql-scalars");
 const type_graphql_1 = require("type-graphql");
 const shell_1 = require("@things-factory/shell");
+const invitation_state_js_1 = require("../../utils/invitation-state.js");
 const invitation_js_1 = require("./invitation.js");
 const invitation_types_js_1 = require("./invitation-types.js");
+/*
+ * ── What changed here, and why ──────────────────────────────────────────────
+ * These read by `{ email, reference, type }` and took no domain at all — `invitations` did not
+ * even take a context, so there was nothing to compare a caller against. An id from one tenant
+ * and an id from another were the same kind of argument.
+ *
+ * They are the invitation **list** now: this domain's invitations, scoped the way every other
+ * list in this package is scoped. `reference` is not read; the domain is a column.
+ */
+const GATE = '@privilege(category: "user", privilege: "query", domainOwnerGranted: true, superUserGranted: true)';
 let InvitationQuery = class InvitationQuery {
-    async invitation(email, reference, type) {
-        return await (0, shell_1.getRepository)(invitation_js_1.Invitation).findOneBy({
-            email,
-            reference,
-            type
+    async invitation(id, context) {
+        const { domain } = context.state;
+        return await (0, shell_1.getRepository)(invitation_js_1.Invitation).findOne({
+            where: { id, domain: { id: domain.id } },
+            relations: ['domain', 'roles']
         });
     }
-    async invitations(reference, type) {
-        const [items, total] = await (0, shell_1.getRepository)(invitation_js_1.Invitation).findAndCountBy({
-            reference,
-            type
+    /**
+     * Who was invited to this domain, by whom, when, and whether they came in.
+     *
+     * ⚠ This is why the rows are kept. Accepting used to delete the row, so the moment somebody
+     * joined, the fact that they had been invited stopped existing — there was nothing to put on a
+     * screen, so no screen was built, so nothing called any of this.
+     */
+    async invitations(params, context) {
+        const { domain } = context.state;
+        const queryBuilder = (0, shell_1.getQueryBuilderFromListParams)({
+            domain,
+            params,
+            repository: (0, shell_1.getRepository)(invitation_js_1.Invitation),
+            alias: 'invitation',
+            searchables: ['email']
         });
+        const [items, total] = await queryBuilder.getManyAndCount();
         return { items, total };
     }
+    /**
+     * What state this invitation is in, read against the clock.
+     *
+     * ⚠ Not the stored column on its own. A pending row whose expiry has passed **is** expired
+     * whether or not anything has been round to write that down — otherwise the list would show a
+     * live invitation for a token that no longer opens anything, which is the more dangerous of
+     * the two ways to be wrong here.
+     */
+    async state(invitation) {
+        return (0, invitation_state_js_1.invitationState)(invitation);
+    }
 };
 exports.InvitationQuery = InvitationQuery;
 tslib_1.__decorate([
-    (0, type_graphql_1.Query)(returns => invitation_js_1.Invitation),
-    tslib_1.__param(0, (0, type_graphql_1.Arg)('email', type => graphql_scalars_1.GraphQLEmailAddress)),
-    tslib_1.__param(1, (0, type_graphql_1.Arg)('reference')),
-    tslib_1.__param(2, (0, type_graphql_1.Arg)('type')),
+    (0, type_graphql_1.Directive)(GATE),
+    (0, type_graphql_1.Query)(returns => invitation_js_1.Invitation, { nullable: true, description: 'To fetch an invitation of this domain' }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('id')),
+    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [String, String, String]),
+    tslib_1.__metadata("design:paramtypes", [String, Object]),
     tslib_1.__metadata("design:returntype", Promise)
 ], InvitationQuery.prototype, "invitation", null);
 tslib_1.__decorate([
-    (0, type_graphql_1.Query)(returns => invitation_types_js_1.InvitationList),
-    tslib_1.__param(0, (0, type_graphql_1.Arg)('reference')),
-    tslib_1.__param(1, (0, type_graphql_1.Arg)('type')),
+    (0, type_graphql_1.Directive)(GATE),
+    (0, type_graphql_1.Query)(returns => invitation_types_js_1.InvitationList, { description: "To fetch this domain's invitations" }),
+    tslib_1.__param(0, (0, type_graphql_1.Args)(type => shell_1.ListParam)),
+    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
     tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [String, String]),
+    tslib_1.__metadata("design:paramtypes", [shell_1.ListParam, Object]),
     tslib_1.__metadata("design:returntype", Promise)
 ], InvitationQuery.prototype, "invitations", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.FieldResolver)(type => String),
+    tslib_1.__param(0, (0, type_graphql_1.Root)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [invitation_js_1.Invitation]),
+    tslib_1.__metadata("design:returntype", Promise)
+], InvitationQuery.prototype, "state", null);
 exports.InvitationQuery = InvitationQuery = tslib_1.__decorate([
     (0, type_graphql_1.Resolver)(invitation_js_1.Invitation)
 ], InvitationQuery);

package/dist-server/service/invitation/invitation-query.js.map

@@ -1 +1 @@
-{"version":3,"file":"invitation-query.js","sourceRoot":"","sources":["../../../server/service/invitation/invitation-query.ts"],"names":[],"mappings":";;;;AAAA,qDAAqD;AACrD,+CAAmD;AAEnD,iDAAqD;AAErD,mDAA4C;AAC5C,+DAAsD;AAG/C,IAAM,eAAe,GAArB,MAAM,eAAe;IAEpB,AAAN,KAAK,CAAC,UAAU,CAC6B,KAAa,EACtC,SAAiB,EACtB,IAAY;QAEzB,OAAO,MAAM,IAAA,qBAAa,EAAC,0BAAU,CAAC,CAAC,SAAS,CAAC;YAC/C,KAAK;YACL,SAAS;YACT,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAmB,SAAiB,EAAe,IAAY;QAC9E,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,IAAA,qBAAa,EAAC,0BAAU,CAAC,CAAC,cAAc,CAAC;YACpE,SAAS;YACT,IAAI;SACL,CAAC,CAAA;QAEF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;CACF,CAAA;AAvBY,0CAAe;AAEpB;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,0BAAU,CAAC;IAE1B,mBAAA,IAAA,kBAAG,EAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,qCAAmB,CAAC,CAAA;IACzC,mBAAA,IAAA,kBAAG,EAAC,WAAW,CAAC,CAAA;IAChB,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;;;;iDAOb;AAGK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,oCAAc,CAAC;IACd,mBAAA,IAAA,kBAAG,EAAC,WAAW,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;;;;kDAOlE;0BAtBU,eAAe;IAD3B,IAAA,uBAAQ,EAAC,0BAAU,CAAC;GACR,eAAe,CAuB3B","sourcesContent":["import { GraphQLEmailAddress } from 'graphql-scalars'\nimport { Arg, Query, Resolver } from 'type-graphql'\n\nimport { getRepository } from '@things-factory/shell'\n\nimport { Invitation } from './invitation.js'\nimport { InvitationList } from './invitation-types.js'\n\n@Resolver(Invitation)\nexport class InvitationQuery {\n  @Query(returns => Invitation)\n  async invitation(\n    @Arg('email', type => GraphQLEmailAddress) email: string,\n    @Arg('reference') reference: string,\n    @Arg('type') type: string\n  ) {\n    return await getRepository(Invitation).findOneBy({\n      email,\n      reference,\n      type\n    })\n  }\n\n  @Query(returns => InvitationList)\n  async invitations(@Arg('reference') reference: string, @Arg('type') type: string) {\n    const [items, total] = await getRepository(Invitation).findAndCountBy({\n      reference,\n      type\n    })\n\n    return { items, total }\n  }\n}\n"]}
+{"version":3,"file":"invitation-query.js","sourceRoot":"","sources":["../../../server/service/invitation/invitation-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8F;AAE9F,iDAA+F;AAE/F,yEAAiE;AACjE,mDAA4C;AAC5C,+DAAsD;AAEtD;;;;;;;;GAQG;AACH,MAAM,IAAI,GAAG,oGAAoG,CAAA;AAG1G,IAAM,eAAe,GAArB,MAAM,eAAe;IAGpB,AAAN,KAAK,CAAC,UAAU,CAAY,EAAU,EAAS,OAAwB;QACrE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,OAAO,MAAM,IAAA,qBAAa,EAAC,0BAAU,CAAC,CAAC,OAAO,CAAC;YAC7C,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE;YACxC,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;SAC/B,CAAC,CAAA;IACJ,CAAC;IAED;;;;;;OAMG;IAGG,AAAN,KAAK,CAAC,WAAW,CACU,MAAiB,EACnC,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;YACjD,MAAM;YACN,MAAM;YACN,UAAU,EAAE,IAAA,qBAAa,EAAC,0BAAU,CAAC;YACrC,KAAK,EAAE,YAAY;YACnB,WAAW,EAAE,CAAC,OAAO,CAAC;SACvB,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;QAE3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAED;;;;;;;OAOG;IAEG,AAAN,KAAK,CAAC,KAAK,CAAS,UAAsB;QACxC,OAAO,IAAA,qCAAe,EAAC,UAAU,CAAC,CAAA;IACpC,CAAC;CACF,CAAA;AApDY,0CAAe;AAGpB;IAFL,IAAA,wBAAS,EAAC,IAAI,CAAC;IACf,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,0BAAU,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC;IACrF,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;iDAO7C;AAWK;IAFL,IAAA,wBAAS,EAAC,IAAI,CAAC;IACf,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,oCAAc,EAAE,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;IAErF,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IACvB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAD2B,iBAAS;;kDAgB3C;AAWK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC;IACjB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAa,0BAAU;;4CAEzC;0BAnDU,eAAe;IAD3B,IAAA,uBAAQ,EAAC,0BAAU,CAAC;GACR,eAAe,CAoD3B","sourcesContent":["import { Arg, Args, Ctx, Directive, FieldResolver, Query, Resolver, Root } from 'type-graphql'\n\nimport { getQueryBuilderFromListParams, getRepository, ListParam } from '@things-factory/shell'\n\nimport { invitationState } from '../../utils/invitation-state.js'\nimport { Invitation } from './invitation.js'\nimport { InvitationList } from './invitation-types.js'\n\n/*\n * ── What changed here, and why ──────────────────────────────────────────────\n * These read by `{ email, reference, type }` and took no domain at all — `invitations` did not\n * even take a context, so there was nothing to compare a caller against. An id from one tenant\n * and an id from another were the same kind of argument.\n *\n * They are the invitation **list** now: this domain's invitations, scoped the way every other\n * list in this package is scoped. `reference` is not read; the domain is a column.\n */\nconst GATE = '@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)'\n\n@Resolver(Invitation)\nexport class InvitationQuery {\n  @Directive(GATE)\n  @Query(returns => Invitation, { nullable: true, description: 'To fetch an invitation of this domain' })\n  async invitation(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<Invitation> {\n    const { domain } = context.state\n\n    return await getRepository(Invitation).findOne({\n      where: { id, domain: { id: domain.id } },\n      relations: ['domain', 'roles']\n    })\n  }\n\n  /**\n   * Who was invited to this domain, by whom, when, and whether they came in.\n   *\n   * ⚠ This is why the rows are kept. Accepting used to delete the row, so the moment somebody\n   * joined, the fact that they had been invited stopped existing — there was nothing to put on a\n   * screen, so no screen was built, so nothing called any of this.\n   */\n  @Directive(GATE)\n  @Query(returns => InvitationList, { description: \"To fetch this domain's invitations\" })\n  async invitations(\n    @Args(type => ListParam) params: ListParam,\n    @Ctx() context: ResolverContext\n  ): Promise<InvitationList> {\n    const { domain } = context.state\n\n    const queryBuilder = getQueryBuilderFromListParams({\n      domain,\n      params,\n      repository: getRepository(Invitation),\n      alias: 'invitation',\n      searchables: ['email']\n    })\n\n    const [items, total] = await queryBuilder.getManyAndCount()\n\n    return { items, total }\n  }\n\n  /**\n   * What state this invitation is in, read against the clock.\n   *\n   * ⚠ Not the stored column on its own. A pending row whose expiry has passed **is** expired\n   * whether or not anything has been round to write that down — otherwise the list would show a\n   * live invitation for a token that no longer opens anything, which is the more dangerous of\n   * the two ways to be wrong here.\n   */\n  @FieldResolver(type => String)\n  async state(@Root() invitation: Invitation): Promise<string> {\n    return invitationState(invitation)\n  }\n}\n"]}

package/dist-server/service/invitation/invitation.d.ts

@@ -1,10 +1,22 @@
+import { Domain } from '@things-factory/shell';
+import { Role } from '../role/role.js';
 import { User } from '../user/user.js';
+import { InvitationStatus } from '../../utils/invitation-state.js';
 export declare class Invitation {
     readonly id: string;
     email: string;
-    reference: string;
-    type: string;
+    domain: Domain;
+    domainId: string;
+    /** ⚠ Superseded by `domain`. Kept nullable for rows written before that column existed. */
+    reference?: string;
+    /** ⚠ Superseded by `domain`. Kept nullable for rows written before that column existed. */
+    type?: string;
+    roles?: Role[];
+    status: InvitationStatus;
+    expiresAt?: Date;
+    acceptedAt?: Date;
     token: string;
+    state?: string;
     createdAt: Date;
     updatedAt: Date;
     creator: User;