@things-factory/auth-base 10.1.6 → 10.1.7

package/dist-server/service/role/role-query.js

@@ -4,7 +4,6 @@ exports.RoleQuery = void 0;
 const tslib_1 = require("tslib");
 const typeorm_1 = require("typeorm");
 const type_graphql_1 = require("type-graphql");
-const env_1 = require("@things-factory/env");
 const shell_1 = require("@things-factory/shell");
 const privilege_js_1 = require("../privilege/privilege.js");
 const user_js_1 = require("../user/user.js");
@@ -68,28 +67,31 @@ let RoleQuery = class RoleQuery {
             assigned: assigned.has(id)
         }));
     }
+    /**
+     * 한 사람의 역할 — **부여할 수 있는 전체와 이 사람이 가진 것을 한 번에.**
+     *
+     * `rolePrivileges` 와 같은 모양이고, **같은 결함을 갖고 있었다.** 한 자리를 고쳤으면 두 번째
+     * 자리도 재야 한다는 것이 이 파일에서 그대로 났다.
+     *
+     *  ① `UR.users_id` 자리에 `userId` 를 문자열로 이어 붙였다. `user:query` 를 가진
+     *     사람이 임의의 SQL 을 넣을 수 있다.
+     *  ② `CASE WHEN … THEN true` 는 방언이다 — MSSQL 에 boolean 리터럴이 없다(DB 5종 지원).
+     *  ③ `FROM roles` — **도메인을 안 봤다.** 남의 도메인 역할까지 전부 돌려줬다.
+     *
+     * ③ 을 고치면서 범위를 `role`·`rolePrivileges` 와 같게 뒀다 — 내 도메인과 부모 1단.
+     * 그것이 실제로 부여할 수 있는 범위다.
+     *
+     * 지금 이 질의를 부르는 화면은 없다(옛 `user-role-editor` 는 `user(email:)` 로 읽었다).
+     * 그래서 범위를 좁히는 것이 깨뜨릴 소비처가 없다.
+     */
     async userRoles(userId, context) {
-        const userRoles = await (0, shell_1.getRepository)(role_js_1.Role).query(`
-        SELECT
-          id,
-          name,
-          description,
-          CASE WHEN id IN (
-            SELECT
-              R.id
-            FROM
-              roles R JOIN users_roles UR
-            ON
-              R.id = UR.roles_id
-            WHERE
-              UR.users_id = '${userId}'
-          ) THEN true
-            ELSE false
-          END AS assigned
-        FROM
-          roles
-      `);
-        return userRoles;
+        const { domain } = context.state;
+        const user = await (0, shell_1.getRepository)(user_js_1.User).findOne({ where: { id: userId }, relations: ['roles'] });
+        const assigned = new Set((user?.roles || []).map(role => role.id));
+        const roles = await (0, shell_1.getRepository)(role_js_1.Role).find({
+            where: { domain: { id: (0, typeorm_1.In)([domain.id, domain.parentId].filter(Boolean)) } }
+        });
+        return roles.map(({ id, name, description }) => ({ id, name, description, assigned: assigned.has(id) }));
     }
     async myRoles(context) {
         const { user, domain } = context.state;
@@ -103,10 +105,19 @@ let RoleQuery = class RoleQuery {
             .getMany();
         return roles;
     }
-    async checkRolePreset(context) {
-        const rolePreset = env_1.config.get('rolePreset') || [];
-        return rolePreset;
-    }
+    /*
+     * `checkRolePreset` stood here and has been removed. It read `config.get('rolePreset')`
+     * and returned it unchanged, declared as `[Role]`.
+     *
+     * Nothing set that config key and nothing called the query, across every repository on
+     * this machine — and it carried no `@privilege`, so any signed-in user could read
+     * whatever an installation later put there. Empty today, quietly public the day someone
+     * fills it. Role templates (`service/role-template/`) do what this was reaching for, as
+     * a boot registry rather than a config blob.
+     *
+     * auth-base ships to npm, so consumers outside this repository cannot be counted. The
+     * removal is recorded in the changelog — that is the only channel they have.
+     */
     async domain(role) {
         return await (0, shell_1.getRepository)(shell_1.Domain).findOneBy({ id: role.domainId });
     }
@@ -121,6 +132,38 @@ let RoleQuery = class RoleQuery {
         });
         return roleData?.users || [];
     }
+    /**
+     * 이 역할이 여는 권한이 **몇 개인가.**
+     *
+     * ── 왜 수만 따로 있나 ──────────────────────────────────────────────────────
+     * 목록 화면이 「이 역할이 무엇을 여나」를 말해야 하는데, 그것을 위해 권한 **행**을 받고 있었다.
+     *
+     * ```
+     * [확인함] roles(limit:20) 권한 포함  5,731 bytes · 69ms
+     * [확인함] roles(limit:20) 권한 없이    518 bytes ·  7ms      → 11.1배 · 10배
+     * ```
+     *
+     * 역할 2개에 권한 행 60개를 받아서 화면에는 잘린 코드 용어 셋을 그렸다. 역할 40개 ×
+     * 권한 100개면 한 페이지에 4,000행이다. **`privileges` 필드 리졸버가 역할마다 한 번씩 도는
+     * 것**까지 함께 없어지는 것이 더 큰 쪽이다.
+     *
+     * 그래서 목록은 이 칸을 쓴다 — 행을 안 받고 수를 받는다. 권한을 실제로 고치는 화면은
+     * `rolePrivileges(roleId:)` 로 따로 읽는다(전체 목록 + 이 역할이 가진 것을 한 번에).
+     *
+     * ── 왜 관계를 세지 않고 질의로 세나 ────────────────────────────────────────
+     * `relation(...).loadMany()` 는 행을 다 읽고 길이를 재는 것이라 여기서 고치려는 것을 그대로
+     * 다시 한다. `getCount()` 는 DB 가 센다.
+     *
+     * 조인 테이블의 주인은 `Privilege` 쪽이지만(`privilege.ts:72` 의 `@JoinTable`), 양쪽이 관계를
+     * 선언하고 있으므로 어느 쪽에서 조인해도 같다.
+     */
+    async privilegeCount(role) {
+        return await (0, shell_1.getRepository)(privilege_js_1.Privilege)
+            .createQueryBuilder('PRIVILEGE')
+            .innerJoin('PRIVILEGE.roles', 'ROLE')
+            .where('ROLE.id = :id', { id: role.id })
+            .getCount();
+    }
     async privileges(role) {
         return (await (0, shell_1.getRepository)(role_js_1.Role).findOne({
             where: { id: role.id },
@@ -178,13 +221,6 @@ tslib_1.__decorate([
     tslib_1.__metadata("design:paramtypes", [Object]),
     tslib_1.__metadata("design:returntype", Promise)
 ], RoleQuery.prototype, "myRoles", null);
-tslib_1.__decorate([
-    (0, type_graphql_1.Query)(returns => [role_js_1.Role], { description: 'To fetch the preset of role for new user' }),
-    tslib_1.__param(0, (0, type_graphql_1.Ctx)()),
-    tslib_1.__metadata("design:type", Function),
-    tslib_1.__metadata("design:paramtypes", [Object]),
-    tslib_1.__metadata("design:returntype", Promise)
-], RoleQuery.prototype, "checkRolePreset", null);
 tslib_1.__decorate([
     (0, type_graphql_1.FieldResolver)(type => shell_1.Domain),
     tslib_1.__param(0, (0, type_graphql_1.Root)()),
@@ -201,6 +237,13 @@ tslib_1.__decorate([
     tslib_1.__metadata("design:paramtypes", [role_js_1.Role, Object]),
     tslib_1.__metadata("design:returntype", Promise)
 ], RoleQuery.prototype, "users", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.FieldResolver)(type => type_graphql_1.Int),
+    tslib_1.__param(0, (0, type_graphql_1.Root)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [role_js_1.Role]),
+    tslib_1.__metadata("design:returntype", Promise)
+], RoleQuery.prototype, "privilegeCount", null);
 tslib_1.__decorate([
     (0, type_graphql_1.FieldResolver)(type => [privilege_js_1.Privilege]),
     tslib_1.__param(0, (0, type_graphql_1.Root)()),

package/dist-server/service/role/role-query.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-query.js","sourceRoot":"","sources":["../../../server/service/role/role-query.ts"],"names":[],"mappings":";;;;AAAA,qCAA4B;AAC5B,+CAA8F;AAG9F,6CAA4C;AAC5C,iDAAuG;AAEvG,4DAAqD;AACrD,6CAAsC;AACtC,uCAAgC;AAChC,mDAA8E;AAGvE,IAAM,SAAS,GAAf,MAAM,SAAS;IAGd,AAAN,KAAK,CAAC,IAAI,CAAc,IAAY,EAAS,OAAwB;QACnE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC;YACzC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE;YAChE,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CAA0B,MAAiB,EAAS,OAAwB;QACrF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,IAAA,qCAA6B,EAAC;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,cAAI,CAAC;YAC/B,MAAM;YACN,MAAM;YACN,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;SACrC,CAAC,CAAC,eAAe,EAAE,CAAA;QAEpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IAGG,AAAN,KAAK,CAAC,cAAc,CAAgB,MAAc,EAAS,OAAwB;QACjF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,mDAAmD;QACnD,MAAM,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAC7C,KAAK,EAAE;gBACL,EAAE,EAAE,MAAM;gBACV,MAAM,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE;aACjE;YACD,SAAS,EAAE,CAAC,YAAY,CAAC;SAC1B,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,CAAA;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAA;QAEhF,OAAO,CAAC,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3F,EAAE;YACF,IAAI;YACJ,QAAQ;YACR,WAAW;YACX,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC,CAAA;IACL,CAAC;IAIK,AAAN,KAAK,CAAC,SAAS,CAAgB,MAAc,EAAS,OAAwB;QAC5E,MAAM,SAAS,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,KAAK,CAC/C;;;;;;;;;;;;;+BAayB,MAAM;;;;;;OAM9B,CACF,CAAA;QAED,OAAO,SAAS,CAAA;IAClB,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAQ,OAAwB;QAC3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEtC,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC;aACpC,kBAAkB,CAAC,MAAM,CAAC;aAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;aAC9B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;aACtC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aAC/C,QAAQ,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;aACzG,MAAM,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;aAChC,OAAO,EAAE,CAAA;QAEZ,OAAO,KAAK,CAAA;IACd,CAAC;IAGK,AAAN,KAAK,CAAC,eAAe,CAAQ,OAAwB;QACnD,MAAM,UAAU,GAAG,YAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;QAEjD,OAAO,UAAU,CAAA;IACnB,CAAC;IAGK,AAAN,KAAK,CAAC,MAAM,CAAS,IAAU;QAC7B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IACrE,CAAC;IAED;;;OAGG;IAGG,AAAN,KAAK,CAAC,KAAK,CAAS,IAAU,EAAS,OAAwB;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,OAAO,CAAC;SACrB,CAAC,CAAA;QAEF,OAAO,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAA;IAC9B,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU,CAAS,IAAU;QACjC,OAAO,CACL,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAChC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,YAAY,CAAC;SAC1B,CAAC,CACH,CAAC,UAAU,CAAA;IACd,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;CACF,CAAA;AApKY,8BAAS;AAGd;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC7C,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IAAgB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qCAM3C;AAIK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,wBAAQ,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;IAC1D,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;sCAWrD;AAsBK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6BAAa,CAAC,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;IAC9D,mBAAA,IAAA,kBAAG,EAAC,QAAQ,CAAC,CAAA;IAAkB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;+CAyBzD;AAIK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,wBAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IACzD,mBAAA,IAAA,kBAAG,EAAC,QAAQ,CAAC,CAAA;IAAkB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0CAyBpD;AAGK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,yBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;IAClF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;wCAanB;AAGK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,cAAI,CAAC,EAAE,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;IAC/D,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;gDAI3B;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IAChB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;uCAE9B;AAQK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAI,CAAC,CAAC;IACjB,mBAAA,IAAA,mBAAI,GAAE,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAZ,cAAI;;sCAO7B;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,wBAAS,CAAC,CAAC;IACjB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;2CAOlC;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;oBAnKU,SAAS;IADrB,IAAA,uBAAQ,EAAC,cAAI,CAAC;GACF,SAAS,CAoKrB","sourcesContent":["import { In } from 'typeorm'\nimport { Arg, Args, Ctx, Directive, FieldResolver, Query, Resolver, Root } from 'type-graphql'\nimport { SelectQueryBuilder } from 'typeorm'\n\nimport { config } from '@things-factory/env'\nimport { Domain, getQueryBuilderFromListParams, getRepository, ListParam } from '@things-factory/shell'\n\nimport { Privilege } from '../privilege/privilege.js'\nimport { User } from '../user/user.js'\nimport { Role } from './role.js'\nimport { RoleList, RolePrivilege, UserRole, RoleBrief } from './role-types.js'\n\n@Resolver(Role)\nexport class RoleQuery {\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => Role, { description: 'To fetch role' })\n  async role(@Arg('name') name: string, @Ctx() context: ResolverContext): Promise<Role> {\n    const { domain } = context.state\n    return await getRepository(Role).findOneBy({\n      domain: { id: In([domain.id, domain.parentId].filter(Boolean)) },\n      name\n    })\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => RoleList, { description: 'To fetch multiple users' })\n  async roles(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<RoleList> {\n    const { domain } = context.state\n\n    const [items, total] = await getQueryBuilderFromListParams({\n      repository: getRepository(Role),\n      params,\n      domain,\n      searchables: ['name', 'description']\n    }).getManyAndCount()\n\n    return { items, total }\n  }\n\n  /**\n   * 한 역할의 권한 — **전체 목록과 이 역할이 가진 것을 한 번에** 돌려준다.\n   *\n   * 권한 편집 화면이 필요한 것은 「무엇이 있나」와 「이 역할이 무엇을 갖나」 둘인데, 그것을\n   * 질의 둘로 가르면 화면이 둘을 짝지어야 하고 그 짝짓기가 역할 **이름**으로 이루어졌다\n   * (옛 `role-privilege-editor` — 같은 이름의 부모 도메인 역할과 헷갈렸다). 여기서 `roleId` 로\n   * 짝지어 주면 화면이 그 일을 안 한다.\n   *\n   * ── 원시 SQL 을 걷어냈다 ────────────────────────────────────────────────────\n   * 셋을 동시에 잃고 있었다.\n   *\n   *  ① `roleId` 를 문자열로 이어 붙였다. `user:query` 를 가진 사람이 임의의 SQL 을 넣을 수 있다.\n   *  ② `CASE WHEN … THEN true` 는 방언이다 — MSSQL 에 boolean 리터럴이 없다. 이 저장소는\n   *     DB 5종을 지원한다.\n   *  ③ 도메인을 안 봤다. 남의 도메인 역할의 `roleId` 로도 답했다.\n   *\n   * 권한 마스터는 전체 배포에 84행 규모(도메인마다 늘지 않는다)이므로 관계를 그대로 읽는다.\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => [RolePrivilege], { description: 'To fetch privileges of a role' })\n  async rolePrivileges(@Arg('roleId') roleId: string, @Ctx() context: ResolverContext): Promise<RolePrivilege[]> {\n    const { domain } = context.state\n\n    /* 상속으로 보이는 부모 도메인 역할까지가 범위다 — `role` 질의와 같은 규칙. */\n    const role = await getRepository(Role).findOne({\n      where: {\n        id: roleId,\n        domain: { id: In([domain.id, domain.parentId].filter(Boolean)) }\n      },\n      relations: ['privileges']\n    })\n\n    if (!role) {\n      return []\n    }\n\n    const assigned = new Set((role.privileges || []).map(privilege => privilege.id))\n\n    return (await getRepository(Privilege).find()).map(({ id, name, category, description }) => ({\n      id,\n      name,\n      category,\n      description,\n      assigned: assigned.has(id)\n    }))\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => [UserRole], { description: 'To fetch roles of a user' })\n  async userRoles(@Arg('userId') userId: string, @Ctx() context: ResolverContext): Promise<UserRole[]> {\n    const userRoles = await getRepository(Role).query(\n      `\n        SELECT\n          id,\n          name,\n          description,\n          CASE WHEN id IN (\n            SELECT\n              R.id\n            FROM\n              roles R JOIN users_roles UR\n            ON\n              R.id = UR.roles_id\n            WHERE\n              UR.users_id = '${userId}'\n          ) THEN true\n            ELSE false\n          END AS assigned\n        FROM\n          roles\n      `\n    )\n\n    return userRoles\n  }\n\n  @Query(returns => [RoleBrief], { description: 'To fetch roles of current user (id, name only)' })\n  async myRoles(@Ctx() context: ResolverContext): Promise<RoleBrief[]> {\n    const { user, domain } = context.state\n\n    const roles = await getRepository(Role)\n      .createQueryBuilder('ROLE')\n      .leftJoin('ROLE.users', 'USER')\n      .leftJoin('ROLE.domain', 'ROLE_DOMAIN')\n      .where('USER.id = :userId', { userId: user.id })\n      .andWhere('ROLE_DOMAIN.id In(:...domainIds)', { domainIds: [domain.id, domain.parentId].filter(Boolean) })\n      .select(['ROLE.id', 'ROLE.name'])\n      .getMany()\n\n    return roles\n  }\n\n  @Query(returns => [Role], { description: 'To fetch the preset of role for new user' })\n  async checkRolePreset(@Ctx() context: ResolverContext): Promise<Role[]> {\n    const rolePreset = config.get('rolePreset') || []\n\n    return rolePreset\n  }\n\n  @FieldResolver(type => Domain)\n  async domain(@Root() role: Role) {\n    return await getRepository(Domain).findOneBy({ id: role.domainId })\n  }\n\n  /**\n   * Role의 users 필드를 위한 리졸버\n   * 사용자 조회 권한이 있는 경우에만 접근 가능\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @FieldResolver(type => [User])\n  async users(@Root() role: Role, @Ctx() context: ResolverContext) {\n    const roleData = await getRepository(Role).findOne({\n      where: { id: role.id },\n      relations: ['users']\n    })\n\n    return roleData?.users || []\n  }\n\n  @FieldResolver(type => [Privilege])\n  async privileges(@Root() role: Role) {\n    return (\n      await getRepository(Role).findOne({\n        where: { id: role.id },\n        relations: ['privileges']\n      })\n    ).privileges\n  }\n\n  @FieldResolver(type => User)\n  async updater(@Root() role: Role): Promise<User> {\n    return await getRepository(User).findOneBy({ id: role.updaterId })\n  }\n\n  @FieldResolver(type => User)\n  async creator(@Root() role: Role): Promise<User> {\n    return await getRepository(User).findOneBy({ id: role.creatorId })\n  }\n}\n"]}
+{"version":3,"file":"role-query.js","sourceRoot":"","sources":["../../../server/service/role/role-query.ts"],"names":[],"mappings":";;;;AAAA,qCAA4B;AAC5B,+CAAmG;AAGnG,iDAAuG;AAEvG,4DAAqD;AACrD,6CAAsC;AACtC,uCAAgC;AAChC,mDAA8E;AAGvE,IAAM,SAAS,GAAf,MAAM,SAAS;IAGd,AAAN,KAAK,CAAC,IAAI,CAAc,IAAY,EAAS,OAAwB;QACnE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC;YACzC,MAAM,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE;YAChE,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAIK,AAAN,KAAK,CAAC,KAAK,CAA0B,MAAiB,EAAS,OAAwB;QACrF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,IAAA,qCAA6B,EAAC;YACzD,UAAU,EAAE,IAAA,qBAAa,EAAC,cAAI,CAAC;YAC/B,MAAM;YACN,MAAM;YACN,WAAW,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC;SACrC,CAAC,CAAC,eAAe,EAAE,CAAA;QAEpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IAGG,AAAN,KAAK,CAAC,cAAc,CAAgB,MAAc,EAAS,OAAwB;QACjF,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,mDAAmD;QACnD,MAAM,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAC7C,KAAK,EAAE;gBACL,EAAE,EAAE,MAAM;gBACV,MAAM,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE;aACjE;YACD,SAAS,EAAE,CAAC,YAAY,CAAC;SAC1B,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,CAAA;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAA;QAEhF,OAAO,CAAC,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3F,EAAE;YACF,IAAI;YACJ,QAAQ;YACR,WAAW;YACX,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC,CAAA;IACL,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IAGG,AAAN,KAAK,CAAC,SAAS,CAAgB,MAAc,EAAS,OAAwB;QAC5E,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC,MAAM,IAAI,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC/F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;QAElE,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,IAAI,CAAC;YAC3C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAA,YAAE,EAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE;SAC5E,CAAC,CAAA;QAEF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC1G,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAQ,OAAwB;QAC3C,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEtC,MAAM,KAAK,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC;aACpC,kBAAkB,CAAC,MAAM,CAAC;aAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;aAC9B,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;aACtC,KAAK,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aAC/C,QAAQ,CAAC,kCAAkC,EAAE,EAAE,SAAS,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;aACzG,MAAM,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;aAChC,OAAO,EAAE,CAAA;QAEZ,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;;;;;;;;;OAYG;IAGG,AAAN,KAAK,CAAC,MAAM,CAAS,IAAU;QAC7B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAM,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IACrE,CAAC;IAED;;;OAGG;IAGG,AAAN,KAAK,CAAC,KAAK,CAAS,IAAU,EAAS,OAAwB;QAC7D,MAAM,QAAQ,GAAG,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YACjD,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,OAAO,CAAC;SACrB,CAAC,CAAA;QAEF,OAAO,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAA;IAC9B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IAEG,AAAN,KAAK,CAAC,cAAc,CAAS,IAAU;QACrC,OAAO,MAAM,IAAA,qBAAa,EAAC,wBAAS,CAAC;aAClC,kBAAkB,CAAC,WAAW,CAAC;aAC/B,SAAS,CAAC,iBAAiB,EAAE,MAAM,CAAC;aACpC,KAAK,CAAC,eAAe,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;aACvC,QAAQ,EAAE,CAAA;IACf,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU,CAAS,IAAU;QACjC,OAAO,CACL,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,OAAO,CAAC;YAChC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE;YACtB,SAAS,EAAE,CAAC,YAAY,CAAC;SAC1B,CAAC,CACH,CAAC,UAAU,CAAA;IACd,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAS,IAAU;QAC9B,OAAO,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACpE,CAAC;CACF,CAAA;AAhNY,8BAAS;AAGd;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC7C,mBAAA,IAAA,kBAAG,EAAC,MAAM,CAAC,CAAA;IAAgB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qCAM3C;AAIK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,wBAAQ,EAAE,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;IAC1D,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;sCAWrD;AAsBK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6BAAa,CAAC,EAAE,EAAE,WAAW,EAAE,+BAA+B,EAAE,CAAC;IAC9D,mBAAA,IAAA,kBAAG,EAAC,QAAQ,CAAC,CAAA;IAAkB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;+CAyBzD;AAqBK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,wBAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IACzD,mBAAA,IAAA,kBAAG,EAAC,QAAQ,CAAC,CAAA;IAAkB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0CAWpD;AAGK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,yBAAS,CAAC,EAAE,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;IAClF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;wCAanB;AAiBK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IAChB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;uCAE9B;AAQK;IAFL,IAAA,wBAAS,EAAC,oGAAoG,CAAC;IAC/G,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,cAAI,CAAC,CAAC;IACjB,mBAAA,IAAA,mBAAI,GAAE,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAZ,cAAI;;sCAO7B;AA4BK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,CAAC;IACL,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;+CAMtC;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,wBAAS,CAAC,CAAC;IACjB,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;2CAOlC;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;AAGK;IADL,IAAA,4BAAa,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACb,mBAAA,IAAA,mBAAI,GAAE,CAAA;;6CAAO,cAAI;;wCAE/B;oBA/MU,SAAS;IADrB,IAAA,uBAAQ,EAAC,cAAI,CAAC;GACF,SAAS,CAgNrB","sourcesContent":["import { In } from 'typeorm'\nimport { Arg, Args, Ctx, Directive, FieldResolver, Int, Query, Resolver, Root } from 'type-graphql'\nimport { SelectQueryBuilder } from 'typeorm'\n\nimport { Domain, getQueryBuilderFromListParams, getRepository, ListParam } from '@things-factory/shell'\n\nimport { Privilege } from '../privilege/privilege.js'\nimport { User } from '../user/user.js'\nimport { Role } from './role.js'\nimport { RoleList, RolePrivilege, UserRole, RoleBrief } from './role-types.js'\n\n@Resolver(Role)\nexport class RoleQuery {\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => Role, { description: 'To fetch role' })\n  async role(@Arg('name') name: string, @Ctx() context: ResolverContext): Promise<Role> {\n    const { domain } = context.state\n    return await getRepository(Role).findOneBy({\n      domain: { id: In([domain.id, domain.parentId].filter(Boolean)) },\n      name\n    })\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => RoleList, { description: 'To fetch multiple users' })\n  async roles(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<RoleList> {\n    const { domain } = context.state\n\n    const [items, total] = await getQueryBuilderFromListParams({\n      repository: getRepository(Role),\n      params,\n      domain,\n      searchables: ['name', 'description']\n    }).getManyAndCount()\n\n    return { items, total }\n  }\n\n  /**\n   * 한 역할의 권한 — **전체 목록과 이 역할이 가진 것을 한 번에** 돌려준다.\n   *\n   * 권한 편집 화면이 필요한 것은 「무엇이 있나」와 「이 역할이 무엇을 갖나」 둘인데, 그것을\n   * 질의 둘로 가르면 화면이 둘을 짝지어야 하고 그 짝짓기가 역할 **이름**으로 이루어졌다\n   * (옛 `role-privilege-editor` — 같은 이름의 부모 도메인 역할과 헷갈렸다). 여기서 `roleId` 로\n   * 짝지어 주면 화면이 그 일을 안 한다.\n   *\n   * ── 원시 SQL 을 걷어냈다 ────────────────────────────────────────────────────\n   * 셋을 동시에 잃고 있었다.\n   *\n   *  ① `roleId` 를 문자열로 이어 붙였다. `user:query` 를 가진 사람이 임의의 SQL 을 넣을 수 있다.\n   *  ② `CASE WHEN … THEN true` 는 방언이다 — MSSQL 에 boolean 리터럴이 없다. 이 저장소는\n   *     DB 5종을 지원한다.\n   *  ③ 도메인을 안 봤다. 남의 도메인 역할의 `roleId` 로도 답했다.\n   *\n   * 권한 마스터는 전체 배포에 84행 규모(도메인마다 늘지 않는다)이므로 관계를 그대로 읽는다.\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => [RolePrivilege], { description: 'To fetch privileges of a role' })\n  async rolePrivileges(@Arg('roleId') roleId: string, @Ctx() context: ResolverContext): Promise<RolePrivilege[]> {\n    const { domain } = context.state\n\n    /* 상속으로 보이는 부모 도메인 역할까지가 범위다 — `role` 질의와 같은 규칙. */\n    const role = await getRepository(Role).findOne({\n      where: {\n        id: roleId,\n        domain: { id: In([domain.id, domain.parentId].filter(Boolean)) }\n      },\n      relations: ['privileges']\n    })\n\n    if (!role) {\n      return []\n    }\n\n    const assigned = new Set((role.privileges || []).map(privilege => privilege.id))\n\n    return (await getRepository(Privilege).find()).map(({ id, name, category, description }) => ({\n      id,\n      name,\n      category,\n      description,\n      assigned: assigned.has(id)\n    }))\n  }\n\n  /**\n   * 한 사람의 역할 — **부여할 수 있는 전체와 이 사람이 가진 것을 한 번에.**\n   *\n   * `rolePrivileges` 와 같은 모양이고, **같은 결함을 갖고 있었다.** 한 자리를 고쳤으면 두 번째\n   * 자리도 재야 한다는 것이 이 파일에서 그대로 났다.\n   *\n   *  ① `UR.users_id` 자리에 `userId` 를 문자열로 이어 붙였다. `user:query` 를 가진\n   *     사람이 임의의 SQL 을 넣을 수 있다.\n   *  ② `CASE WHEN … THEN true` 는 방언이다 — MSSQL 에 boolean 리터럴이 없다(DB 5종 지원).\n   *  ③ `FROM roles` — **도메인을 안 봤다.** 남의 도메인 역할까지 전부 돌려줬다.\n   *\n   * ③ 을 고치면서 범위를 `role`·`rolePrivileges` 와 같게 뒀다 — 내 도메인과 부모 1단.\n   * 그것이 실제로 부여할 수 있는 범위다.\n   *\n   * 지금 이 질의를 부르는 화면은 없다(옛 `user-role-editor` 는 `user(email:)` 로 읽었다).\n   * 그래서 범위를 좁히는 것이 깨뜨릴 소비처가 없다.\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => [UserRole], { description: 'To fetch roles of a user' })\n  async userRoles(@Arg('userId') userId: string, @Ctx() context: ResolverContext): Promise<UserRole[]> {\n    const { domain } = context.state\n\n    const user = await getRepository(User).findOne({ where: { id: userId }, relations: ['roles'] })\n    const assigned = new Set((user?.roles || []).map(role => role.id))\n\n    const roles = await getRepository(Role).find({\n      where: { domain: { id: In([domain.id, domain.parentId].filter(Boolean)) } }\n    })\n\n    return roles.map(({ id, name, description }) => ({ id, name, description, assigned: assigned.has(id) }))\n  }\n\n  @Query(returns => [RoleBrief], { description: 'To fetch roles of current user (id, name only)' })\n  async myRoles(@Ctx() context: ResolverContext): Promise<RoleBrief[]> {\n    const { user, domain } = context.state\n\n    const roles = await getRepository(Role)\n      .createQueryBuilder('ROLE')\n      .leftJoin('ROLE.users', 'USER')\n      .leftJoin('ROLE.domain', 'ROLE_DOMAIN')\n      .where('USER.id = :userId', { userId: user.id })\n      .andWhere('ROLE_DOMAIN.id In(:...domainIds)', { domainIds: [domain.id, domain.parentId].filter(Boolean) })\n      .select(['ROLE.id', 'ROLE.name'])\n      .getMany()\n\n    return roles\n  }\n\n  /*\n   * `checkRolePreset` stood here and has been removed. It read `config.get('rolePreset')`\n   * and returned it unchanged, declared as `[Role]`.\n   *\n   * Nothing set that config key and nothing called the query, across every repository on\n   * this machine — and it carried no `@privilege`, so any signed-in user could read\n   * whatever an installation later put there. Empty today, quietly public the day someone\n   * fills it. Role templates (`service/role-template/`) do what this was reaching for, as\n   * a boot registry rather than a config blob.\n   *\n   * auth-base ships to npm, so consumers outside this repository cannot be counted. The\n   * removal is recorded in the changelog — that is the only channel they have.\n   */\n\n  @FieldResolver(type => Domain)\n  async domain(@Root() role: Role) {\n    return await getRepository(Domain).findOneBy({ id: role.domainId })\n  }\n\n  /**\n   * Role의 users 필드를 위한 리졸버\n   * 사용자 조회 권한이 있는 경우에만 접근 가능\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true, superUserGranted: true)')\n  @FieldResolver(type => [User])\n  async users(@Root() role: Role, @Ctx() context: ResolverContext) {\n    const roleData = await getRepository(Role).findOne({\n      where: { id: role.id },\n      relations: ['users']\n    })\n\n    return roleData?.users || []\n  }\n\n  /**\n   * 이 역할이 여는 권한이 **몇 개인가.**\n   *\n   * ── 왜 수만 따로 있나 ──────────────────────────────────────────────────────\n   * 목록 화면이 「이 역할이 무엇을 여나」를 말해야 하는데, 그것을 위해 권한 **행**을 받고 있었다.\n   *\n   * ```\n   * [확인함] roles(limit:20) 권한 포함  5,731 bytes · 69ms\n   * [확인함] roles(limit:20) 권한 없이    518 bytes ·  7ms      → 11.1배 · 10배\n   * ```\n   *\n   * 역할 2개에 권한 행 60개를 받아서 화면에는 잘린 코드 용어 셋을 그렸다. 역할 40개 ×\n   * 권한 100개면 한 페이지에 4,000행이다. **`privileges` 필드 리졸버가 역할마다 한 번씩 도는\n   * 것**까지 함께 없어지는 것이 더 큰 쪽이다.\n   *\n   * 그래서 목록은 이 칸을 쓴다 — 행을 안 받고 수를 받는다. 권한을 실제로 고치는 화면은\n   * `rolePrivileges(roleId:)` 로 따로 읽는다(전체 목록 + 이 역할이 가진 것을 한 번에).\n   *\n   * ── 왜 관계를 세지 않고 질의로 세나 ────────────────────────────────────────\n   * `relation(...).loadMany()` 는 행을 다 읽고 길이를 재는 것이라 여기서 고치려는 것을 그대로\n   * 다시 한다. `getCount()` 는 DB 가 센다.\n   *\n   * 조인 테이블의 주인은 `Privilege` 쪽이지만(`privilege.ts:72` 의 `@JoinTable`), 양쪽이 관계를\n   * 선언하고 있으므로 어느 쪽에서 조인해도 같다.\n   */\n  @FieldResolver(type => Int)\n  async privilegeCount(@Root() role: Role): Promise<number> {\n    return await getRepository(Privilege)\n      .createQueryBuilder('PRIVILEGE')\n      .innerJoin('PRIVILEGE.roles', 'ROLE')\n      .where('ROLE.id = :id', { id: role.id })\n      .getCount()\n  }\n\n  @FieldResolver(type => [Privilege])\n  async privileges(@Root() role: Role) {\n    return (\n      await getRepository(Role).findOne({\n        where: { id: role.id },\n        relations: ['privileges']\n      })\n    ).privileges\n  }\n\n  @FieldResolver(type => User)\n  async updater(@Root() role: Role): Promise<User> {\n    return await getRepository(User).findOneBy({ id: role.updaterId })\n  }\n\n  @FieldResolver(type => User)\n  async creator(@Root() role: Role): Promise<User> {\n    return await getRepository(User).findOneBy({ id: role.creatorId })\n  }\n}\n"]}

package/dist-server/service/role-template/index.d.ts

@@ -0,0 +1,4 @@
+import { RoleTemplateMutation } from './role-template-mutation.js';
+import { RoleTemplateQuery } from './role-template-query.js';
+export declare const entities: any[];
+export declare const resolvers: (typeof RoleTemplateQuery | typeof RoleTemplateMutation)[];

package/dist-server/service/role-template/index.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvers = exports.entities = void 0;
+const role_template_mutation_js_1 = require("./role-template-mutation.js");
+const role_template_query_js_1 = require("./role-template-query.js");
+/* Templates live in the boot registry, not in a table, so there is no entity here. */
+exports.entities = [];
+exports.resolvers = [role_template_query_js_1.RoleTemplateQuery, role_template_mutation_js_1.RoleTemplateMutation];
+//# sourceMappingURL=index.js.map

package/dist-server/service/role-template/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/service/role-template/index.ts"],"names":[],"mappings":";;;AAAA,2EAAkE;AAClE,qEAA4D;AAE5D,sFAAsF;AACzE,QAAA,QAAQ,GAAG,EAAE,CAAA;AACb,QAAA,SAAS,GAAG,CAAC,0CAAiB,EAAE,gDAAoB,CAAC,CAAA","sourcesContent":["import { RoleTemplateMutation } from './role-template-mutation.js'\nimport { RoleTemplateQuery } from './role-template-query.js'\n\n/* Templates live in the boot registry, not in a table, so there is no entity here. */\nexport const entities = []\nexport const resolvers = [RoleTemplateQuery, RoleTemplateMutation]\n"]}

package/dist-server/service/role-template/role-template-mutation.d.ts

@@ -0,0 +1,39 @@
+import { Role } from '../role/role.js';
+export declare class RoleTemplateMutation {
+    /**
+     * Creates a role from a template — once per name.
+     *
+     * ── Why an existing name is used rather than replaced ────────────────────────
+     * Approval lines store a role's **id** (`worklist` resolves an approver of type `Role`
+     * by id). Creating a second QUALITY-INSPECTOR would leave every approval routed at the
+     * first one while the administrator edits the second, and nothing would report it: the
+     * screen shows two roles and the approvals go to the one nobody is looking at.
+     *
+     * So an existing role of that name is used as it stands. operato-plant's seed already
+     * behaves this way (`seed-demo-org.ts` looks the role up and only saves when absent);
+     * this is the same rule, stated once.
+     *
+     * ── Why privileges are added and never removed ───────────────────────────────
+     * Two applications may declare a template with the same role name on purpose, and the
+     * privileges are then the union — to a user "quality inspector" is one seat. The union
+     * only widens: if a template later drops a privilege it stays on roles already seeded,
+     * because the seed runs once and the role belongs to the administrator afterwards.
+     *
+     * A privilege that is no longer declared anywhere is already handled elsewhere and not
+     * here — `isDeprecatedPrivilege` marks it, the role screen strikes it through and refuses
+     * to switch it back on, and removing it is the administrator's call. Reclaiming it from
+     * this side would mean overwriting, and would be unable to tell a stale grant from one
+     * the administrator added on purpose.
+     */
+    createRoleFromTemplate(templateId: string, 
+    /**
+     * What this plant calls the seat. Defaults to the template's name.
+     *
+     * The template knows which seat exists in a factory running this product; it does not
+     * know what the people there call it. And because a role is also what an approval line
+     * points at, the same seat is sometimes needed twice — a day shift and a night shift
+     * inspector hold the same privileges and take different approvals. Without a name of
+     * their own a template could be used exactly once per domain.
+     */
+    name: string | undefined, context: ResolverContext): Promise<Role>;
+}

package/dist-server/service/role-template/role-template-mutation.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleTemplateMutation = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+const privilege_js_1 = require("../privilege/privilege.js");
+const role_js_1 = require("../role/role.js");
+const role_template_js_1 = require("./role-template.js");
+let RoleTemplateMutation = class RoleTemplateMutation {
+    /**
+     * Creates a role from a template — once per name.
+     *
+     * ── Why an existing name is used rather than replaced ────────────────────────
+     * Approval lines store a role's **id** (`worklist` resolves an approver of type `Role`
+     * by id). Creating a second QUALITY-INSPECTOR would leave every approval routed at the
+     * first one while the administrator edits the second, and nothing would report it: the
+     * screen shows two roles and the approvals go to the one nobody is looking at.
+     *
+     * So an existing role of that name is used as it stands. operato-plant's seed already
+     * behaves this way (`seed-demo-org.ts` looks the role up and only saves when absent);
+     * this is the same rule, stated once.
+     *
+     * ── Why privileges are added and never removed ───────────────────────────────
+     * Two applications may declare a template with the same role name on purpose, and the
+     * privileges are then the union — to a user "quality inspector" is one seat. The union
+     * only widens: if a template later drops a privilege it stays on roles already seeded,
+     * because the seed runs once and the role belongs to the administrator afterwards.
+     *
+     * A privilege that is no longer declared anywhere is already handled elsewhere and not
+     * here — `isDeprecatedPrivilege` marks it, the role screen strikes it through and refuses
+     * to switch it back on, and removing it is the administrator's call. Reclaiming it from
+     * this side would mean overwriting, and would be unable to tell a stale grant from one
+     * the administrator added on purpose.
+     */
+    async createRoleFromTemplate(templateId, name, context) {
+        const { domain, user, tx } = context.state;
+        const template = findTemplate(templateId);
+        if (!template) {
+            throw new Error(`There is no role template "${templateId}" in this installation.`);
+        }
+        const roleName = (name || template.name).trim();
+        if (!roleName) {
+            throw new Error('A role needs a name.');
+        }
+        const roleRepository = tx.getRepository(role_js_1.Role);
+        let role = await roleRepository.findOne({
+            where: { domain: { id: domain.id }, name: roleName },
+            relations: ['privileges']
+        });
+        if (!role) {
+            role = await roleRepository.save({
+                domain,
+                name: roleName,
+                description: template.description,
+                creator: user,
+                updater: user
+            });
+            role = await roleRepository.findOne({
+                where: { id: role.id },
+                relations: ['privileges']
+            });
+        }
+        const held = new Set((role.privileges || []).map(privilege => `${privilege.category} ${privilege.name}`));
+        const wanted = template.grants.flatMap(grant => grant.axes.map(axis => ({ category: grant.category, name: axis })));
+        /*
+         * Privileges have no domain — the whole server shares one set and what differs per
+         * domain is only which role holds them (`Privilege` has no domain column; auth-base's
+         * boot creates them by category and name alone). Filtering by domain finds nothing.
+         */
+        const privilegeRepository = tx.getRepository(privilege_js_1.Privilege);
+        const added = [];
+        for (const one of wanted) {
+            if (held.has(`${one.category} ${one.name}`)) {
+                continue;
+            }
+            const privilege = await privilegeRepository.findOne({ where: { category: one.category, name: one.name } });
+            /*
+             * A privilege this installation does not declare is skipped, never created. Creating
+             * it here would make a row no `@privilege` asks for: the role would look as if it
+             * had been granted something, and open nothing. Granted-but-closed is the worst of
+             * the three outcomes. `roleTemplates` reports these as `missingCount` before the
+             * administrator picks the template.
+             */
+            if (privilege) {
+                added.push(privilege);
+            }
+        }
+        /*
+         * Nothing records that this role came from a template.
+         *
+         * A `templateVersions` column stood here so a later change to the template could be
+         * reported. It bought less than it looked like: what an administrator needs is "these
+         * two privileges were added to the template", and that is the template's current
+         * grants against the role's current privileges — computed, not stored. Telling them
+         * apart from a privilege the administrator removed on purpose would take the seeded
+         * content itself, not a version of it, and no screen asks for either yet.
+         *
+         * So the seed ends here. If reporting template drift is designed later, what to store
+         * follows from that design rather than being guessed at now.
+         */
+        role.privileges = [...(role.privileges || []), ...added];
+        role.updater = user;
+        return await roleRepository.save(role);
+    }
+};
+exports.RoleTemplateMutation = RoleTemplateMutation;
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)('@privilege(category: "user", privilege: "mutation", domainOwnerGranted: true, superUserGranted: true)'),
+    (0, type_graphql_1.Directive)('@transaction'),
+    (0, type_graphql_1.Mutation)(returns => role_js_1.Role, { description: 'To create a role from a role template' }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('templateId')),
+    tslib_1.__param(1, (0, type_graphql_1.Arg)('name', { nullable: true })),
+    tslib_1.__param(2, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], RoleTemplateMutation.prototype, "createRoleFromTemplate", null);
+exports.RoleTemplateMutation = RoleTemplateMutation = tslib_1.__decorate([
+    (0, type_graphql_1.Resolver)(role_js_1.Role)
+], RoleTemplateMutation);
+function findTemplate(id) {
+    return (0, role_template_js_1.roleTemplateById)(id) || (0, role_template_js_1.computedRoleTemplates)().find(template => template.id === id);
+}
+//# sourceMappingURL=role-template-mutation.js.map

package/dist-server/service/role-template/role-template-mutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-template-mutation.js","sourceRoot":"","sources":["../../../server/service/role-template/role-template-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAsE;AAItE,4DAAqD;AACrD,6CAAsC;AACtC,yDAAoG;AAG7F,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IAIG,AAAN,KAAK,CAAC,sBAAsB,CACP,UAAkB,EAUJ,IAAwB,EAClD,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;QAEzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,yBAAyB,CAAC,CAAA;QACpF,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;QAE/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACzC,CAAC;QAED,MAAM,cAAc,GAAG,EAAE,CAAC,aAAa,CAAC,cAAI,CAAC,CAAA;QAE7C,IAAI,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;YACtC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpD,SAAS,EAAE,CAAC,YAAY,CAAC;SAC1B,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC;gBAC/B,MAAM;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI;aACP,CAAC,CAAA;YAET,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAK,CAAC,EAAE,EAAE;gBACvB,SAAS,EAAE,CAAC,YAAY,CAAC;aAC1B,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,IAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC1G,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAEnH;;;;WAIG;QACH,MAAM,mBAAmB,GAAG,EAAE,CAAC,aAAa,CAAC,wBAAS,CAAC,CAAA;QACvD,MAAM,KAAK,GAAgB,EAAE,CAAA;QAE7B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5C,SAAQ;YACV,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAE1G;;;;;;eAMG;YACH,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACvB,CAAC;QACH,CAAC;QAED;;;;;;;;;;;;WAYG;QACH,IAAK,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,IAAK,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAA;QAC1D,IAAK,CAAC,OAAO,GAAG,IAAI,CAAA;QAEpB,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,IAAK,CAAC,CAAA;IACzC,CAAC;CACF,CAAA;AA/HY,oDAAoB;AA6BzB;IAHL,IAAA,wBAAS,EAAC,uGAAuG,CAAC;IAClH,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC;IAEjF,mBAAA,IAAA,kBAAG,EAAC,YAAY,CAAC,CAAA;IAUjB,mBAAA,IAAA,kBAAG,EAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/B,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;kEAqFP;+BA9HU,oBAAoB;IADhC,IAAA,uBAAQ,EAAC,cAAI,CAAC;GACF,oBAAoB,CA+HhC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAA,mCAAgB,EAAC,EAAE,CAAC,IAAI,IAAA,wCAAqB,GAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;AAC7F,CAAC","sourcesContent":["import { Arg, Ctx, Directive, Mutation, Resolver } from 'type-graphql'\n\nimport { getRepository } from '@things-factory/shell'\n\nimport { Privilege } from '../privilege/privilege.js'\nimport { Role } from '../role/role.js'\nimport { roleTemplateById, computedRoleTemplates, RegisteredRoleTemplate } from './role-template.js'\n\n@Resolver(Role)\nexport class RoleTemplateMutation {\n  /**\n   * Creates a role from a template — once per name.\n   *\n   * ── Why an existing name is used rather than replaced ────────────────────────\n   * Approval lines store a role's **id** (`worklist` resolves an approver of type `Role`\n   * by id). Creating a second QUALITY-INSPECTOR would leave every approval routed at the\n   * first one while the administrator edits the second, and nothing would report it: the\n   * screen shows two roles and the approvals go to the one nobody is looking at.\n   *\n   * So an existing role of that name is used as it stands. operato-plant's seed already\n   * behaves this way (`seed-demo-org.ts` looks the role up and only saves when absent);\n   * this is the same rule, stated once.\n   *\n   * ── Why privileges are added and never removed ───────────────────────────────\n   * Two applications may declare a template with the same role name on purpose, and the\n   * privileges are then the union — to a user \"quality inspector\" is one seat. The union\n   * only widens: if a template later drops a privilege it stays on roles already seeded,\n   * because the seed runs once and the role belongs to the administrator afterwards.\n   *\n   * A privilege that is no longer declared anywhere is already handled elsewhere and not\n   * here — `isDeprecatedPrivilege` marks it, the role screen strikes it through and refuses\n   * to switch it back on, and removing it is the administrator's call. Reclaiming it from\n   * this side would mean overwriting, and would be unable to tell a stale grant from one\n   * the administrator added on purpose.\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true, superUserGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Role, { description: 'To create a role from a role template' })\n  async createRoleFromTemplate(\n    @Arg('templateId') templateId: string,\n    /**\n     * What this plant calls the seat. Defaults to the template's name.\n     *\n     * The template knows which seat exists in a factory running this product; it does not\n     * know what the people there call it. And because a role is also what an approval line\n     * points at, the same seat is sometimes needed twice — a day shift and a night shift\n     * inspector hold the same privileges and take different approvals. Without a name of\n     * their own a template could be used exactly once per domain.\n     */\n    @Arg('name', { nullable: true }) name: string | undefined,\n    @Ctx() context: ResolverContext\n  ): Promise<Role> {\n    const { domain, user, tx } = context.state\n\n    const template = findTemplate(templateId)\n\n    if (!template) {\n      throw new Error(`There is no role template \"${templateId}\" in this installation.`)\n    }\n\n    const roleName = (name || template.name).trim()\n\n    if (!roleName) {\n      throw new Error('A role needs a name.')\n    }\n\n    const roleRepository = tx.getRepository(Role)\n\n    let role = await roleRepository.findOne({\n      where: { domain: { id: domain.id }, name: roleName },\n      relations: ['privileges']\n    })\n\n    if (!role) {\n      role = await roleRepository.save({\n        domain,\n        name: roleName,\n        description: template.description,\n        creator: user,\n        updater: user\n      } as any)\n\n      role = await roleRepository.findOne({\n        where: { id: role!.id },\n        relations: ['privileges']\n      })\n    }\n\n    const held = new Set((role!.privileges || []).map(privilege => `${privilege.category} ${privilege.name}`))\n    const wanted = template.grants.flatMap(grant => grant.axes.map(axis => ({ category: grant.category, name: axis })))\n\n    /*\n     * Privileges have no domain — the whole server shares one set and what differs per\n     * domain is only which role holds them (`Privilege` has no domain column; auth-base's\n     * boot creates them by category and name alone). Filtering by domain finds nothing.\n     */\n    const privilegeRepository = tx.getRepository(Privilege)\n    const added: Privilege[] = []\n\n    for (const one of wanted) {\n      if (held.has(`${one.category} ${one.name}`)) {\n        continue\n      }\n\n      const privilege = await privilegeRepository.findOne({ where: { category: one.category, name: one.name } })\n\n      /*\n       * A privilege this installation does not declare is skipped, never created. Creating\n       * it here would make a row no `@privilege` asks for: the role would look as if it\n       * had been granted something, and open nothing. Granted-but-closed is the worst of\n       * the three outcomes. `roleTemplates` reports these as `missingCount` before the\n       * administrator picks the template.\n       */\n      if (privilege) {\n        added.push(privilege)\n      }\n    }\n\n    /*\n     * Nothing records that this role came from a template.\n     *\n     * A `templateVersions` column stood here so a later change to the template could be\n     * reported. It bought less than it looked like: what an administrator needs is \"these\n     * two privileges were added to the template\", and that is the template's current\n     * grants against the role's current privileges — computed, not stored. Telling them\n     * apart from a privilege the administrator removed on purpose would take the seeded\n     * content itself, not a version of it, and no screen asks for either yet.\n     *\n     * So the seed ends here. If reporting template drift is designed later, what to store\n     * follows from that design rather than being guessed at now.\n     */\n    role!.privileges = [...(role!.privileges || []), ...added]\n    role!.updater = user\n\n    return await roleRepository.save(role!)\n  }\n}\n\nfunction findTemplate(id: string): RegisteredRoleTemplate | undefined {\n  return roleTemplateById(id) || computedRoleTemplates().find(template => template.id === id)\n}\n"]}

package/dist-server/service/role-template/role-template-query.d.ts

@@ -0,0 +1,11 @@
+import { RoleTemplateView } from './role-template-types.js';
+export declare class RoleTemplateQuery {
+    /**
+     * The templates this domain can start a role from.
+     *
+     * Gated the same way role editing is: choosing a template creates a role, so whoever may
+     * do this is whoever may create roles.
+     */
+    roleTemplates(context: ResolverContext): Promise<RoleTemplateView[]>;
+    roleTemplate(id: string, context: ResolverContext): Promise<RoleTemplateView | null>;
+}

package/dist-server/service/role-template/role-template-query.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleTemplateQuery = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+const shell_1 = require("@things-factory/shell");
+const role_js_1 = require("../role/role.js");
+const role_template_js_1 = require("./role-template.js");
+const role_template_types_js_1 = require("./role-template-types.js");
+let RoleTemplateQuery = class RoleTemplateQuery {
+    /**
+     * The templates this domain can start a role from.
+     *
+     * Gated the same way role editing is: choosing a template creates a role, so whoever may
+     * do this is whoever may create roles.
+     */
+    async roleTemplates(context) {
+        const { domain } = context.state;
+        /*
+         * Read the existing role names once. The alternative — a field resolver asking per
+         * template — runs a query per row for an answer the list already has.
+         */
+        const existing = new Set((await (0, shell_1.getRepository)(role_js_1.Role)
+            .createQueryBuilder('ROLE')
+            .select('ROLE.name')
+            .where('ROLE.domain = :domain', { domain: domain.id })
+            .getMany()).map(role => role.name));
+        return (0, role_template_js_1.allRoleTemplates)().map(template => view(template, existing));
+    }
+    async roleTemplate(id, context) {
+        const templates = await this.roleTemplates(context);
+        return templates.find(template => template.id === id) || null;
+    }
+};
+exports.RoleTemplateQuery = RoleTemplateQuery;
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)('@privilege(category: "user", privilege: "mutation", domainOwnerGranted: true, superUserGranted: true)'),
+    (0, type_graphql_1.Query)(returns => [role_template_types_js_1.RoleTemplateView], { description: 'To fetch the role templates this installation offers' }),
+    tslib_1.__param(0, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], RoleTemplateQuery.prototype, "roleTemplates", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)('@privilege(category: "user", privilege: "mutation", domainOwnerGranted: true, superUserGranted: true)'),
+    (0, type_graphql_1.Query)(returns => role_template_types_js_1.RoleTemplateView, { nullable: true, description: 'To fetch one role template by id' }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('id')),
+    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], RoleTemplateQuery.prototype, "roleTemplate", null);
+exports.RoleTemplateQuery = RoleTemplateQuery = tslib_1.__decorate([
+    (0, type_graphql_1.Resolver)(role_template_types_js_1.RoleTemplateView)
+], RoleTemplateQuery);
+function view(template, existing) {
+    const declared = process['PRIVILEGES'] || {};
+    const grants = template.grants.map(grant => {
+        const present = grant.axes.filter(axis => declared[`${grant.category} ${axis}`]);
+        const missingAxes = grant.axes.filter(axis => !declared[`${grant.category} ${axis}`]);
+        return { category: grant.category, axes: present, missingAxes };
+    });
+    return {
+        id: template.id,
+        name: template.name,
+        description: template.description,
+        grants,
+        privilegeCount: grants.reduce((count, grant) => count + grant.axes.length, 0),
+        missingCount: grants.reduce((count, grant) => count + grant.missingAxes.length, 0),
+        defaultNameTaken: existing.has(template.name),
+        /*
+         * Declared with no grants at all — an approval seat. Distinct from a template whose
+         * grants all went missing in this installation, which is a defect and shows a
+         * `missingCount` instead.
+         */
+        grantsNothingDeliberately: template.grants.length === 0
+    };
+}
+//# sourceMappingURL=role-template-query.js.map

package/dist-server/service/role-template/role-template-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-template-query.js","sourceRoot":"","sources":["../../../server/service/role-template/role-template-query.ts"],"names":[],"mappings":";;;;AAAA,+CAAmE;AAEnE,iDAAqD;AAErD,6CAAsC;AACtC,yDAA6E;AAC7E,qEAA2D;AAGpD,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B;;;;;OAKG;IAGG,AAAN,KAAK,CAAC,aAAa,CAAQ,OAAwB;QACjD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC;;;WAGG;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CACE,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC;aACtB,kBAAkB,CAAC,MAAM,CAAC;aAC1B,MAAM,CAAC,WAAW,CAAC;aACnB,KAAK,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;aACrD,OAAO,EAAE,CACb,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CACzB,CAAA;QAED,OAAO,IAAA,mCAAgB,GAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IACrE,CAAC;IAIK,AAAN,KAAK,CAAC,YAAY,CAAY,EAAU,EAAS,OAAwB;QACvE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QAEnD,OAAO,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAA;IAC/D,CAAC;CACF,CAAA;AApCY,8CAAiB;AAStB;IAFL,IAAA,wBAAS,EAAC,uGAAuG,CAAC;IAClH,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,yCAAgB,CAAC,EAAE,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC;IACzF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;sDAkBzB;AAIK;IAFL,IAAA,wBAAS,EAAC,uGAAuG,CAAC;IAClH,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,yCAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IACpF,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qDAI/C;4BAnCU,iBAAiB;IAD7B,IAAA,uBAAQ,EAAC,yCAAgB,CAAC;GACd,iBAAiB,CAoC7B;AAED,SAAS,IAAI,CAAC,QAAgC,EAAE,QAAqB;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;IAE5C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;QAChF,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;QAErF,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,MAAM;QACN,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,gBAAgB,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC7C;;;;WAIG;QACH,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;KACxD,CAAA;AACH,CAAC","sourcesContent":["import { Arg, Ctx, Directive, Query, Resolver } from 'type-graphql'\n\nimport { getRepository } from '@things-factory/shell'\n\nimport { Role } from '../role/role.js'\nimport { allRoleTemplates, RegisteredRoleTemplate } from './role-template.js'\nimport { RoleTemplateView } from './role-template-types.js'\n\n@Resolver(RoleTemplateView)\nexport class RoleTemplateQuery {\n  /**\n   * The templates this domain can start a role from.\n   *\n   * Gated the same way role editing is: choosing a template creates a role, so whoever may\n   * do this is whoever may create roles.\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => [RoleTemplateView], { description: 'To fetch the role templates this installation offers' })\n  async roleTemplates(@Ctx() context: ResolverContext): Promise<RoleTemplateView[]> {\n    const { domain } = context.state\n\n    /*\n     * Read the existing role names once. The alternative — a field resolver asking per\n     * template — runs a query per row for an answer the list already has.\n     */\n    const existing = new Set(\n      (\n        await getRepository(Role)\n          .createQueryBuilder('ROLE')\n          .select('ROLE.name')\n          .where('ROLE.domain = :domain', { domain: domain.id })\n          .getMany()\n      ).map(role => role.name)\n    )\n\n    return allRoleTemplates().map(template => view(template, existing))\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => RoleTemplateView, { nullable: true, description: 'To fetch one role template by id' })\n  async roleTemplate(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<RoleTemplateView | null> {\n    const templates = await this.roleTemplates(context)\n\n    return templates.find(template => template.id === id) || null\n  }\n}\n\nfunction view(template: RegisteredRoleTemplate, existing: Set<string>): RoleTemplateView {\n  const declared = process['PRIVILEGES'] || {}\n\n  const grants = template.grants.map(grant => {\n    const present = grant.axes.filter(axis => declared[`${grant.category} ${axis}`])\n    const missingAxes = grant.axes.filter(axis => !declared[`${grant.category} ${axis}`])\n\n    return { category: grant.category, axes: present, missingAxes }\n  })\n\n  return {\n    id: template.id,\n    name: template.name,\n    description: template.description,\n    grants,\n    privilegeCount: grants.reduce((count, grant) => count + grant.axes.length, 0),\n    missingCount: grants.reduce((count, grant) => count + grant.missingAxes.length, 0),\n    defaultNameTaken: existing.has(template.name),\n    /*\n     * Declared with no grants at all — an approval seat. Distinct from a template whose\n     * grants all went missing in this installation, which is a defect and shows a\n     * `missingCount` instead.\n     */\n    grantsNothingDeliberately: template.grants.length === 0\n  }\n}\n"]}

package/dist-server/service/role-template/role-template-types.d.ts

@@ -0,0 +1,51 @@
+/**
+ * What a template looks like *to this installation*.
+ *
+ * The declared template and the offered template are not the same thing: an app declares
+ * grants across modules it expects to be installed, and a given installation has a subset.
+ * operato-plant declares 14 categories; the plant app running on :4000 sees 33 of the 47
+ * categories declared across the repository. So the answer has to say which parts of the
+ * template this installation can actually honour.
+ */
+export declare class RoleTemplateGrantView {
+    category: string;
+    axes: string[];
+    /**
+     * Axes this installation does not declare.
+     *
+     * Dropping them quietly would hand the administrator a role that does not match the
+     * template's name, with no way to tell. They are reported instead, and the screen says
+     * "not present in this installation".
+     */
+    missingAxes: string[];
+}
+export declare class RoleTemplateView {
+    id: string;
+    name: string;
+    description?: string;
+    grants: RoleTemplateGrantView[];
+    privilegeCount: number;
+    missingCount: number;
+    /**
+     * Whether a role already carries this template's default name in the current domain.
+     *
+     * The screen warns before creating one, because seeding onto an existing name does not
+     * make a second role — approval lines hold a role's id, so a duplicate would leave the
+     * approval routed to the role nobody edits. The existing role is used as it stands and
+     * the template's privileges are added to it.
+     *
+     * It says "default name" rather than "seeded" because the administrator may give the
+     * role a name of their own, and then nothing here can tell whether this template was
+     * used. That is deliberate: provenance is not stored.
+     */
+    defaultNameTaken: boolean;
+    /**
+     * True when the template deliberately opens nothing.
+     *
+     * A seat that only receives approvals is legitimate — operato-twin declares seven roles
+     * with no privileges at all, used as the target an approval line points at. The screen
+     * must not draw that as "0 privileges, something is wrong", so the distinction is
+     * carried here rather than inferred from an empty list.
+     */
+    grantsNothingDeliberately: boolean;
+}