@things-factory/auth-base 10.1.79 → 10.1.106

package/dist-server/service/access-request/access-request-types.d.ts

@@ -0,0 +1,32 @@
+import { AccessRequest } from './access-request.js';
+export declare enum AccessDecision {
+    GRANT = "GRANT",
+    DENY = "DENY"
+}
+export declare class NewAccessRequest {
+    category: string;
+    privilege: string;
+    operationName?: string;
+    reason?: string;
+}
+export declare class AccessDecisionInput {
+    requestId: string;
+    decision: AccessDecision;
+    roleId?: string;
+    reason?: string;
+}
+export declare class AccessDecisionIssue {
+    code: string;
+    blocking: boolean;
+    field?: string;
+    params?: Record<string, unknown>;
+}
+export declare class AccessRoleCandidate {
+    id: string;
+    name: string;
+    privilegeCount: number;
+}
+export declare class AccessRequestList {
+    items: AccessRequest[];
+    total: number;
+}

package/dist-server/service/access-request/access-request-types.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessRequestList = exports.AccessRoleCandidate = exports.AccessDecisionIssue = exports.AccessDecisionInput = exports.NewAccessRequest = exports.AccessDecision = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+const shell_1 = require("@things-factory/shell");
+const access_request_js_1 = require("./access-request.js");
+var AccessDecision;
+(function (AccessDecision) {
+    AccessDecision["GRANT"] = "GRANT";
+    AccessDecision["DENY"] = "DENY";
+})(AccessDecision || (exports.AccessDecision = AccessDecision = {}));
+(0, type_graphql_1.registerEnumType)(AccessDecision, {
+    name: 'AccessDecision',
+    description: 'What the person deciding an access request does: put the requester into a role, or deny with a reason.'
+});
+let NewAccessRequest = class NewAccessRequest {
+};
+exports.NewAccessRequest = NewAccessRequest;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: "The category of the refused privilege, from the refusal's extensions.requires." }),
+    tslib_1.__metadata("design:type", String)
+], NewAccessRequest.prototype, "category", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: "The refused privilege, from the refusal's extensions.requires." }),
+    tslib_1.__metadata("design:type", String)
+], NewAccessRequest.prototype, "privilege", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The operation that was refused, shown to the person deciding.' }),
+    tslib_1.__metadata("design:type", String)
+], NewAccessRequest.prototype, "operationName", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: "The requester's reason." }),
+    tslib_1.__metadata("design:type", String)
+], NewAccessRequest.prototype, "reason", void 0);
+exports.NewAccessRequest = NewAccessRequest = tslib_1.__decorate([
+    (0, type_graphql_1.InputType)({ description: 'An access request for one privilege in this domain - what a refusal carried, and why it is needed.' })
+], NewAccessRequest);
+let AccessDecisionInput = class AccessDecisionInput {
+};
+exports.AccessDecisionInput = AccessDecisionInput;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'The access request decided.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessDecisionInput.prototype, "requestId", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => AccessDecision, { description: 'Grant or deny.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessDecisionInput.prototype, "decision", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The role to put the requester into - required to grant, one this domain can assign that holds the privilege.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessDecisionInput.prototype, "roleId", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'Why - required to deny.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessDecisionInput.prototype, "reason", void 0);
+exports.AccessDecisionInput = AccessDecisionInput = tslib_1.__decorate([
+    (0, type_graphql_1.InputType)({ description: 'A decision on one access request.' })
+], AccessDecisionInput);
+let AccessDecisionIssue = class AccessDecisionIssue {
+};
+exports.AccessDecisionIssue = AccessDecisionIssue;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'What was found, as a code the screen words.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessDecisionIssue.prototype, "code", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'Whether it keeps the decision from being made.' }),
+    tslib_1.__metadata("design:type", Boolean)
+], AccessDecisionIssue.prototype, "blocking", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The part of the decision it is about: request, decision, role or reason.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessDecisionIssue.prototype, "field", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => shell_1.ScalarObject, { nullable: true, description: 'The values the sentence is built from.' }),
+    tslib_1.__metadata("design:type", Object)
+], AccessDecisionIssue.prototype, "params", void 0);
+exports.AccessDecisionIssue = AccessDecisionIssue = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'One finding of the access decision review - blocking ones keep the decision from being made.' })
+], AccessDecisionIssue);
+let AccessRoleCandidate = class AccessRoleCandidate {
+};
+exports.AccessRoleCandidate = AccessRoleCandidate;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'The role id.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessRoleCandidate.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'The role name.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessRoleCandidate.prototype, "name", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'How many privileges the role carries - fewer is closer to what was asked.' }),
+    tslib_1.__metadata("design:type", Number)
+], AccessRoleCandidate.prototype, "privilegeCount", void 0);
+exports.AccessRoleCandidate = AccessRoleCandidate = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'A role this domain can assign that grants the asked privilege.' })
+], AccessRoleCandidate);
+let AccessRequestList = class AccessRequestList {
+};
+exports.AccessRequestList = AccessRequestList;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => [access_request_js_1.AccessRequest], { nullable: true, description: 'The access requests.' }),
+    tslib_1.__metadata("design:type", Array)
+], AccessRequestList.prototype, "items", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { nullable: true, description: 'The total number of access requests.' }),
+    tslib_1.__metadata("design:type", Number)
+], AccessRequestList.prototype, "total", void 0);
+exports.AccessRequestList = AccessRequestList = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'A paginated list of access requests.' })
+], AccessRequestList);
+//# sourceMappingURL=access-request-types.js.map

package/dist-server/service/access-request/access-request-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-request-types.js","sourceRoot":"","sources":["../../../server/service/access-request/access-request-types.ts"],"names":[],"mappings":";;;;AAAA,+CAAkF;AAClF,iDAAoD;AAEpD,2DAAmD;AAEnD,IAAY,cAGX;AAHD,WAAY,cAAc;IACxB,iCAAe,CAAA;IACf,+BAAa,CAAA;AACf,CAAC,EAHW,cAAc,8BAAd,cAAc,QAGzB;AAED,IAAA,+BAAgB,EAAC,cAAc,EAAE;IAC/B,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,wGAAwG;CACtH,CAAC,CAAA;AAGK,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAY5B,CAAA;AAZY,4CAAgB;AAE3B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,gFAAgF,EAAE,CAAC;;kDACzF;AAGhB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,gEAAgE,EAAE,CAAC;;mDACxE;AAGjB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;;uDAClF;AAGtB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;;gDACnD;2BAXJ,gBAAgB;IAD5B,IAAA,wBAAS,EAAC,EAAE,WAAW,EAAE,oGAAoG,EAAE,CAAC;GACpH,gBAAgB,CAY5B;AAGM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAY/B,CAAA;AAZY,kDAAmB;AAE9B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;;sDACrC;AAGjB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;;qDACzC;AAGxB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8GAA8G,EAAE,CAAC;;mDACxI;AAGf;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;;mDACnD;8BAXJ,mBAAmB;IAD/B,IAAA,wBAAS,EAAC,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;GACnD,mBAAmB,CAY/B;AAGM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAY/B,CAAA;AAZY,kDAAmB;AAE9B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;;iDAC1D;AAGZ;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;;qDACxD;AAGjB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0EAA0E,EAAE,CAAC;;kDACrG;AAGd;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,oBAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;;mDACvE;8BAXrB,mBAAmB;IAD/B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,8FAA8F,EAAE,CAAC;GAC/G,mBAAmB,CAY/B;AAGM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAS/B,CAAA;AATY,kDAAmB;AAE9B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;;+CAC7B;AAGV;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;;iDAC7B;AAGZ;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,2EAA2E,EAAE,CAAC;;2DAC3F;8BARX,mBAAmB;IAD/B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,gEAAgE,EAAE,CAAC;GACjF,mBAAmB,CAS/B;AAGM,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAM7B,CAAA;AANY,8CAAiB;AAE5B;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,iCAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;;gDAClE;AAGtB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;;gDAC/E;4BALF,iBAAiB;IAD7B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;GACvD,iBAAiB,CAM7B","sourcesContent":["import { Field, InputType, Int, ObjectType, registerEnumType } from 'type-graphql'\nimport { ScalarObject } from '@things-factory/shell'\n\nimport { AccessRequest } from './access-request.js'\n\nexport enum AccessDecision {\n  GRANT = 'GRANT',\n  DENY = 'DENY'\n}\n\nregisterEnumType(AccessDecision, {\n  name: 'AccessDecision',\n  description: 'What the person deciding an access request does: put the requester into a role, or deny with a reason.'\n})\n\n@InputType({ description: 'An access request for one privilege in this domain - what a refusal carried, and why it is needed.' })\nexport class NewAccessRequest {\n  @Field({ description: \"The category of the refused privilege, from the refusal's extensions.requires.\" })\n  category: string\n\n  @Field({ description: \"The refused privilege, from the refusal's extensions.requires.\" })\n  privilege: string\n\n  @Field({ nullable: true, description: 'The operation that was refused, shown to the person deciding.' })\n  operationName?: string\n\n  @Field({ nullable: true, description: \"The requester's reason.\" })\n  reason?: string\n}\n\n@InputType({ description: 'A decision on one access request.' })\nexport class AccessDecisionInput {\n  @Field({ description: 'The access request decided.' })\n  requestId: string\n\n  @Field(type => AccessDecision, { description: 'Grant or deny.' })\n  decision: AccessDecision\n\n  @Field({ nullable: true, description: 'The role to put the requester into - required to grant, one this domain can assign that holds the privilege.' })\n  roleId?: string\n\n  @Field({ nullable: true, description: 'Why - required to deny.' })\n  reason?: string\n}\n\n@ObjectType({ description: 'One finding of the access decision review - blocking ones keep the decision from being made.' })\nexport class AccessDecisionIssue {\n  @Field({ description: 'What was found, as a code the screen words.' })\n  code: string\n\n  @Field({ description: 'Whether it keeps the decision from being made.' })\n  blocking: boolean\n\n  @Field({ nullable: true, description: 'The part of the decision it is about: request, decision, role or reason.' })\n  field?: string\n\n  @Field(type => ScalarObject, { nullable: true, description: 'The values the sentence is built from.' })\n  params?: Record<string, unknown>\n}\n\n@ObjectType({ description: 'A role this domain can assign that grants the asked privilege.' })\nexport class AccessRoleCandidate {\n  @Field({ description: 'The role id.' })\n  id: string\n\n  @Field({ description: 'The role name.' })\n  name: string\n\n  @Field(type => Int, { description: 'How many privileges the role carries - fewer is closer to what was asked.' })\n  privilegeCount: number\n}\n\n@ObjectType({ description: 'A paginated list of access requests.' })\nexport class AccessRequestList {\n  @Field(type => [AccessRequest], { nullable: true, description: 'The access requests.' })\n  items: AccessRequest[]\n\n  @Field(type => Int, { nullable: true, description: 'The total number of access requests.' })\n  total: number\n}\n"]}

package/dist-server/service/access-request/access-request.d.ts

@@ -0,0 +1,33 @@
+import { Domain } from '@things-factory/shell';
+import { Role } from '../role/role.js';
+import { User } from '../user/user.js';
+export declare enum AccessRequestStatus {
+    PENDING = "PENDING",
+    GRANTED = "GRANTED",
+    DENIED = "DENIED",
+    WITHDRAWN = "WITHDRAWN",
+    EXPIRED = "EXPIRED"
+}
+export declare class AccessRequest {
+    readonly id: string;
+    domain: Domain;
+    domainId: string;
+    requester: User;
+    requesterId: string;
+    category: string;
+    privilege: string;
+    operationName?: string;
+    reason?: string;
+    count: number;
+    lastRequestedAt?: Date;
+    state: AccessRequestStatus;
+    expiresAt?: Date;
+    decidedBy?: User;
+    decidedById?: string;
+    decidedAt?: Date;
+    decisionReason?: string;
+    grantedRole?: Role;
+    grantedRoleId?: string;
+    createdAt: Date;
+    updatedAt: Date;
+}

package/dist-server/service/access-request/access-request.js

@@ -0,0 +1,160 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessRequest = exports.AccessRequestStatus = void 0;
+const tslib_1 = require("tslib");
+const typeorm_1 = require("typeorm");
+const type_graphql_1 = require("type-graphql");
+const env_1 = require("@things-factory/env");
+const shell_1 = require("@things-factory/shell");
+const role_js_1 = require("../role/role.js");
+const user_js_1 = require("../user/user.js");
+const ORMCONFIG = env_1.config.get('ormconfig', {});
+const DATABASE_TYPE = ORMCONFIG.type;
+var AccessRequestStatus;
+(function (AccessRequestStatus) {
+    AccessRequestStatus["PENDING"] = "PENDING";
+    AccessRequestStatus["GRANTED"] = "GRANTED";
+    AccessRequestStatus["DENIED"] = "DENIED";
+    AccessRequestStatus["WITHDRAWN"] = "WITHDRAWN";
+    AccessRequestStatus["EXPIRED"] = "EXPIRED";
+})(AccessRequestStatus || (exports.AccessRequestStatus = AccessRequestStatus = {}));
+(0, type_graphql_1.registerEnumType)(AccessRequestStatus, {
+    name: 'AccessRequestStatus',
+    description: 'Where an access request stands: waiting, granted, denied, withdrawn by the requester, or expired unanswered.'
+});
+/*
+ * A person refused for want of a role asks for the privilege (ADR-0103, docs/design/access-request.md).
+ *
+ * ── The row is the record ────────────────────────────────────────────────
+ * Who asked, for what, why, who decided, which role, why not - all here, and never deleted. A notification
+ * is a courtesy on top: it is not stored per person and does nothing where FCM is not set up.
+ *
+ * ── At most one pending per person and privilege ─────────────────────────
+ * Asking again bumps `count` and `lastRequestedAt` instead of adding a row. A partial unique index would say
+ * it and is not portable across the databases this framework supports, so it is held where the request is
+ * made (as `Invitation` does). The index below is for reading.
+ */
+let AccessRequest = class AccessRequest {
+};
+exports.AccessRequest = AccessRequest;
+tslib_1.__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    (0, type_graphql_1.Field)(type => type_graphql_1.ID, { description: 'Unique identifier for the access request.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => shell_1.Domain),
+    (0, type_graphql_1.Field)(type => shell_1.Domain, { description: 'The domain the privilege is asked in.' }),
+    tslib_1.__metadata("design:type", shell_1.Domain)
+], AccessRequest.prototype, "domain", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((request) => request.domain),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "domainId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => user_js_1.User),
+    (0, type_graphql_1.Field)(type => user_js_1.User, { description: 'The person who asked.' }),
+    tslib_1.__metadata("design:type", user_js_1.User)
+], AccessRequest.prototype, "requester", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((request) => request.requester),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "requesterId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)(),
+    (0, type_graphql_1.Field)({ description: 'The category of the privilege asked for, as the refusal carried it.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "category", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)(),
+    (0, type_graphql_1.Field)({ description: 'The privilege asked for, as the refusal carried it.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "privilege", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The operation that was refused - shown to the person deciding.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "operationName", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: "The requester's reason." }),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "reason", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ type: 'int', default: 1 }),
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'How many times it was asked while pending.' }),
+    tslib_1.__metadata("design:type", Number)
+], AccessRequest.prototype, "count", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'When it was last asked.' }),
+    tslib_1.__metadata("design:type", Date
+    /* The same column shape as Invitation.status - an enum where the database has one, a string elsewhere. */
+    )
+], AccessRequest.prototype, "lastRequestedAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({
+        type: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
+            ? 'enum'
+            : DATABASE_TYPE == 'oracle'
+                ? 'varchar2'
+                : DATABASE_TYPE == 'mssql'
+                    ? 'nvarchar'
+                    : 'varchar',
+        enum: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? AccessRequestStatus : undefined,
+        length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,
+        default: AccessRequestStatus.PENDING
+    }),
+    (0, type_graphql_1.Field)(type => AccessRequestStatus, { description: 'Where the request stands.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "state", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'When a pending request expires unanswered.' }),
+    tslib_1.__metadata("design:type", Date)
+], AccessRequest.prototype, "expiresAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => user_js_1.User, { nullable: true }),
+    (0, type_graphql_1.Field)(type => user_js_1.User, { nullable: true, description: 'Who decided it.' }),
+    tslib_1.__metadata("design:type", user_js_1.User)
+], AccessRequest.prototype, "decidedBy", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((request) => request.decidedBy),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "decidedById", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'When it was decided.' }),
+    tslib_1.__metadata("design:type", Date)
+], AccessRequest.prototype, "decidedAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: "The decider's reason - required to deny." }),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "decisionReason", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => role_js_1.Role, { nullable: true }),
+    (0, type_graphql_1.Field)(type => role_js_1.Role, { nullable: true, description: 'The role the requester was put into.' }),
+    tslib_1.__metadata("design:type", role_js_1.Role)
+], AccessRequest.prototype, "grantedRole", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((request) => request.grantedRole),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "grantedRoleId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.CreateDateColumn)(),
+    (0, type_graphql_1.Field)({ description: 'When it was first asked.' }),
+    tslib_1.__metadata("design:type", Date)
+], AccessRequest.prototype, "createdAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.UpdateDateColumn)(),
+    (0, type_graphql_1.Field)({ description: 'When it last changed.' }),
+    tslib_1.__metadata("design:type", Date)
+], AccessRequest.prototype, "updatedAt", void 0);
+exports.AccessRequest = AccessRequest = tslib_1.__decorate([
+    (0, typeorm_1.Entity)(),
+    (0, typeorm_1.Index)('ix_access_request_0', (request) => [request.domain, request.state]),
+    (0, typeorm_1.Index)('ix_access_request_1', (request) => [request.domain, request.requester, request.category, request.privilege]),
+    (0, type_graphql_1.ObjectType)({ description: 'A request by a person refused for want of a role, for one privilege in this domain.' })
+], AccessRequest);
+//# sourceMappingURL=access-request.js.map

package/dist-server/service/access-request/access-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-request.js","sourceRoot":"","sources":["../../../server/service/access-request/access-request.ts"],"names":[],"mappings":";;;;AAAA,qCASgB;AAChB,+CAA2E;AAE3E,6CAA4C;AAC5C,iDAA8C;AAE9C,6CAAsC;AACtC,6CAAsC;AAEtC,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AAC7C,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAA;AAEpC,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;IACnB,wCAAiB,CAAA;IACjB,8CAAuB,CAAA;IACvB,0CAAmB,CAAA;AACrB,CAAC,EANW,mBAAmB,mCAAnB,mBAAmB,QAM9B;AAED,IAAA,+BAAgB,EAAC,mBAAmB,EAAE;IACpC,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EAAE,8GAA8G;CAC5H,CAAC,CAAA;AAEF;;;;;;;;;;;GAWG;AAKI,IAAM,aAAa,GAAnB,MAAM,aAAa;CA8FzB,CAAA;AA9FY,sCAAa;AAGf;IAFR,IAAA,gCAAsB,EAAC,MAAM,CAAC;IAC9B,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAE,EAAE,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;yCAC7D;AAInB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IACzB,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,EAAE,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC;sCACxE,cAAM;6CAAA;AAGd;IADC,IAAA,oBAAU,EAAC,CAAC,OAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;;+CACvC;AAIhB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACvB,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;sCACnD,cAAI;gDAAA;AAGf;IADC,IAAA,oBAAU,EAAC,CAAC,OAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;;kDACvC;AAInB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,qEAAqE,EAAE,CAAC;;+CAC9E;AAIhB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;;gDAC7D;AAIjB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,gEAAgE,EAAE,CAAC;;oDACnF;AAItB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;;6CACnD;AAIf;IAFC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACnC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;;4CACrE;AAIb;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;sCAChD,IAAI;IAEtB,0GAA0G;;sDAFpF;AAkBtB;IAfC,IAAA,gBAAM,EAAC;QACN,IAAI,EACF,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS;YACnF,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,aAAa,IAAI,QAAQ;gBACzB,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,aAAa,IAAI,OAAO;oBACxB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,SAAS;QACnB,IAAI,EACF,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS;QACzH,MAAM,EAAE,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QAC9G,OAAO,EAAE,mBAAmB,CAAC,OAAO;KACrC,CAAC;IACD,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,EAAE,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;;4CACvD;AAI1B;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;sCACzE,IAAI;gDAAA;AAIhB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;sCAC5D,cAAI;gDAAA;AAGhB;IADC,IAAA,oBAAU,EAAC,CAAC,OAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;;kDACtC;AAIpB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;sCACnD,IAAI;gDAAA;AAIhB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;;qDAC5D;AAIvB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;sCAC/E,cAAI;kDAAA;AAGlB;IADC,IAAA,oBAAU,EAAC,CAAC,OAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;;oDACtC;AAItB;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;sCACxC,IAAI;gDAAA;AAIf;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;sCACrC,IAAI;gDAAA;wBA7FJ,aAAa;IAJzB,IAAA,gBAAM,GAAE;IACR,IAAA,eAAK,EAAC,qBAAqB,EAAE,CAAC,OAAsB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACzF,IAAA,eAAK,EAAC,qBAAqB,EAAE,CAAC,OAAsB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAClI,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,qFAAqF,EAAE,CAAC;GACtG,aAAa,CA8FzB","sourcesContent":["import {\n  Column,\n  CreateDateColumn,\n  Entity,\n  Index,\n  ManyToOne,\n  PrimaryGeneratedColumn,\n  RelationId,\n  UpdateDateColumn\n} from 'typeorm'\nimport { Field, ID, Int, ObjectType, registerEnumType } from 'type-graphql'\n\nimport { config } from '@things-factory/env'\nimport { Domain } from '@things-factory/shell'\n\nimport { Role } from '../role/role.js'\nimport { User } from '../user/user.js'\n\nconst ORMCONFIG = config.get('ormconfig', {})\nconst DATABASE_TYPE = ORMCONFIG.type\n\nexport enum AccessRequestStatus {\n  PENDING = 'PENDING',\n  GRANTED = 'GRANTED',\n  DENIED = 'DENIED',\n  WITHDRAWN = 'WITHDRAWN',\n  EXPIRED = 'EXPIRED'\n}\n\nregisterEnumType(AccessRequestStatus, {\n  name: 'AccessRequestStatus',\n  description: 'Where an access request stands: waiting, granted, denied, withdrawn by the requester, or expired unanswered.'\n})\n\n/*\n * A person refused for want of a role asks for the privilege (ADR-0103, docs/design/access-request.md).\n *\n * ── The row is the record ────────────────────────────────────────────────\n * Who asked, for what, why, who decided, which role, why not - all here, and never deleted. A notification\n * is a courtesy on top: it is not stored per person and does nothing where FCM is not set up.\n *\n * ── At most one pending per person and privilege ─────────────────────────\n * Asking again bumps `count` and `lastRequestedAt` instead of adding a row. A partial unique index would say\n * it and is not portable across the databases this framework supports, so it is held where the request is\n * made (as `Invitation` does). The index below is for reading.\n */\n@Entity()\n@Index('ix_access_request_0', (request: AccessRequest) => [request.domain, request.state])\n@Index('ix_access_request_1', (request: AccessRequest) => [request.domain, request.requester, request.category, request.privilege])\n@ObjectType({ description: 'A request by a person refused for want of a role, for one privilege in this domain.' })\nexport class AccessRequest {\n  @PrimaryGeneratedColumn('uuid')\n  @Field(type => ID, { description: 'Unique identifier for the access request.' })\n  readonly id: string\n\n  @ManyToOne(type => Domain)\n  @Field(type => Domain, { description: 'The domain the privilege is asked in.' })\n  domain: Domain\n\n  @RelationId((request: AccessRequest) => request.domain)\n  domainId: string\n\n  @ManyToOne(type => User)\n  @Field(type => User, { description: 'The person who asked.' })\n  requester: User\n\n  @RelationId((request: AccessRequest) => request.requester)\n  requesterId: string\n\n  @Column()\n  @Field({ description: 'The category of the privilege asked for, as the refusal carried it.' })\n  category: string\n\n  @Column()\n  @Field({ description: 'The privilege asked for, as the refusal carried it.' })\n  privilege: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'The operation that was refused - shown to the person deciding.' })\n  operationName?: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: \"The requester's reason.\" })\n  reason?: string\n\n  @Column({ type: 'int', default: 1 })\n  @Field(type => Int, { description: 'How many times it was asked while pending.' })\n  count: number\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'When it was last asked.' })\n  lastRequestedAt?: Date\n\n  /* The same column shape as Invitation.status - an enum where the database has one, a string elsewhere. */\n  @Column({\n    type:\n      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'\n        ? 'enum'\n        : DATABASE_TYPE == 'oracle'\n          ? 'varchar2'\n          : DATABASE_TYPE == 'mssql'\n            ? 'nvarchar'\n            : 'varchar',\n    enum:\n      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? AccessRequestStatus : undefined,\n    length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,\n    default: AccessRequestStatus.PENDING\n  })\n  @Field(type => AccessRequestStatus, { description: 'Where the request stands.' })\n  state: AccessRequestStatus\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'When a pending request expires unanswered.' })\n  expiresAt?: Date\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field(type => User, { nullable: true, description: 'Who decided it.' })\n  decidedBy?: User\n\n  @RelationId((request: AccessRequest) => request.decidedBy)\n  decidedById?: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'When it was decided.' })\n  decidedAt?: Date\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: \"The decider's reason - required to deny.\" })\n  decisionReason?: string\n\n  @ManyToOne(type => Role, { nullable: true })\n  @Field(type => Role, { nullable: true, description: 'The role the requester was put into.' })\n  grantedRole?: Role\n\n  @RelationId((request: AccessRequest) => request.grantedRole)\n  grantedRoleId?: string\n\n  @CreateDateColumn()\n  @Field({ description: 'When it was first asked.' })\n  createdAt: Date\n\n  @UpdateDateColumn()\n  @Field({ description: 'When it last changed.' })\n  updatedAt: Date\n}\n"]}

package/dist-server/service/access-request/index.d.ts

@@ -0,0 +1,5 @@
+import { AccessRequest } from './access-request.js';
+import { AccessRequestMutation } from './access-request-mutation.js';
+import { AccessRequestQuery } from './access-request-query.js';
+export declare const entities: (typeof AccessRequest)[];
+export declare const resolvers: (typeof AccessRequestQuery | typeof AccessRequestMutation)[];

package/dist-server/service/access-request/index.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvers = exports.entities = void 0;
+const access_request_js_1 = require("./access-request.js");
+const access_request_mutation_js_1 = require("./access-request-mutation.js");
+const access_request_query_js_1 = require("./access-request-query.js");
+exports.entities = [access_request_js_1.AccessRequest];
+exports.resolvers = [access_request_query_js_1.AccessRequestQuery, access_request_mutation_js_1.AccessRequestMutation];
+//# sourceMappingURL=index.js.map

package/dist-server/service/access-request/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/service/access-request/index.ts"],"names":[],"mappings":";;;AAAA,2DAAmD;AACnD,6EAAoE;AACpE,uEAA8D;AAEjD,QAAA,QAAQ,GAAG,CAAC,iCAAa,CAAC,CAAA;AAC1B,QAAA,SAAS,GAAG,CAAC,4CAAkB,EAAE,kDAAqB,CAAC,CAAA","sourcesContent":["import { AccessRequest } from './access-request.js'\nimport { AccessRequestMutation } from './access-request-mutation.js'\nimport { AccessRequestQuery } from './access-request-query.js'\n\nexport const entities = [AccessRequest]\nexport const resolvers = [AccessRequestQuery, AccessRequestMutation]\n"]}

package/dist-server/service/index.d.ts

@@ -20,6 +20,7 @@ export * from './login-history/login-history.js';
 export * from './web-auth-credential/web-auth-credential.js';
 export * from './domain-link/domain-link.js';
 export * from './domain-owner/domain-owner.js';
+export * from './access-request/access-request.js';
 export * from './app-binding/app-binding-types.js';
 export * from './appliance/appliance-types.js';
 export * from './application/application-types.js';
@@ -30,7 +31,8 @@ export * from './privilege/privilege-types.js';
 export * from './role/role-types.js';
 export * from './user/user-types.js';
 export * from './domain-link/domain-link-types.js';
-export declare const entities: (typeof import("./web-auth-credential/web-auth-credential.js").WebAuthCredential | typeof import("./user/user.js").User | typeof import("./auth-provider/auth-provider.js").AuthProvider | typeof import("./users-auth-providers/users-auth-providers.js").UsersAuthProviders | typeof import("./domain-owner/domain-owner.js").DomainOwner | typeof import("./granted-role/granted-role.js").GrantedRole | typeof import("./role/role.js").Role | typeof import("./privilege/privilege.js").Privilege | typeof import("./password-history/password-history.js").PasswordHistory | typeof import("./verification-token/verification-token.js").VerificationToken | typeof import("./verification-token/verification-token.js").VerificationTokenType | typeof import("./invitation/invitation.js").Invitation | typeof import("./application/application.js").Application | typeof import("./login-history/login-history.js").LoginHistory | typeof import("./appliance/appliance.js").Appliance | typeof import("./partner/partner.js").Partner | typeof import("./domain-link/domain-link.js").DomainLink)[];
+export * from './access-request/access-request-types.js';
+export declare const entities: (typeof import("./access-request/access-request.js").AccessRequest | typeof import("./users-auth-providers/users-auth-providers.js").UsersAuthProviders | typeof import("./auth-provider/auth-provider.js").AuthProvider | typeof import("./application/application.js").Application | typeof import("./appliance/appliance.js").Appliance | typeof import("./privilege/privilege.js").Privilege | typeof import("./role/role.js").Role | typeof import("./user/user.js").User | typeof import("./partner/partner.js").Partner | typeof import("./granted-role/granted-role.js").GrantedRole | typeof import("./invitation/invitation.js").Invitation | typeof import("./password-history/password-history.js").PasswordHistory | typeof import("./verification-token/verification-token.js").VerificationToken | typeof import("./verification-token/verification-token.js").VerificationTokenType | typeof import("./login-history/login-history.js").LoginHistory | typeof import("./web-auth-credential/web-auth-credential.js").WebAuthCredential | typeof import("./domain-link/domain-link.js").DomainLink | typeof import("./domain-owner/domain-owner.js").DomainOwner)[];
 export declare const schema: {
     typeDefs: {
         privilegeDirectiveTypeDefs: import("graphql").DocumentNode;

package/dist-server/service/index.js

@@ -3,27 +3,28 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = exports.entities = exports.privilegeOfField = void 0;
 const tslib_1 = require("tslib");
 /* IMPORT ENTITIES AND RESOLVERS */
-const index_js_1 = require("./users-auth-providers/index.js");
-const index_js_2 = require("./auth-provider/index.js");
-const index_js_3 = require("./app-binding/index.js");
-const index_js_4 = require("./appliance/index.js");
-const index_js_5 = require("./application/index.js");
-const index_js_6 = require("./domain-generator/index.js");
-const index_js_7 = require("./granted-role/index.js");
-const index_js_8 = require("./invitation/index.js");
-const index_js_9 = require("./login-history/index.js");
-const index_js_10 = require("./partner/index.js");
-const index_js_11 = require("./password-history/index.js");
-const index_js_12 = require("./privilege/index.js");
+const index_js_1 = require("./access-request/index.js");
+const index_js_2 = require("./users-auth-providers/index.js");
+const index_js_3 = require("./auth-provider/index.js");
+const index_js_4 = require("./app-binding/index.js");
+const index_js_5 = require("./appliance/index.js");
+const index_js_6 = require("./application/index.js");
+const index_js_7 = require("./domain-generator/index.js");
+const index_js_8 = require("./granted-role/index.js");
+const index_js_9 = require("./invitation/index.js");
+const index_js_10 = require("./login-history/index.js");
+const index_js_11 = require("./partner/index.js");
+const index_js_12 = require("./password-history/index.js");
+const index_js_13 = require("./privilege/index.js");
 const privilege_directive_js_1 = require("./privilege/privilege-directive.js");
 const open_fields_js_1 = require("./open-fields.js");
-const index_js_13 = require("./role/index.js");
-const index_js_14 = require("./role-template/index.js");
-const index_js_15 = require("./user/index.js");
-const index_js_16 = require("./verification-token/index.js");
-const index_js_17 = require("./web-auth-credential/index.js");
-const index_js_18 = require("./domain-link/index.js");
-const index_js_19 = require("./domain-owner/index.js");
+const index_js_14 = require("./role/index.js");
+const index_js_15 = require("./role-template/index.js");
+const index_js_16 = require("./user/index.js");
+const index_js_17 = require("./verification-token/index.js");
+const index_js_18 = require("./web-auth-credential/index.js");
+const index_js_19 = require("./domain-link/index.js");
+const index_js_20 = require("./domain-owner/index.js");
 /* EXPORT ENTITY TYPES */
 tslib_1.__exportStar(require("./users-auth-providers/users-auth-providers.js"), exports);
 tslib_1.__exportStar(require("./auth-provider/auth-provider.js"), exports);
@@ -48,6 +49,7 @@ tslib_1.__exportStar(require("./login-history/login-history.js"), exports);
 tslib_1.__exportStar(require("./web-auth-credential/web-auth-credential.js"), exports);
 tslib_1.__exportStar(require("./domain-link/domain-link.js"), exports);
 tslib_1.__exportStar(require("./domain-owner/domain-owner.js"), exports);
+tslib_1.__exportStar(require("./access-request/access-request.js"), exports);
 /* EXPORT TYPES */
 tslib_1.__exportStar(require("./app-binding/app-binding-types.js"), exports);
 tslib_1.__exportStar(require("./appliance/appliance-types.js"), exports);
@@ -59,24 +61,26 @@ tslib_1.__exportStar(require("./privilege/privilege-types.js"), exports);
 tslib_1.__exportStar(require("./role/role-types.js"), exports);
 tslib_1.__exportStar(require("./user/user-types.js"), exports);
 tslib_1.__exportStar(require("./domain-link/domain-link-types.js"), exports);
+tslib_1.__exportStar(require("./access-request/access-request-types.js"), exports);
 exports.entities = [
     /* ENTITIES */
-    ...index_js_1.entities,
     ...index_js_2.entities,
+    ...index_js_3.entities,
+    ...index_js_6.entities,
     ...index_js_5.entities,
-    ...index_js_4.entities,
-    ...index_js_12.entities,
     ...index_js_13.entities,
-    ...index_js_15.entities,
-    ...index_js_10.entities,
-    ...index_js_7.entities,
-    ...index_js_8.entities,
-    ...index_js_11.entities,
+    ...index_js_14.entities,
     ...index_js_16.entities,
+    ...index_js_11.entities,
+    ...index_js_8.entities,
     ...index_js_9.entities,
+    ...index_js_12.entities,
     ...index_js_17.entities,
+    ...index_js_10.entities,
     ...index_js_18.entities,
-    ...index_js_19.entities
+    ...index_js_19.entities,
+    ...index_js_20.entities,
+    ...index_js_1.entities
 ];
 exports.schema = {
     typeDefs: {
@@ -86,22 +90,23 @@ exports.schema = {
     openFields: open_fields_js_1.openFields,
     resolverClasses: [
         /* RESOLVER CLASSES */
-        ...index_js_1.resolvers,
         ...index_js_2.resolvers,
+        ...index_js_3.resolvers,
+        ...index_js_6.resolvers,
         ...index_js_5.resolvers,
-        ...index_js_4.resolvers,
-        ...index_js_12.resolvers,
         ...index_js_13.resolvers,
         ...index_js_14.resolvers,
         ...index_js_15.resolvers,
-        ...index_js_10.resolvers,
-        ...index_js_7.resolvers,
+        ...index_js_16.resolvers,
+        ...index_js_11.resolvers,
         ...index_js_8.resolvers,
-        ...index_js_3.resolvers,
-        ...index_js_6.resolvers,
         ...index_js_9.resolvers,
-        ...index_js_18.resolvers,
-        ...index_js_19.resolvers
+        ...index_js_4.resolvers,
+        ...index_js_7.resolvers,
+        ...index_js_10.resolvers,
+        ...index_js_19.resolvers,
+        ...index_js_20.resolvers,
+        ...index_js_1.resolvers
     ],
     directives: {
         privilege: privilege_directive_js_1.privilegeDirectiveResolver

package/dist-server/service/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/service/index.ts"],"names":[],"mappings":";;;;AAAA,mCAAmC;AACnC,8DAGwC;AACxC,uDAA+G;AAC/G,qDAAwE;AACxE,mDAAqG;AACrG,qDAA2G;AAC3G,0DAAkF;AAClF,sDAA2G;AAC3G,oDAAuG;AACvG,uDAA8G;AAC9G,kDAA+F;AAC/F,2DAAiF;AACjF,oDAAqG;AACrG,+EAA2G;AAC3G,qDAA6C;AAC7C,+CAAsF;AACtF,wDAA6E;AAC7E,+CAAsF;AACtF,6DAAqF;AACrF,8DAAsF;AACtF,sDAAwG;AACxG,uDAA4G;AAE5G,yBAAyB;AACzB,yFAA8D;AAC9D,2EAAgD;AAChD,uEAA4C;AAC5C,mEAAwC;AACxC,mEAAwC;AACxC,yDAA8B;AAC9B,wEAA6C;AAC7C,gHAAgH;AAChH,6EAAqF;AAA5E,0HAAA,gBAAgB,OAAA;AAGzB,2EAAgD;AAChD,iFAAsD;AACtD,yDAA8B;AAC9B,+DAAoC;AACpC,yEAA8C;AAC9C,qEAA0C;AAC1C,uEAA4C;AAC5C,iFAAsD;AACtD,qFAA0D;AAC1D,2EAAgD;AAChD,uFAA4D;AAC5D,uEAA4C;AAC5C,yEAA8C;AAE9C,kBAAkB;AAClB,6EAAkD;AAClD,yEAA8C;AAC9C,6EAAkD;AAClD,uFAA4D;AAC5D,2EAAgD;AAChD,qEAA0C;AAC1C,yEAA8C;AAC9C,+DAAoC;AACpC,+DAAoC;AACpC,6EAAkD;AAErC,QAAA,QAAQ,GAAG;IACtB,cAAc;IACd,GAAG,mBAA0B;IAC7B,GAAG,mBAAoB;IACvB,GAAG,mBAAmB;IACtB,GAAG,mBAAiB;IACpB,GAAG,oBAAiB;IACpB,GAAG,oBAAY;IACf,GAAG,oBAAY;IACf,GAAG,oBAAe;IAClB,GAAG,mBAAmB;IACtB,GAAG,mBAAkB;IACrB,GAAG,oBAAuB;IAC1B,GAAG,oBAAyB;IAC5B,GAAG,mBAAoB;IACvB,GAAG,oBAAyB;IAC5B,GAAG,oBAAkB;IACrB,GAAG,oBAAmB;CACvB,CAAA;AAEY,QAAA,MAAM,GAAG;IACpB,QAAQ,EAAE;QACR,0BAA0B,EAA1B,mDAA0B;KAC3B;IAED,6FAA6F;IAC7F,UAAU,EAAV,2BAAU;IAEV,eAAe,EAAE;QACf,sBAAsB;QACtB,GAAG,oBAA2B;QAC9B,GAAG,oBAAqB;QACxB,GAAG,oBAAoB;QACvB,GAAG,oBAAkB;QACrB,GAAG,qBAAkB;QACrB,GAAG,qBAAa;QAChB,GAAG,qBAAqB;QACxB,GAAG,qBAAa;QAChB,GAAG,qBAAgB;QACnB,GAAG,oBAAmB;QACtB,GAAG,oBAAkB;QACrB,GAAG,oBAAkB;QACrB,GAAG,oBAAuB;QAC1B,GAAG,oBAAoB;QACvB,GAAG,qBAAkB;QACrB,GAAG,qBAAoB;KACxB;IACD,UAAU,EAAE;QACV,SAAS,EAAE,mDAA0B;KACtC;CACF,CAAA","sourcesContent":["/* IMPORT ENTITIES AND RESOLVERS */\nimport {\n  entities as UsersAuthProvidersEntities,\n  resolvers as UsersAuthProvidersResolvers\n} from './users-auth-providers/index.js'\nimport { entities as AuthProviderEntities, resolvers as AuthProviderResolvers } from './auth-provider/index.js'\nimport { resolvers as AppbindingResolver } from './app-binding/index.js'\nimport { entities as ApplianceEntities, resolvers as ApplianceResolvers } from './appliance/index.js'\nimport { entities as ApplicationEntities, resolvers as ApplicationResolvers } from './application/index.js'\nimport { resolvers as DomainGeneratorResolver } from './domain-generator/index.js'\nimport { entities as GrantedRoleEntities, resolvers as GrantedRoleResolver } from './granted-role/index.js'\nimport { entities as InvitationEntities, resolvers as InvitationResolver } from './invitation/index.js'\nimport { entities as LoginHistoryEntities, resolvers as LoginHistoryResolver } from './login-history/index.js'\nimport { entities as PartnerEntities, resolvers as PartnerResolvers } from './partner/index.js'\nimport { entities as PasswordHistoryEntities } from './password-history/index.js'\nimport { entities as PrivilegeEntities, resolvers as PrivilegeResolvers } from './privilege/index.js'\nimport { privilegeDirectiveResolver, privilegeDirectiveTypeDefs } from './privilege/privilege-directive.js'\nimport { openFields } from './open-fields.js'\nimport { entities as RoleEntities, resolvers as RoleResolvers } from './role/index.js'\nimport { resolvers as RoleTemplateResolvers } from './role-template/index.js'\nimport { entities as UserEntities, resolvers as UserResolvers } from './user/index.js'\nimport { entities as VerificationTokenEntities } from './verification-token/index.js'\nimport { entities as WebAuthCredentialEntities } from './web-auth-credential/index.js'\nimport { entities as DomainLinkEntities, resolvers as DomainLinkResolver } from './domain-link/index.js'\nimport { entities as DomainOwnerEntities, resolvers as DomainOwnerResolvers } from './domain-owner/index.js'\n\n/* EXPORT ENTITY TYPES */\nexport * from './users-auth-providers/users-auth-providers.js'\nexport * from './auth-provider/auth-provider.js'\nexport * from './application/application.js'\nexport * from './appliance/appliance.js'\nexport * from './privilege/privilege.js'\nexport * from './role/role.js'\nexport * from './privilege/privilege-axis.js'\n/* What a field asks for, by name — for another entrance to the same door (operato-twin ADR-0072 decision 5). */\nexport { privilegeOfField, type FieldGate } from './privilege/privilege-directive.js'\n/* How a module declares the fields it leaves open — see `privilege/open-field-rule.ts`. */\nexport { type OpenFieldsDeclaration } from './privilege/open-field-rule.js'\nexport * from './role-template/role-template.js'\nexport * from './role-template/role-template-types.js'\nexport * from './user/user.js'\nexport * from './partner/partner.js'\nexport * from './granted-role/granted-role.js'\nexport * from './invitation/invitation.js'\nexport * from './app-binding/app-binding.js'\nexport * from './password-history/password-history.js'\nexport * from './verification-token/verification-token.js'\nexport * from './login-history/login-history.js'\nexport * from './web-auth-credential/web-auth-credential.js'\nexport * from './domain-link/domain-link.js'\nexport * from './domain-owner/domain-owner.js'\n\n/* EXPORT TYPES */\nexport * from './app-binding/app-binding-types.js'\nexport * from './appliance/appliance-types.js'\nexport * from './application/application-types.js'\nexport * from './domain-generator/domain-generator-types.js'\nexport * from './invitation/invitation-types.js'\nexport * from './partner/partner-types.js'\nexport * from './privilege/privilege-types.js'\nexport * from './role/role-types.js'\nexport * from './user/user-types.js'\nexport * from './domain-link/domain-link-types.js'\n\nexport const entities = [\n  /* ENTITIES */\n  ...UsersAuthProvidersEntities,\n  ...AuthProviderEntities,\n  ...ApplicationEntities,\n  ...ApplianceEntities,\n  ...PrivilegeEntities,\n  ...RoleEntities,\n  ...UserEntities,\n  ...PartnerEntities,\n  ...GrantedRoleEntities,\n  ...InvitationEntities,\n  ...PasswordHistoryEntities,\n  ...VerificationTokenEntities,\n  ...LoginHistoryEntities,\n  ...WebAuthCredentialEntities,\n  ...DomainLinkEntities,\n  ...DomainOwnerEntities\n]\n\nexport const schema = {\n  typeDefs: {\n    privilegeDirectiveTypeDefs\n  },\n\n  /* The fields that carry no @privilege, and why — `open-fields.ts`, read by the directive. */\n  openFields,\n\n  resolverClasses: [\n    /* RESOLVER CLASSES */\n    ...UsersAuthProvidersResolvers,\n    ...AuthProviderResolvers,\n    ...ApplicationResolvers,\n    ...ApplianceResolvers,\n    ...PrivilegeResolvers,\n    ...RoleResolvers,\n    ...RoleTemplateResolvers,\n    ...UserResolvers,\n    ...PartnerResolvers,\n    ...GrantedRoleResolver,\n    ...InvitationResolver,\n    ...AppbindingResolver,\n    ...DomainGeneratorResolver,\n    ...LoginHistoryResolver,\n    ...DomainLinkResolver,\n    ...DomainOwnerResolvers\n  ],\n  directives: {\n    privilege: privilegeDirectiveResolver\n  }\n}\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/service/index.ts"],"names":[],"mappings":";;;;AAAA,mCAAmC;AACnC,wDAAkH;AAClH,8DAGwC;AACxC,uDAA+G;AAC/G,qDAAwE;AACxE,mDAAqG;AACrG,qDAA2G;AAC3G,0DAAkF;AAClF,sDAA2G;AAC3G,oDAAuG;AACvG,wDAA8G;AAC9G,kDAA+F;AAC/F,2DAAiF;AACjF,oDAAqG;AACrG,+EAA2G;AAC3G,qDAA6C;AAC7C,+CAAsF;AACtF,wDAA6E;AAC7E,+CAAsF;AACtF,6DAAqF;AACrF,8DAAsF;AACtF,sDAAwG;AACxG,uDAA4G;AAE5G,yBAAyB;AACzB,yFAA8D;AAC9D,2EAAgD;AAChD,uEAA4C;AAC5C,mEAAwC;AACxC,mEAAwC;AACxC,yDAA8B;AAC9B,wEAA6C;AAC7C,gHAAgH;AAChH,6EAAqF;AAA5E,0HAAA,gBAAgB,OAAA;AAGzB,2EAAgD;AAChD,iFAAsD;AACtD,yDAA8B;AAC9B,+DAAoC;AACpC,yEAA8C;AAC9C,qEAA0C;AAC1C,uEAA4C;AAC5C,iFAAsD;AACtD,qFAA0D;AAC1D,2EAAgD;AAChD,uFAA4D;AAC5D,uEAA4C;AAC5C,yEAA8C;AAC9C,6EAAkD;AAElD,kBAAkB;AAClB,6EAAkD;AAClD,yEAA8C;AAC9C,6EAAkD;AAClD,uFAA4D;AAC5D,2EAAgD;AAChD,qEAA0C;AAC1C,yEAA8C;AAC9C,+DAAoC;AACpC,+DAAoC;AACpC,6EAAkD;AAClD,mFAAwD;AAE3C,QAAA,QAAQ,GAAG;IACtB,cAAc;IACd,GAAG,mBAA0B;IAC7B,GAAG,mBAAoB;IACvB,GAAG,mBAAmB;IACtB,GAAG,mBAAiB;IACpB,GAAG,oBAAiB;IACpB,GAAG,oBAAY;IACf,GAAG,oBAAY;IACf,GAAG,oBAAe;IAClB,GAAG,mBAAmB;IACtB,GAAG,mBAAkB;IACrB,GAAG,oBAAuB;IAC1B,GAAG,oBAAyB;IAC5B,GAAG,oBAAoB;IACvB,GAAG,oBAAyB;IAC5B,GAAG,oBAAkB;IACrB,GAAG,oBAAmB;IACtB,GAAG,mBAAqB;CACzB,CAAA;AAEY,QAAA,MAAM,GAAG;IACpB,QAAQ,EAAE;QACR,0BAA0B,EAA1B,mDAA0B;KAC3B;IAED,6FAA6F;IAC7F,UAAU,EAAV,2BAAU;IAEV,eAAe,EAAE;QACf,sBAAsB;QACtB,GAAG,oBAA2B;QAC9B,GAAG,oBAAqB;QACxB,GAAG,oBAAoB;QACvB,GAAG,oBAAkB;QACrB,GAAG,qBAAkB;QACrB,GAAG,qBAAa;QAChB,GAAG,qBAAqB;QACxB,GAAG,qBAAa;QAChB,GAAG,qBAAgB;QACnB,GAAG,oBAAmB;QACtB,GAAG,oBAAkB;QACrB,GAAG,oBAAkB;QACrB,GAAG,oBAAuB;QAC1B,GAAG,qBAAoB;QACvB,GAAG,qBAAkB;QACrB,GAAG,qBAAoB;QACvB,GAAG,oBAAsB;KAC1B;IACD,UAAU,EAAE;QACV,SAAS,EAAE,mDAA0B;KACtC;CACF,CAAA","sourcesContent":["/* IMPORT ENTITIES AND RESOLVERS */\nimport { entities as AccessRequestEntities, resolvers as AccessRequestResolvers } from './access-request/index.js'\nimport {\n  entities as UsersAuthProvidersEntities,\n  resolvers as UsersAuthProvidersResolvers\n} from './users-auth-providers/index.js'\nimport { entities as AuthProviderEntities, resolvers as AuthProviderResolvers } from './auth-provider/index.js'\nimport { resolvers as AppbindingResolver } from './app-binding/index.js'\nimport { entities as ApplianceEntities, resolvers as ApplianceResolvers } from './appliance/index.js'\nimport { entities as ApplicationEntities, resolvers as ApplicationResolvers } from './application/index.js'\nimport { resolvers as DomainGeneratorResolver } from './domain-generator/index.js'\nimport { entities as GrantedRoleEntities, resolvers as GrantedRoleResolver } from './granted-role/index.js'\nimport { entities as InvitationEntities, resolvers as InvitationResolver } from './invitation/index.js'\nimport { entities as LoginHistoryEntities, resolvers as LoginHistoryResolver } from './login-history/index.js'\nimport { entities as PartnerEntities, resolvers as PartnerResolvers } from './partner/index.js'\nimport { entities as PasswordHistoryEntities } from './password-history/index.js'\nimport { entities as PrivilegeEntities, resolvers as PrivilegeResolvers } from './privilege/index.js'\nimport { privilegeDirectiveResolver, privilegeDirectiveTypeDefs } from './privilege/privilege-directive.js'\nimport { openFields } from './open-fields.js'\nimport { entities as RoleEntities, resolvers as RoleResolvers } from './role/index.js'\nimport { resolvers as RoleTemplateResolvers } from './role-template/index.js'\nimport { entities as UserEntities, resolvers as UserResolvers } from './user/index.js'\nimport { entities as VerificationTokenEntities } from './verification-token/index.js'\nimport { entities as WebAuthCredentialEntities } from './web-auth-credential/index.js'\nimport { entities as DomainLinkEntities, resolvers as DomainLinkResolver } from './domain-link/index.js'\nimport { entities as DomainOwnerEntities, resolvers as DomainOwnerResolvers } from './domain-owner/index.js'\n\n/* EXPORT ENTITY TYPES */\nexport * from './users-auth-providers/users-auth-providers.js'\nexport * from './auth-provider/auth-provider.js'\nexport * from './application/application.js'\nexport * from './appliance/appliance.js'\nexport * from './privilege/privilege.js'\nexport * from './role/role.js'\nexport * from './privilege/privilege-axis.js'\n/* What a field asks for, by name — for another entrance to the same door (operato-twin ADR-0072 decision 5). */\nexport { privilegeOfField, type FieldGate } from './privilege/privilege-directive.js'\n/* How a module declares the fields it leaves open — see `privilege/open-field-rule.ts`. */\nexport { type OpenFieldsDeclaration } from './privilege/open-field-rule.js'\nexport * from './role-template/role-template.js'\nexport * from './role-template/role-template-types.js'\nexport * from './user/user.js'\nexport * from './partner/partner.js'\nexport * from './granted-role/granted-role.js'\nexport * from './invitation/invitation.js'\nexport * from './app-binding/app-binding.js'\nexport * from './password-history/password-history.js'\nexport * from './verification-token/verification-token.js'\nexport * from './login-history/login-history.js'\nexport * from './web-auth-credential/web-auth-credential.js'\nexport * from './domain-link/domain-link.js'\nexport * from './domain-owner/domain-owner.js'\nexport * from './access-request/access-request.js'\n\n/* EXPORT TYPES */\nexport * from './app-binding/app-binding-types.js'\nexport * from './appliance/appliance-types.js'\nexport * from './application/application-types.js'\nexport * from './domain-generator/domain-generator-types.js'\nexport * from './invitation/invitation-types.js'\nexport * from './partner/partner-types.js'\nexport * from './privilege/privilege-types.js'\nexport * from './role/role-types.js'\nexport * from './user/user-types.js'\nexport * from './domain-link/domain-link-types.js'\nexport * from './access-request/access-request-types.js'\n\nexport const entities = [\n  /* ENTITIES */\n  ...UsersAuthProvidersEntities,\n  ...AuthProviderEntities,\n  ...ApplicationEntities,\n  ...ApplianceEntities,\n  ...PrivilegeEntities,\n  ...RoleEntities,\n  ...UserEntities,\n  ...PartnerEntities,\n  ...GrantedRoleEntities,\n  ...InvitationEntities,\n  ...PasswordHistoryEntities,\n  ...VerificationTokenEntities,\n  ...LoginHistoryEntities,\n  ...WebAuthCredentialEntities,\n  ...DomainLinkEntities,\n  ...DomainOwnerEntities,\n  ...AccessRequestEntities\n]\n\nexport const schema = {\n  typeDefs: {\n    privilegeDirectiveTypeDefs\n  },\n\n  /* The fields that carry no @privilege, and why — `open-fields.ts`, read by the directive. */\n  openFields,\n\n  resolverClasses: [\n    /* RESOLVER CLASSES */\n    ...UsersAuthProvidersResolvers,\n    ...AuthProviderResolvers,\n    ...ApplicationResolvers,\n    ...ApplianceResolvers,\n    ...PrivilegeResolvers,\n    ...RoleResolvers,\n    ...RoleTemplateResolvers,\n    ...UserResolvers,\n    ...PartnerResolvers,\n    ...GrantedRoleResolver,\n    ...InvitationResolver,\n    ...AppbindingResolver,\n    ...DomainGeneratorResolver,\n    ...LoginHistoryResolver,\n    ...DomainLinkResolver,\n    ...DomainOwnerResolvers,\n    ...AccessRequestResolvers\n  ],\n  directives: {\n    privilege: privilegeDirectiveResolver\n  }\n}\n"]}

package/dist-server/service/open-fields.js

@@ -18,7 +18,10 @@ exports.openFields = {
         'Query.checkResettablePasswordToDefault': "about the caller's own password",
         'Query.checkDefaultPassword': 'whether the caller is still on the default password',
         'Query.passwordRule': "the installation's password policy. The change-password screen needs it before the caller has any privilege — and after a forced reset they may have none",
-        'Query.authProviderTypes': "which provider types this build supports. A catalogue, not a tenant's configuration"
+        'Query.authProviderTypes': "which provider types this build supports. A catalogue, not a tenant's configuration",
+        'Query.myAccessRequests': "the caller's own access requests",
+        'Mutation.requestAccess': 'asked by someone refused for want of a role - a gate here would need the privilege being asked for. The door asks only for the caller and judges again that a role would open it (ADR-0103)',
+        'Mutation.withdrawAccessRequest': "withdraws the caller's own pending request and nobody else's"
     }
 };
 //# sourceMappingURL=open-fields.js.map

package/dist-server/service/open-fields.js.map

@@ -1 +1 @@
-{"version":3,"file":"open-fields.js","sourceRoot":"","sources":["../../server/service/open-fields.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AACU,QAAA,UAAU,GAA0B;IAC/C,QAAQ,EAAE;QACR,wBAAwB,EAAE,2BAA2B;QACrD,eAAe,EAAE,wBAAwB;QACzC,oBAAoB,EAAE,0EAA0E;QAChG,4BAA4B,EAAE,sCAAsC;QACpE,8BAA8B,EAAE,2CAA2C;QAC3E,wCAAwC,EAAE,iCAAiC;QAC3E,4BAA4B,EAAE,qDAAqD;QACnF,oBAAoB,EAClB,2JAA2J;QAC7J,yBAAyB,EAAE,qFAAqF;KACjH;CACF,CAAA","sourcesContent":["import type { OpenFieldsDeclaration } from './privilege/open-field-rule.js'\n\n/**\n * auth-base's root fields that declare no `@privilege` — every one of them, and why.\n *\n * There is no `notYetDeclared` here. The twelve that were open without a reason were closed on\n * 2026-09-20 (`c02ee9bdc1`); what is left answers about the caller, or about the installation\n * rather than anybody's data. An addition to this list needs its reason written first.\n */\nexport const openFields: OpenFieldsDeclaration = {\n  byDesign: {\n    'Query.myLoginHistories': \"the caller's own sign-ins\",\n    'Query.myRoles': \"the caller's own roles\",\n    'Query.hasPrivilege': 'whether the caller has one — a gate here would need the answer to itself',\n    'Query.domainsWithPrivilege': 'the domains where the caller has one',\n    'Query.checkUserBelongsDomain': 'whether the caller belongs to this domain',\n    'Query.checkResettablePasswordToDefault': \"about the caller's own password\",\n    'Query.checkDefaultPassword': 'whether the caller is still on the default password',\n    'Query.passwordRule':\n      \"the installation's password policy. The change-password screen needs it before the caller has any privilege — and after a forced reset they may have none\",\n    'Query.authProviderTypes': \"which provider types this build supports. A catalogue, not a tenant's configuration\"\n  }\n}\n"]}
+{"version":3,"file":"open-fields.js","sourceRoot":"","sources":["../../server/service/open-fields.ts"],"names":[],"mappings":";;;AAEA;;;;;;GAMG;AACU,QAAA,UAAU,GAA0B;IAC/C,QAAQ,EAAE;QACR,wBAAwB,EAAE,2BAA2B;QACrD,eAAe,EAAE,wBAAwB;QACzC,oBAAoB,EAAE,0EAA0E;QAChG,4BAA4B,EAAE,sCAAsC;QACpE,8BAA8B,EAAE,2CAA2C;QAC3E,wCAAwC,EAAE,iCAAiC;QAC3E,4BAA4B,EAAE,qDAAqD;QACnF,oBAAoB,EAClB,2JAA2J;QAC7J,yBAAyB,EAAE,qFAAqF;QAChH,wBAAwB,EAAE,kCAAkC;QAC5D,wBAAwB,EACtB,6LAA6L;QAC/L,gCAAgC,EAAE,8DAA8D;KACjG;CACF,CAAA","sourcesContent":["import type { OpenFieldsDeclaration } from './privilege/open-field-rule.js'\n\n/**\n * auth-base's root fields that declare no `@privilege` — every one of them, and why.\n *\n * There is no `notYetDeclared` here. The twelve that were open without a reason were closed on\n * 2026-09-20 (`c02ee9bdc1`); what is left answers about the caller, or about the installation\n * rather than anybody's data. An addition to this list needs its reason written first.\n */\nexport const openFields: OpenFieldsDeclaration = {\n  byDesign: {\n    'Query.myLoginHistories': \"the caller's own sign-ins\",\n    'Query.myRoles': \"the caller's own roles\",\n    'Query.hasPrivilege': 'whether the caller has one — a gate here would need the answer to itself',\n    'Query.domainsWithPrivilege': 'the domains where the caller has one',\n    'Query.checkUserBelongsDomain': 'whether the caller belongs to this domain',\n    'Query.checkResettablePasswordToDefault': \"about the caller's own password\",\n    'Query.checkDefaultPassword': 'whether the caller is still on the default password',\n    'Query.passwordRule':\n      \"the installation's password policy. The change-password screen needs it before the caller has any privilege — and after a forced reset they may have none\",\n    'Query.authProviderTypes': \"which provider types this build supports. A catalogue, not a tenant's configuration\",\n    'Query.myAccessRequests': \"the caller's own access requests\",\n    'Mutation.requestAccess':\n      'asked by someone refused for want of a role - a gate here would need the privilege being asked for. The door asks only for the caller and judges again that a role would open it (ADR-0103)',\n    'Mutation.withdrawAccessRequest': \"withdraws the caller's own pending request and nobody else's\"\n  }\n}\n"]}