@things-factory/auth-base 10.1.79 → 10.1.107

package/dist-server/service/access-request/access-request-query.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessRequestQuery = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+const shell_1 = require("@things-factory/shell");
+const access_request_js_1 = require("../../controllers/access-request.js");
+const access_request_js_2 = require("./access-request.js");
+const access_request_types_js_1 = require("./access-request-types.js");
+/* Reading the requests is reading who asks for what in this domain - the user screens' read privilege. */
+const READ = '@privilege(category: "user", privilege: "query", domainOwnerGranted: true)';
+/* The review and the candidates serve a decision - the deciding declaration. */
+const DECIDE = '@privilege(category: "user", privilege: "mutation", domainOwnerGranted: true)';
+let AccessRequestQuery = class AccessRequestQuery {
+    async accessRequests(params, context) {
+        const { domain } = context.state;
+        const queryBuilder = (0, shell_1.getQueryBuilderFromListParams)({
+            domain,
+            params,
+            repository: (0, shell_1.getRepository)(access_request_js_2.AccessRequest),
+            alias: 'accessRequest',
+            searchables: ['category', 'privilege', 'reason']
+        });
+        queryBuilder.leftJoinAndSelect('accessRequest.requester', 'requester').leftJoinAndSelect('accessRequest.decidedBy', 'decidedBy').leftJoinAndSelect('accessRequest.grantedRole', 'grantedRole');
+        const [items, total] = await queryBuilder.getManyAndCount();
+        return { items, total };
+    }
+    /** Open by design: the caller's own requests - where they see what became of them. */
+    async myAccessRequests(context) {
+        const { domain, user } = context.state;
+        return await (0, shell_1.getRepository)(access_request_js_2.AccessRequest).find({
+            where: { domain: { id: domain.id }, requester: { id: user.id } },
+            relations: ['grantedRole'],
+            order: { createdAt: 'DESC' },
+            take: 100
+        });
+    }
+    /**
+     * Open by design: how many people a request would reach - the popup says it before the person sends, so asking reads
+     * as what it is. A number, never who.
+     */
+    async accessRequestDeciderCount(context) {
+        const { domain, user } = context.state;
+        return (await (0, access_request_js_1.findDeciderIds)(domain, user.id)).length;
+    }
+    async rolesGranting(category, privilege, context) {
+        return (await (0, access_request_js_1.rolesGranting)(category, privilege, context.state.domain)).map(({ id, name, privilegeCount }) => ({ id, name, privilegeCount }));
+    }
+    /** The same review the decision runs - the list screen and the AI draft card show this (ADR-0103 decision 4). */
+    async reviewAccessDecision(decision, context) {
+        return (await (0, access_request_js_1.reviewDecision)(decision, context));
+    }
+};
+exports.AccessRequestQuery = AccessRequestQuery;
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)(READ),
+    (0, type_graphql_1.Query)(returns => access_request_types_js_1.AccessRequestList, { description: "To fetch this domain's access requests." }),
+    tslib_1.__param(0, (0, type_graphql_1.Args)(type => shell_1.ListParam)),
+    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [shell_1.ListParam, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], AccessRequestQuery.prototype, "accessRequests", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Query)(returns => [access_request_js_2.AccessRequest], { description: "To fetch the caller's own access requests in this domain, newest first." }),
+    tslib_1.__param(0, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], AccessRequestQuery.prototype, "myAccessRequests", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Query)(returns => type_graphql_1.Int, { description: 'To count the people who would be told of an access request from the caller in this domain.' }),
+    tslib_1.__param(0, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], AccessRequestQuery.prototype, "accessRequestDeciderCount", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)(DECIDE),
+    (0, type_graphql_1.Query)(returns => [access_request_types_js_1.AccessRoleCandidate], { description: 'To list the roles this domain can assign that grant a privilege, fewest privileges first.' }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('category')),
+    tslib_1.__param(1, (0, type_graphql_1.Arg)('privilege')),
+    tslib_1.__param(2, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], AccessRequestQuery.prototype, "rolesGranting", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)(DECIDE),
+    (0, type_graphql_1.Query)(returns => [access_request_types_js_1.AccessDecisionIssue], { description: 'To review a decision before it is made: what blocks it and what the person deciding should know.' }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('decision', type => access_request_types_js_1.AccessDecisionInput)),
+    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [access_request_types_js_1.AccessDecisionInput, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], AccessRequestQuery.prototype, "reviewAccessDecision", null);
+exports.AccessRequestQuery = AccessRequestQuery = tslib_1.__decorate([
+    (0, type_graphql_1.Resolver)(access_request_js_2.AccessRequest)
+], AccessRequestQuery);
+//# sourceMappingURL=access-request-query.js.map

package/dist-server/service/access-request/access-request-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-request-query.js","sourceRoot":"","sources":["../../../server/service/access-request/access-request-query.ts"],"names":[],"mappings":";;;;AAAA,+CAA8E;AAE9E,iDAA+F;AAE/F,2EAAmG;AACnG,2DAAmD;AACnD,uEAA4H;AAE5H,0GAA0G;AAC1G,MAAM,IAAI,GAAG,4EAA4E,CAAA;AACzF,gFAAgF;AAChF,MAAM,MAAM,GAAG,+EAA+E,CAAA;AAGvF,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAGvB,AAAN,KAAK,CAAC,cAAc,CAA0B,MAAiB,EAAS,OAAwB;QAC9F,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAChC,MAAM,YAAY,GAAG,IAAA,qCAA6B,EAAC;YACjD,MAAM;YACN,MAAM;YACN,UAAU,EAAE,IAAA,qBAAa,EAAC,iCAAa,CAAC;YACxC,KAAK,EAAE,eAAe;YACtB,WAAW,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC;SACjD,CAAC,CAAA;QACF,YAAY,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC,iBAAiB,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC,iBAAiB,CAAC,2BAA2B,EAAE,aAAa,CAAC,CAAA;QAC9L,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAA;QAC3D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IACzB,CAAC;IAED,sFAAsF;IAEhF,AAAN,KAAK,CAAC,gBAAgB,CAAQ,OAAwB;QACpD,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACtC,OAAO,MAAM,IAAA,qBAAa,EAAC,iCAAa,CAAC,CAAC,IAAI,CAAC;YAC7C,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE;YAChE,SAAS,EAAE,CAAC,aAAa,CAAC;YAC1B,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5B,IAAI,EAAE,GAAG;SACV,CAAC,CAAA;IACJ,CAAC;IAED;;;OAGG;IAEG,AAAN,KAAK,CAAC,yBAAyB,CAAQ,OAAwB;QAC7D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QACtC,OAAO,CAAC,MAAM,IAAA,kCAAc,EAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAA;IACvD,CAAC;IAIK,AAAN,KAAK,CAAC,aAAa,CAAkB,QAAgB,EAAoB,SAAiB,EAAS,OAAwB;QACzH,OAAO,CAAC,MAAM,IAAA,iCAAa,EAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC,CAAA;IAC/I,CAAC;IAED,iHAAiH;IAG3G,AAAN,KAAK,CAAC,oBAAoB,CAA+C,QAA6B,EAAS,OAAwB;QACrI,OAAO,CAAC,MAAM,IAAA,kCAAc,EAAC,QAAe,EAAE,OAAO,CAAC,CAA0B,CAAA;IAClF,CAAC;CACF,CAAA;AAnDY,gDAAkB;AAGvB;IAFL,IAAA,wBAAS,EAAC,IAAI,CAAC;IACf,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,2CAAiB,EAAE,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;IAC1E,mBAAA,IAAA,mBAAI,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAS,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAAjB,iBAAS;;wDAY9D;AAIK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,iCAAa,CAAC,EAAE,EAAE,WAAW,EAAE,yEAAyE,EAAE,CAAC;IACtG,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;0DAQ5B;AAOK;IADL,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,4FAA4F,EAAE,CAAC;IACpG,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;mEAGrC;AAIK;IAFL,IAAA,wBAAS,EAAC,MAAM,CAAC;IACjB,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6CAAmB,CAAC,EAAE,EAAE,WAAW,EAAE,2FAA2F,EAAE,CAAC;IACjI,mBAAA,IAAA,kBAAG,EAAC,UAAU,CAAC,CAAA;IAAoB,mBAAA,IAAA,kBAAG,EAAC,WAAW,CAAC,CAAA;IAAqB,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;uDAEjG;AAKK;IAFL,IAAA,wBAAS,EAAC,MAAM,CAAC;IACjB,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,6CAAmB,CAAC,EAAE,EAAE,WAAW,EAAE,kGAAkG,EAAE,CAAC;IACjI,mBAAA,IAAA,kBAAG,EAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,6CAAmB,CAAC,CAAA;IAAiC,mBAAA,IAAA,kBAAG,GAAE,CAAA;;6CAA3B,6CAAmB;;8DAErG;6BAlDU,kBAAkB;IAD9B,IAAA,uBAAQ,EAAC,iCAAa,CAAC;GACX,kBAAkB,CAmD9B","sourcesContent":["import { Arg, Args, Ctx, Directive, Int, Query, Resolver } from 'type-graphql'\n\nimport { getQueryBuilderFromListParams, getRepository, ListParam } from '@things-factory/shell'\n\nimport { findDeciderIds, reviewDecision, rolesGranting } from '../../controllers/access-request.js'\nimport { AccessRequest } from './access-request.js'\nimport { AccessDecisionInput, AccessDecisionIssue, AccessRequestList, AccessRoleCandidate } from './access-request-types.js'\n\n/* Reading the requests is reading who asks for what in this domain - the user screens' read privilege. */\nconst READ = '@privilege(category: \"user\", privilege: \"query\", domainOwnerGranted: true)'\n/* The review and the candidates serve a decision - the deciding declaration. */\nconst DECIDE = '@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true)'\n\n@Resolver(AccessRequest)\nexport class AccessRequestQuery {\n  @Directive(READ)\n  @Query(returns => AccessRequestList, { description: \"To fetch this domain's access requests.\" })\n  async accessRequests(@Args(type => ListParam) params: ListParam, @Ctx() context: ResolverContext): Promise<AccessRequestList> {\n    const { domain } = context.state\n    const queryBuilder = getQueryBuilderFromListParams({\n      domain,\n      params,\n      repository: getRepository(AccessRequest),\n      alias: 'accessRequest',\n      searchables: ['category', 'privilege', 'reason']\n    })\n    queryBuilder.leftJoinAndSelect('accessRequest.requester', 'requester').leftJoinAndSelect('accessRequest.decidedBy', 'decidedBy').leftJoinAndSelect('accessRequest.grantedRole', 'grantedRole')\n    const [items, total] = await queryBuilder.getManyAndCount()\n    return { items, total }\n  }\n\n  /** Open by design: the caller's own requests - where they see what became of them. */\n  @Query(returns => [AccessRequest], { description: \"To fetch the caller's own access requests in this domain, newest first.\" })\n  async myAccessRequests(@Ctx() context: ResolverContext): Promise<AccessRequest[]> {\n    const { domain, user } = context.state\n    return await getRepository(AccessRequest).find({\n      where: { domain: { id: domain.id }, requester: { id: user.id } },\n      relations: ['grantedRole'],\n      order: { createdAt: 'DESC' },\n      take: 100\n    })\n  }\n\n  /**\n   * Open by design: how many people a request would reach - the popup says it before the person sends, so asking reads\n   * as what it is. A number, never who.\n   */\n  @Query(returns => Int, { description: 'To count the people who would be told of an access request from the caller in this domain.' })\n  async accessRequestDeciderCount(@Ctx() context: ResolverContext): Promise<number> {\n    const { domain, user } = context.state\n    return (await findDeciderIds(domain, user.id)).length\n  }\n\n  @Directive(DECIDE)\n  @Query(returns => [AccessRoleCandidate], { description: 'To list the roles this domain can assign that grant a privilege, fewest privileges first.' })\n  async rolesGranting(@Arg('category') category: string, @Arg('privilege') privilege: string, @Ctx() context: ResolverContext): Promise<AccessRoleCandidate[]> {\n    return (await rolesGranting(category, privilege, context.state.domain)).map(({ id, name, privilegeCount }) => ({ id, name, privilegeCount }))\n  }\n\n  /** The same review the decision runs - the list screen and the AI draft card show this (ADR-0103 decision 4). */\n  @Directive(DECIDE)\n  @Query(returns => [AccessDecisionIssue], { description: 'To review a decision before it is made: what blocks it and what the person deciding should know.' })\n  async reviewAccessDecision(@Arg('decision', type => AccessDecisionInput) decision: AccessDecisionInput, @Ctx() context: ResolverContext): Promise<AccessDecisionIssue[]> {\n    return (await reviewDecision(decision as any, context)) as AccessDecisionIssue[]\n  }\n}\n"]}

package/dist-server/service/access-request/access-request-types.d.ts

@@ -0,0 +1,32 @@
+import { AccessRequest } from './access-request.js';
+export declare enum AccessDecision {
+    GRANT = "GRANT",
+    DENY = "DENY"
+}
+export declare class NewAccessRequest {
+    category: string;
+    privilege: string;
+    operationName?: string;
+    reason?: string;
+}
+export declare class AccessDecisionInput {
+    requestId: string;
+    decision: AccessDecision;
+    roleId?: string;
+    reason?: string;
+}
+export declare class AccessDecisionIssue {
+    code: string;
+    blocking: boolean;
+    field?: string;
+    params?: Record<string, unknown>;
+}
+export declare class AccessRoleCandidate {
+    id: string;
+    name: string;
+    privilegeCount: number;
+}
+export declare class AccessRequestList {
+    items: AccessRequest[];
+    total: number;
+}

package/dist-server/service/access-request/access-request-types.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessRequestList = exports.AccessRoleCandidate = exports.AccessDecisionIssue = exports.AccessDecisionInput = exports.NewAccessRequest = exports.AccessDecision = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+const shell_1 = require("@things-factory/shell");
+const access_request_js_1 = require("./access-request.js");
+var AccessDecision;
+(function (AccessDecision) {
+    AccessDecision["GRANT"] = "GRANT";
+    AccessDecision["DENY"] = "DENY";
+})(AccessDecision || (exports.AccessDecision = AccessDecision = {}));
+(0, type_graphql_1.registerEnumType)(AccessDecision, {
+    name: 'AccessDecision',
+    description: 'What the person deciding an access request does: put the requester into a role, or deny with a reason.'
+});
+let NewAccessRequest = class NewAccessRequest {
+};
+exports.NewAccessRequest = NewAccessRequest;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: "The category of the refused privilege, from the refusal's extensions.requires." }),
+    tslib_1.__metadata("design:type", String)
+], NewAccessRequest.prototype, "category", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: "The refused privilege, from the refusal's extensions.requires." }),
+    tslib_1.__metadata("design:type", String)
+], NewAccessRequest.prototype, "privilege", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The operation that was refused, shown to the person deciding.' }),
+    tslib_1.__metadata("design:type", String)
+], NewAccessRequest.prototype, "operationName", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: "The requester's reason." }),
+    tslib_1.__metadata("design:type", String)
+], NewAccessRequest.prototype, "reason", void 0);
+exports.NewAccessRequest = NewAccessRequest = tslib_1.__decorate([
+    (0, type_graphql_1.InputType)({ description: 'An access request for one privilege in this domain - what a refusal carried, and why it is needed.' })
+], NewAccessRequest);
+let AccessDecisionInput = class AccessDecisionInput {
+};
+exports.AccessDecisionInput = AccessDecisionInput;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'The access request decided.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessDecisionInput.prototype, "requestId", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => AccessDecision, { description: 'Grant or deny.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessDecisionInput.prototype, "decision", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The role to put the requester into - required to grant, one this domain can assign that holds the privilege.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessDecisionInput.prototype, "roleId", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'Why - required to deny.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessDecisionInput.prototype, "reason", void 0);
+exports.AccessDecisionInput = AccessDecisionInput = tslib_1.__decorate([
+    (0, type_graphql_1.InputType)({ description: 'A decision on one access request.' })
+], AccessDecisionInput);
+let AccessDecisionIssue = class AccessDecisionIssue {
+};
+exports.AccessDecisionIssue = AccessDecisionIssue;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'What was found, as a code the screen words.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessDecisionIssue.prototype, "code", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'Whether it keeps the decision from being made.' }),
+    tslib_1.__metadata("design:type", Boolean)
+], AccessDecisionIssue.prototype, "blocking", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The part of the decision it is about: request, decision, role or reason.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessDecisionIssue.prototype, "field", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => shell_1.ScalarObject, { nullable: true, description: 'The values the sentence is built from.' }),
+    tslib_1.__metadata("design:type", Object)
+], AccessDecisionIssue.prototype, "params", void 0);
+exports.AccessDecisionIssue = AccessDecisionIssue = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'One finding of the access decision review - blocking ones keep the decision from being made.' })
+], AccessDecisionIssue);
+let AccessRoleCandidate = class AccessRoleCandidate {
+};
+exports.AccessRoleCandidate = AccessRoleCandidate;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'The role id.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessRoleCandidate.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'The role name.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessRoleCandidate.prototype, "name", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'How many privileges the role carries - fewer is closer to what was asked.' }),
+    tslib_1.__metadata("design:type", Number)
+], AccessRoleCandidate.prototype, "privilegeCount", void 0);
+exports.AccessRoleCandidate = AccessRoleCandidate = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'A role this domain can assign that grants the asked privilege.' })
+], AccessRoleCandidate);
+let AccessRequestList = class AccessRequestList {
+};
+exports.AccessRequestList = AccessRequestList;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => [access_request_js_1.AccessRequest], { nullable: true, description: 'The access requests.' }),
+    tslib_1.__metadata("design:type", Array)
+], AccessRequestList.prototype, "items", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { nullable: true, description: 'The total number of access requests.' }),
+    tslib_1.__metadata("design:type", Number)
+], AccessRequestList.prototype, "total", void 0);
+exports.AccessRequestList = AccessRequestList = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'A paginated list of access requests.' })
+], AccessRequestList);
+//# sourceMappingURL=access-request-types.js.map

package/dist-server/service/access-request/access-request-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-request-types.js","sourceRoot":"","sources":["../../../server/service/access-request/access-request-types.ts"],"names":[],"mappings":";;;;AAAA,+CAAkF;AAClF,iDAAoD;AAEpD,2DAAmD;AAEnD,IAAY,cAGX;AAHD,WAAY,cAAc;IACxB,iCAAe,CAAA;IACf,+BAAa,CAAA;AACf,CAAC,EAHW,cAAc,8BAAd,cAAc,QAGzB;AAED,IAAA,+BAAgB,EAAC,cAAc,EAAE;IAC/B,IAAI,EAAE,gBAAgB;IACtB,WAAW,EAAE,wGAAwG;CACtH,CAAC,CAAA;AAGK,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CAY5B,CAAA;AAZY,4CAAgB;AAE3B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,gFAAgF,EAAE,CAAC;;kDACzF;AAGhB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,gEAAgE,EAAE,CAAC;;mDACxE;AAGjB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,+DAA+D,EAAE,CAAC;;uDAClF;AAGtB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;;gDACnD;2BAXJ,gBAAgB;IAD5B,IAAA,wBAAS,EAAC,EAAE,WAAW,EAAE,oGAAoG,EAAE,CAAC;GACpH,gBAAgB,CAY5B;AAGM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAY/B,CAAA;AAZY,kDAAmB;AAE9B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;;sDACrC;AAGjB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;;qDACzC;AAGxB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,8GAA8G,EAAE,CAAC;;mDACxI;AAGf;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;;mDACnD;8BAXJ,mBAAmB;IAD/B,IAAA,wBAAS,EAAC,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;GACnD,mBAAmB,CAY/B;AAGM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAY/B,CAAA;AAZY,kDAAmB;AAE9B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;;iDAC1D;AAGZ;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,gDAAgD,EAAE,CAAC;;qDACxD;AAGjB;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0EAA0E,EAAE,CAAC;;kDACrG;AAGd;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,oBAAY,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;;mDACvE;8BAXrB,mBAAmB;IAD/B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,8FAA8F,EAAE,CAAC;GAC/G,mBAAmB,CAY/B;AAGM,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;CAS/B,CAAA;AATY,kDAAmB;AAE9B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;;+CAC7B;AAGV;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;;iDAC7B;AAGZ;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,2EAA2E,EAAE,CAAC;;2DAC3F;8BARX,mBAAmB;IAD/B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,gEAAgE,EAAE,CAAC;GACjF,mBAAmB,CAS/B;AAGM,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;CAM7B,CAAA;AANY,8CAAiB;AAE5B;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,iCAAa,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;;gDAClE;AAGtB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;;gDAC/E;4BALF,iBAAiB;IAD7B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;GACvD,iBAAiB,CAM7B","sourcesContent":["import { Field, InputType, Int, ObjectType, registerEnumType } from 'type-graphql'\nimport { ScalarObject } from '@things-factory/shell'\n\nimport { AccessRequest } from './access-request.js'\n\nexport enum AccessDecision {\n  GRANT = 'GRANT',\n  DENY = 'DENY'\n}\n\nregisterEnumType(AccessDecision, {\n  name: 'AccessDecision',\n  description: 'What the person deciding an access request does: put the requester into a role, or deny with a reason.'\n})\n\n@InputType({ description: 'An access request for one privilege in this domain - what a refusal carried, and why it is needed.' })\nexport class NewAccessRequest {\n  @Field({ description: \"The category of the refused privilege, from the refusal's extensions.requires.\" })\n  category: string\n\n  @Field({ description: \"The refused privilege, from the refusal's extensions.requires.\" })\n  privilege: string\n\n  @Field({ nullable: true, description: 'The operation that was refused, shown to the person deciding.' })\n  operationName?: string\n\n  @Field({ nullable: true, description: \"The requester's reason.\" })\n  reason?: string\n}\n\n@InputType({ description: 'A decision on one access request.' })\nexport class AccessDecisionInput {\n  @Field({ description: 'The access request decided.' })\n  requestId: string\n\n  @Field(type => AccessDecision, { description: 'Grant or deny.' })\n  decision: AccessDecision\n\n  @Field({ nullable: true, description: 'The role to put the requester into - required to grant, one this domain can assign that holds the privilege.' })\n  roleId?: string\n\n  @Field({ nullable: true, description: 'Why - required to deny.' })\n  reason?: string\n}\n\n@ObjectType({ description: 'One finding of the access decision review - blocking ones keep the decision from being made.' })\nexport class AccessDecisionIssue {\n  @Field({ description: 'What was found, as a code the screen words.' })\n  code: string\n\n  @Field({ description: 'Whether it keeps the decision from being made.' })\n  blocking: boolean\n\n  @Field({ nullable: true, description: 'The part of the decision it is about: request, decision, role or reason.' })\n  field?: string\n\n  @Field(type => ScalarObject, { nullable: true, description: 'The values the sentence is built from.' })\n  params?: Record<string, unknown>\n}\n\n@ObjectType({ description: 'A role this domain can assign that grants the asked privilege.' })\nexport class AccessRoleCandidate {\n  @Field({ description: 'The role id.' })\n  id: string\n\n  @Field({ description: 'The role name.' })\n  name: string\n\n  @Field(type => Int, { description: 'How many privileges the role carries - fewer is closer to what was asked.' })\n  privilegeCount: number\n}\n\n@ObjectType({ description: 'A paginated list of access requests.' })\nexport class AccessRequestList {\n  @Field(type => [AccessRequest], { nullable: true, description: 'The access requests.' })\n  items: AccessRequest[]\n\n  @Field(type => Int, { nullable: true, description: 'The total number of access requests.' })\n  total: number\n}\n"]}

package/dist-server/service/access-request/access-request.d.ts

@@ -0,0 +1,33 @@
+import { Domain } from '@things-factory/shell';
+import { Role } from '../role/role.js';
+import { User } from '../user/user.js';
+export declare enum AccessRequestStatus {
+    PENDING = "PENDING",
+    GRANTED = "GRANTED",
+    DENIED = "DENIED",
+    WITHDRAWN = "WITHDRAWN",
+    EXPIRED = "EXPIRED"
+}
+export declare class AccessRequest {
+    readonly id: string;
+    domain: Domain;
+    domainId: string;
+    requester: User;
+    requesterId: string;
+    category: string;
+    privilege: string;
+    operationName?: string;
+    reason?: string;
+    count: number;
+    lastRequestedAt?: Date;
+    state: AccessRequestStatus;
+    expiresAt?: Date;
+    decidedBy?: User;
+    decidedById?: string;
+    decidedAt?: Date;
+    decisionReason?: string;
+    grantedRole?: Role;
+    grantedRoleId?: string;
+    createdAt: Date;
+    updatedAt: Date;
+}

package/dist-server/service/access-request/access-request.js

@@ -0,0 +1,160 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessRequest = exports.AccessRequestStatus = void 0;
+const tslib_1 = require("tslib");
+const typeorm_1 = require("typeorm");
+const type_graphql_1 = require("type-graphql");
+const env_1 = require("@things-factory/env");
+const shell_1 = require("@things-factory/shell");
+const role_js_1 = require("../role/role.js");
+const user_js_1 = require("../user/user.js");
+const ORMCONFIG = env_1.config.get('ormconfig', {});
+const DATABASE_TYPE = ORMCONFIG.type;
+var AccessRequestStatus;
+(function (AccessRequestStatus) {
+    AccessRequestStatus["PENDING"] = "PENDING";
+    AccessRequestStatus["GRANTED"] = "GRANTED";
+    AccessRequestStatus["DENIED"] = "DENIED";
+    AccessRequestStatus["WITHDRAWN"] = "WITHDRAWN";
+    AccessRequestStatus["EXPIRED"] = "EXPIRED";
+})(AccessRequestStatus || (exports.AccessRequestStatus = AccessRequestStatus = {}));
+(0, type_graphql_1.registerEnumType)(AccessRequestStatus, {
+    name: 'AccessRequestStatus',
+    description: 'Where an access request stands: waiting, granted, denied, withdrawn by the requester, or expired unanswered.'
+});
+/*
+ * A person refused for want of a role asks for the privilege (ADR-0103, docs/design/access-request.md).
+ *
+ * ── The row is the record ────────────────────────────────────────────────
+ * Who asked, for what, why, who decided, which role, why not - all here, and never deleted. A notification
+ * is a courtesy on top: it is not stored per person and does nothing where FCM is not set up.
+ *
+ * ── At most one pending per person and privilege ─────────────────────────
+ * Asking again bumps `count` and `lastRequestedAt` instead of adding a row. A partial unique index would say
+ * it and is not portable across the databases this framework supports, so it is held where the request is
+ * made (as `Invitation` does). The index below is for reading.
+ */
+let AccessRequest = class AccessRequest {
+};
+exports.AccessRequest = AccessRequest;
+tslib_1.__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    (0, type_graphql_1.Field)(type => type_graphql_1.ID, { description: 'Unique identifier for the access request.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => shell_1.Domain),
+    (0, type_graphql_1.Field)(type => shell_1.Domain, { description: 'The domain the privilege is asked in.' }),
+    tslib_1.__metadata("design:type", shell_1.Domain)
+], AccessRequest.prototype, "domain", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((request) => request.domain),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "domainId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => user_js_1.User),
+    (0, type_graphql_1.Field)(type => user_js_1.User, { description: 'The person who asked.' }),
+    tslib_1.__metadata("design:type", user_js_1.User)
+], AccessRequest.prototype, "requester", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((request) => request.requester),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "requesterId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)(),
+    (0, type_graphql_1.Field)({ description: 'The category of the privilege asked for, as the refusal carried it.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "category", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)(),
+    (0, type_graphql_1.Field)({ description: 'The privilege asked for, as the refusal carried it.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "privilege", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'The operation that was refused - shown to the person deciding.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "operationName", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: "The requester's reason." }),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "reason", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ type: 'int', default: 1 }),
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'How many times it was asked while pending.' }),
+    tslib_1.__metadata("design:type", Number)
+], AccessRequest.prototype, "count", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'When it was last asked.' }),
+    tslib_1.__metadata("design:type", Date
+    /* The same column shape as Invitation.status - an enum where the database has one, a string elsewhere. */
+    )
+], AccessRequest.prototype, "lastRequestedAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({
+        type: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'
+            ? 'enum'
+            : DATABASE_TYPE == 'oracle'
+                ? 'varchar2'
+                : DATABASE_TYPE == 'mssql'
+                    ? 'nvarchar'
+                    : 'varchar',
+        enum: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? AccessRequestStatus : undefined,
+        length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,
+        default: AccessRequestStatus.PENDING
+    }),
+    (0, type_graphql_1.Field)(type => AccessRequestStatus, { description: 'Where the request stands.' }),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "state", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'When a pending request expires unanswered.' }),
+    tslib_1.__metadata("design:type", Date)
+], AccessRequest.prototype, "expiresAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => user_js_1.User, { nullable: true }),
+    (0, type_graphql_1.Field)(type => user_js_1.User, { nullable: true, description: 'Who decided it.' }),
+    tslib_1.__metadata("design:type", user_js_1.User)
+], AccessRequest.prototype, "decidedBy", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((request) => request.decidedBy),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "decidedById", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: 'When it was decided.' }),
+    tslib_1.__metadata("design:type", Date)
+], AccessRequest.prototype, "decidedAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.Column)({ nullable: true }),
+    (0, type_graphql_1.Field)({ nullable: true, description: "The decider's reason - required to deny." }),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "decisionReason", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.ManyToOne)(type => role_js_1.Role, { nullable: true }),
+    (0, type_graphql_1.Field)(type => role_js_1.Role, { nullable: true, description: 'The role the requester was put into.' }),
+    tslib_1.__metadata("design:type", role_js_1.Role)
+], AccessRequest.prototype, "grantedRole", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.RelationId)((request) => request.grantedRole),
+    tslib_1.__metadata("design:type", String)
+], AccessRequest.prototype, "grantedRoleId", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.CreateDateColumn)(),
+    (0, type_graphql_1.Field)({ description: 'When it was first asked.' }),
+    tslib_1.__metadata("design:type", Date)
+], AccessRequest.prototype, "createdAt", void 0);
+tslib_1.__decorate([
+    (0, typeorm_1.UpdateDateColumn)(),
+    (0, type_graphql_1.Field)({ description: 'When it last changed.' }),
+    tslib_1.__metadata("design:type", Date)
+], AccessRequest.prototype, "updatedAt", void 0);
+exports.AccessRequest = AccessRequest = tslib_1.__decorate([
+    (0, typeorm_1.Entity)(),
+    (0, typeorm_1.Index)('ix_access_request_0', (request) => [request.domain, request.state]),
+    (0, typeorm_1.Index)('ix_access_request_1', (request) => [request.domain, request.requester, request.category, request.privilege]),
+    (0, type_graphql_1.ObjectType)({ description: 'A request by a person refused for want of a role, for one privilege in this domain.' })
+], AccessRequest);
+//# sourceMappingURL=access-request.js.map

package/dist-server/service/access-request/access-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-request.js","sourceRoot":"","sources":["../../../server/service/access-request/access-request.ts"],"names":[],"mappings":";;;;AAAA,qCASgB;AAChB,+CAA2E;AAE3E,6CAA4C;AAC5C,iDAA8C;AAE9C,6CAAsC;AACtC,6CAAsC;AAEtC,MAAM,SAAS,GAAG,YAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AAC7C,MAAM,aAAa,GAAG,SAAS,CAAC,IAAI,CAAA;AAEpC,IAAY,mBAMX;AAND,WAAY,mBAAmB;IAC7B,0CAAmB,CAAA;IACnB,0CAAmB,CAAA;IACnB,wCAAiB,CAAA;IACjB,8CAAuB,CAAA;IACvB,0CAAmB,CAAA;AACrB,CAAC,EANW,mBAAmB,mCAAnB,mBAAmB,QAM9B;AAED,IAAA,+BAAgB,EAAC,mBAAmB,EAAE;IACpC,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EAAE,8GAA8G;CAC5H,CAAC,CAAA;AAEF;;;;;;;;;;;GAWG;AAKI,IAAM,aAAa,GAAnB,MAAM,aAAa;CA8FzB,CAAA;AA9FY,sCAAa;AAGf;IAFR,IAAA,gCAAsB,EAAC,MAAM,CAAC;IAC9B,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,iBAAE,EAAE,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;yCAC7D;AAInB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,CAAC;IACzB,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAM,EAAE,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC;sCACxE,cAAM;6CAAA;AAGd;IADC,IAAA,oBAAU,EAAC,CAAC,OAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;;+CACvC;AAIhB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,CAAC;IACvB,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;sCACnD,cAAI;gDAAA;AAGf;IADC,IAAA,oBAAU,EAAC,CAAC,OAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;;kDACvC;AAInB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,qEAAqE,EAAE,CAAC;;+CAC9E;AAIhB;IAFC,IAAA,gBAAM,GAAE;IACR,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;;gDAC7D;AAIjB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,gEAAgE,EAAE,CAAC;;oDACnF;AAItB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;;6CACnD;AAIf;IAFC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACnC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;;4CACrE;AAIb;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC;sCAChD,IAAI;IAEtB,0GAA0G;;sDAFpF;AAkBtB;IAfC,IAAA,gBAAM,EAAC;QACN,IAAI,EACF,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS;YACnF,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,aAAa,IAAI,QAAQ;gBACzB,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,aAAa,IAAI,OAAO;oBACxB,CAAC,CAAC,UAAU;oBACZ,CAAC,CAAC,SAAS;QACnB,IAAI,EACF,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,SAAS;QACzH,MAAM,EAAE,aAAa,IAAI,UAAU,IAAI,aAAa,IAAI,OAAO,IAAI,aAAa,IAAI,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QAC9G,OAAO,EAAE,mBAAmB,CAAC,OAAO;KACrC,CAAC;IACD,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,mBAAmB,EAAE,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;;4CACvD;AAI1B;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;sCACzE,IAAI;gDAAA;AAIhB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;sCAC5D,cAAI;gDAAA;AAGhB;IADC,IAAA,oBAAU,EAAC,CAAC,OAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;;kDACtC;AAIpB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sBAAsB,EAAE,CAAC;sCACnD,IAAI;gDAAA;AAIhB;IAFC,IAAA,gBAAM,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1B,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;;qDAC5D;AAIvB;IAFC,IAAA,mBAAS,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;sCAC/E,cAAI;kDAAA;AAGlB;IADC,IAAA,oBAAU,EAAC,CAAC,OAAsB,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC;;oDACtC;AAItB;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;sCACxC,IAAI;gDAAA;AAIf;IAFC,IAAA,0BAAgB,GAAE;IAClB,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;sCACrC,IAAI;gDAAA;wBA7FJ,aAAa;IAJzB,IAAA,gBAAM,GAAE;IACR,IAAA,eAAK,EAAC,qBAAqB,EAAE,CAAC,OAAsB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACzF,IAAA,eAAK,EAAC,qBAAqB,EAAE,CAAC,OAAsB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAClI,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,qFAAqF,EAAE,CAAC;GACtG,aAAa,CA8FzB","sourcesContent":["import {\n  Column,\n  CreateDateColumn,\n  Entity,\n  Index,\n  ManyToOne,\n  PrimaryGeneratedColumn,\n  RelationId,\n  UpdateDateColumn\n} from 'typeorm'\nimport { Field, ID, Int, ObjectType, registerEnumType } from 'type-graphql'\n\nimport { config } from '@things-factory/env'\nimport { Domain } from '@things-factory/shell'\n\nimport { Role } from '../role/role.js'\nimport { User } from '../user/user.js'\n\nconst ORMCONFIG = config.get('ormconfig', {})\nconst DATABASE_TYPE = ORMCONFIG.type\n\nexport enum AccessRequestStatus {\n  PENDING = 'PENDING',\n  GRANTED = 'GRANTED',\n  DENIED = 'DENIED',\n  WITHDRAWN = 'WITHDRAWN',\n  EXPIRED = 'EXPIRED'\n}\n\nregisterEnumType(AccessRequestStatus, {\n  name: 'AccessRequestStatus',\n  description: 'Where an access request stands: waiting, granted, denied, withdrawn by the requester, or expired unanswered.'\n})\n\n/*\n * A person refused for want of a role asks for the privilege (ADR-0103, docs/design/access-request.md).\n *\n * ── The row is the record ────────────────────────────────────────────────\n * Who asked, for what, why, who decided, which role, why not - all here, and never deleted. A notification\n * is a courtesy on top: it is not stored per person and does nothing where FCM is not set up.\n *\n * ── At most one pending per person and privilege ─────────────────────────\n * Asking again bumps `count` and `lastRequestedAt` instead of adding a row. A partial unique index would say\n * it and is not portable across the databases this framework supports, so it is held where the request is\n * made (as `Invitation` does). The index below is for reading.\n */\n@Entity()\n@Index('ix_access_request_0', (request: AccessRequest) => [request.domain, request.state])\n@Index('ix_access_request_1', (request: AccessRequest) => [request.domain, request.requester, request.category, request.privilege])\n@ObjectType({ description: 'A request by a person refused for want of a role, for one privilege in this domain.' })\nexport class AccessRequest {\n  @PrimaryGeneratedColumn('uuid')\n  @Field(type => ID, { description: 'Unique identifier for the access request.' })\n  readonly id: string\n\n  @ManyToOne(type => Domain)\n  @Field(type => Domain, { description: 'The domain the privilege is asked in.' })\n  domain: Domain\n\n  @RelationId((request: AccessRequest) => request.domain)\n  domainId: string\n\n  @ManyToOne(type => User)\n  @Field(type => User, { description: 'The person who asked.' })\n  requester: User\n\n  @RelationId((request: AccessRequest) => request.requester)\n  requesterId: string\n\n  @Column()\n  @Field({ description: 'The category of the privilege asked for, as the refusal carried it.' })\n  category: string\n\n  @Column()\n  @Field({ description: 'The privilege asked for, as the refusal carried it.' })\n  privilege: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'The operation that was refused - shown to the person deciding.' })\n  operationName?: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: \"The requester's reason.\" })\n  reason?: string\n\n  @Column({ type: 'int', default: 1 })\n  @Field(type => Int, { description: 'How many times it was asked while pending.' })\n  count: number\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'When it was last asked.' })\n  lastRequestedAt?: Date\n\n  /* The same column shape as Invitation.status - an enum where the database has one, a string elsewhere. */\n  @Column({\n    type:\n      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb'\n        ? 'enum'\n        : DATABASE_TYPE == 'oracle'\n          ? 'varchar2'\n          : DATABASE_TYPE == 'mssql'\n            ? 'nvarchar'\n            : 'varchar',\n    enum:\n      DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? AccessRequestStatus : undefined,\n    length: DATABASE_TYPE == 'postgres' || DATABASE_TYPE == 'mysql' || DATABASE_TYPE == 'mariadb' ? undefined : 32,\n    default: AccessRequestStatus.PENDING\n  })\n  @Field(type => AccessRequestStatus, { description: 'Where the request stands.' })\n  state: AccessRequestStatus\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'When a pending request expires unanswered.' })\n  expiresAt?: Date\n\n  @ManyToOne(type => User, { nullable: true })\n  @Field(type => User, { nullable: true, description: 'Who decided it.' })\n  decidedBy?: User\n\n  @RelationId((request: AccessRequest) => request.decidedBy)\n  decidedById?: string\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: 'When it was decided.' })\n  decidedAt?: Date\n\n  @Column({ nullable: true })\n  @Field({ nullable: true, description: \"The decider's reason - required to deny.\" })\n  decisionReason?: string\n\n  @ManyToOne(type => Role, { nullable: true })\n  @Field(type => Role, { nullable: true, description: 'The role the requester was put into.' })\n  grantedRole?: Role\n\n  @RelationId((request: AccessRequest) => request.grantedRole)\n  grantedRoleId?: string\n\n  @CreateDateColumn()\n  @Field({ description: 'When it was first asked.' })\n  createdAt: Date\n\n  @UpdateDateColumn()\n  @Field({ description: 'When it last changed.' })\n  updatedAt: Date\n}\n"]}

package/dist-server/service/access-request/index.d.ts

@@ -0,0 +1,5 @@
+import { AccessRequest } from './access-request.js';
+import { AccessRequestMutation } from './access-request-mutation.js';
+import { AccessRequestQuery } from './access-request-query.js';
+export declare const entities: (typeof AccessRequest)[];
+export declare const resolvers: (typeof AccessRequestQuery | typeof AccessRequestMutation)[];

package/dist-server/service/access-request/index.js

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvers = exports.entities = void 0;
+const access_request_js_1 = require("./access-request.js");
+const access_request_mutation_js_1 = require("./access-request-mutation.js");
+const access_request_query_js_1 = require("./access-request-query.js");
+exports.entities = [access_request_js_1.AccessRequest];
+exports.resolvers = [access_request_query_js_1.AccessRequestQuery, access_request_mutation_js_1.AccessRequestMutation];
+//# sourceMappingURL=index.js.map

package/dist-server/service/access-request/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../server/service/access-request/index.ts"],"names":[],"mappings":";;;AAAA,2DAAmD;AACnD,6EAAoE;AACpE,uEAA8D;AAEjD,QAAA,QAAQ,GAAG,CAAC,iCAAa,CAAC,CAAA;AAC1B,QAAA,SAAS,GAAG,CAAC,4CAAkB,EAAE,kDAAqB,CAAC,CAAA","sourcesContent":["import { AccessRequest } from './access-request.js'\nimport { AccessRequestMutation } from './access-request-mutation.js'\nimport { AccessRequestQuery } from './access-request-query.js'\n\nexport const entities = [AccessRequest]\nexport const resolvers = [AccessRequestQuery, AccessRequestMutation]\n"]}

package/dist-server/service/index.d.ts

@@ -20,6 +20,7 @@ export * from './login-history/login-history.js';
 export * from './web-auth-credential/web-auth-credential.js';
 export * from './domain-link/domain-link.js';
 export * from './domain-owner/domain-owner.js';
+export * from './access-request/access-request.js';
 export * from './app-binding/app-binding-types.js';
 export * from './appliance/appliance-types.js';
 export * from './application/application-types.js';
@@ -30,7 +31,8 @@ export * from './privilege/privilege-types.js';
 export * from './role/role-types.js';
 export * from './user/user-types.js';
 export * from './domain-link/domain-link-types.js';
-export declare const entities: (typeof import("./web-auth-credential/web-auth-credential.js").WebAuthCredential | typeof import("./user/user.js").User | typeof import("./auth-provider/auth-provider.js").AuthProvider | typeof import("./users-auth-providers/users-auth-providers.js").UsersAuthProviders | typeof import("./domain-owner/domain-owner.js").DomainOwner | typeof import("./granted-role/granted-role.js").GrantedRole | typeof import("./role/role.js").Role | typeof import("./privilege/privilege.js").Privilege | typeof import("./password-history/password-history.js").PasswordHistory | typeof import("./verification-token/verification-token.js").VerificationToken | typeof import("./verification-token/verification-token.js").VerificationTokenType | typeof import("./invitation/invitation.js").Invitation | typeof import("./application/application.js").Application | typeof import("./login-history/login-history.js").LoginHistory | typeof import("./appliance/appliance.js").Appliance | typeof import("./partner/partner.js").Partner | typeof import("./domain-link/domain-link.js").DomainLink)[];
+export * from './access-request/access-request-types.js';
+export declare const entities: (typeof import("./access-request/access-request.js").AccessRequest | typeof import("./role/role.js").Role | typeof import("./privilege/privilege.js").Privilege | typeof import("./user/user.js").User | typeof import("./users-auth-providers/users-auth-providers.js").UsersAuthProviders | typeof import("./auth-provider/auth-provider.js").AuthProvider | typeof import("./application/application.js").Application | typeof import("./appliance/appliance.js").Appliance | typeof import("./partner/partner.js").Partner | typeof import("./granted-role/granted-role.js").GrantedRole | typeof import("./invitation/invitation.js").Invitation | typeof import("./password-history/password-history.js").PasswordHistory | typeof import("./verification-token/verification-token.js").VerificationToken | typeof import("./verification-token/verification-token.js").VerificationTokenType | typeof import("./login-history/login-history.js").LoginHistory | typeof import("./web-auth-credential/web-auth-credential.js").WebAuthCredential | typeof import("./domain-link/domain-link.js").DomainLink | typeof import("./domain-owner/domain-owner.js").DomainOwner)[];
 export declare const schema: {
     typeDefs: {
         privilegeDirectiveTypeDefs: import("graphql").DocumentNode;