@trailmix-cms/cms 0.4.3 → 0.7.1

package/dist/managers/organization-role.manager.js

@@ -0,0 +1,218 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var OrganizationRoleManager_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrganizationRoleManager = void 0;
+const common_1 = require("@nestjs/common");
+const models = __importStar(require("@trailmix-cms/models"));
+const services_1 = require("../services");
+const collections_1 = require("../collections");
+let OrganizationRoleManager = OrganizationRoleManager_1 = class OrganizationRoleManager {
+    organizationRoleService;
+    authorizationService;
+    organizationCollection;
+    securityAuditCollection;
+    logger = new common_1.Logger(OrganizationRoleManager_1.name);
+    constructor(organizationRoleService, authorizationService, organizationCollection, securityAuditCollection) {
+        this.organizationRoleService = organizationRoleService;
+        this.authorizationService = authorizationService;
+        this.organizationCollection = organizationCollection;
+        this.securityAuditCollection = securityAuditCollection;
+    }
+    async verifyOrganizationExists(organizationId) {
+        const organization = await this.organizationCollection.get(organizationId);
+        if (!organization) {
+            throw new common_1.BadRequestException('Organization not found');
+        }
+    }
+    async authorizeOrganizationAdmin(params) {
+        const { organizationId, principal } = params;
+        const accessResult = await this.authorizationService.resolveOrganizationAuthorization({
+            principal,
+            rolesAllowList: [
+                models.RoleValue.Admin,
+                models.RoleValue.Owner,
+            ],
+            principalTypeAllowList: [models.Principal.Account, models.Principal.ApiKey],
+            organizationId: organizationId,
+        });
+        if (!accessResult.hasAccess) {
+            await this.securityAuditCollection.insertOne({
+                event_type: models.SecurityAuditEventType.UnauthorizedAccess,
+                principal_id: principal.entity._id,
+                principal_type: principal.principal_type,
+                message: `Insufficient permissions to access organization roles for organization ${organizationId}`,
+                source: OrganizationRoleManager_1.name,
+            });
+            // If the principal has at least reader organization role, throw a forbidden exception since they have access to the organization
+            if (accessResult.organizationRoles.some(role => [
+                models.RoleValue.Admin,
+                models.RoleValue.Owner,
+                models.RoleValue.User,
+                models.RoleValue.Reader,
+            ].includes(role.role))) {
+                throw new common_1.ForbiddenException(`Insufficient permissions to access organization roles for organization ${organizationId}`);
+            }
+            throw new common_1.BadRequestException(`Organization ${organizationId} not found`);
+        }
+        return accessResult;
+    }
+    async insertOne(params, principal, auditContext) {
+        this.logger.log(`Assigning organization role ${params.role} to principal ${params.principal_id} (${params.principal_type}) in organization ${params.organization_id}`);
+        // Verify organization exists
+        await this.verifyOrganizationExists(params.organization_id);
+        // Check authorization - must be global admin or organization admin
+        await this.authorizeOrganizationAdmin({
+            organizationId: params.organization_id,
+            principal: principal
+        });
+        // Check if role already exists
+        const existing = await this.organizationRoleService.findOne(params);
+        if (existing) {
+            throw new common_1.BadRequestException('Organization role already assigned to this principal in this organization');
+        }
+        // Create the role
+        return await this.organizationRoleService.insertOne(params, auditContext);
+    }
+    async find(params, principal) {
+        this.logger.log(`Getting organization role assignments for query: ${JSON.stringify(params)}`);
+        const { organization_id } = params;
+        // Global admin can find all organization roles
+        if (!organization_id) {
+            const isGlobalAdmin = await this.authorizationService.isGlobalAdmin(principal.entity._id, principal.principal_type);
+            if (!isGlobalAdmin) {
+                throw new common_1.BadRequestException('organization_id is required');
+            }
+            return await this.organizationRoleService.find(params);
+        }
+        await this.verifyOrganizationExists(organization_id);
+        // Check authorization - must be global admin or organization admin
+        const accessResult = await this.authorizationService.resolveOrganizationAuthorization({
+            principal,
+            rolesAllowList: [
+                models.RoleValue.Admin,
+                models.RoleValue.Owner,
+            ],
+            principalTypeAllowList: [models.Principal.Account, models.Principal.ApiKey],
+            organizationId: organization_id,
+        });
+        if (accessResult.hasAccess) {
+            return await this.organizationRoleService.find(params);
+        }
+        // Principal (non admin) is not trying to view their own organization roles (non admin)
+        if (params.principal_id &&
+            !params.principal_id.equals(principal.entity._id)) {
+            throw new common_1.BadRequestException('You cannot view organization roles for other principals');
+        }
+        // Principal (non admin) is not trying to view other principal types
+        if (params.principal_type &&
+            params.principal_type !== principal.principal_type) {
+            throw new common_1.BadRequestException('You cannot view organization roles for other principal types');
+        }
+        return accessResult.organizationRoles;
+    }
+    async get(id, principal) {
+        const role = await this.organizationRoleService.findOne({ _id: id });
+        if (!role) {
+            throw new common_1.NotFoundException('Organization role not found');
+        }
+        const accessResult = await this.authorizationService.resolveOrganizationAuthorization({
+            principal,
+            rolesAllowList: [
+                models.RoleValue.Admin,
+                models.RoleValue.Owner,
+            ],
+            principalTypeAllowList: [models.Principal.Account, models.Principal.ApiKey],
+            organizationId: role.organization_id,
+        });
+        // If the principal is not org admin and does not have access to the organization
+        if (!accessResult.hasAccess &&
+            !accessResult.organizationRoles.some(role => [
+                models.RoleValue.Admin,
+                models.RoleValue.Owner,
+                models.RoleValue.User,
+                models.RoleValue.Reader,
+            ].includes(role.role))) {
+            await this.securityAuditCollection.insertOne({
+                event_type: models.SecurityAuditEventType.UnauthorizedAccess,
+                principal_id: principal.entity._id,
+                principal_type: principal.principal_type,
+                message: `Insufficient permissions to access organization role ${role._id} for organization ${role.organization_id}`,
+                source: OrganizationRoleManager_1.name,
+            });
+            throw new common_1.BadRequestException(`Organization role ${role._id} not found for organization ${role.organization_id}`);
+        }
+        // Check to see if the role is assigned to the principal
+        if (!role.principal_id.equals(principal.entity._id) ||
+            role.principal_type !== principal.principal_type) {
+            throw new common_1.NotFoundException('Organization role not found');
+        }
+        return role;
+    }
+    async deleteOne(roleId, principal, auditContext) {
+        this.logger.log(`Removing organization role assignment ${roleId}`);
+        // Get the role to check its organization and validate it's an organization role
+        const role = await this.organizationRoleService.findOne({ _id: roleId });
+        if (!role) {
+            throw new common_1.NotFoundException('Organization role not found');
+        }
+        // Check authorization - user must be global admin or organization admin
+        await this.authorizeOrganizationAdmin({
+            organizationId: role.organization_id,
+            principal: principal,
+        });
+        // Delete the role
+        await this.organizationRoleService.deleteOne(roleId, auditContext);
+        this.logger.log(`Removed organization role ${roleId}`);
+    }
+};
+exports.OrganizationRoleManager = OrganizationRoleManager;
+exports.OrganizationRoleManager = OrganizationRoleManager = OrganizationRoleManager_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [services_1.OrganizationRoleService,
+        services_1.AuthorizationService,
+        collections_1.OrganizationCollection,
+        collections_1.SecurityAuditCollection])
+], OrganizationRoleManager);
+//# sourceMappingURL=organization-role.manager.js.map

package/dist/managers/organization-role.manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-role.manager.js","sourceRoot":"","sources":["../../src/managers/organization-role.manager.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAgH;AAEhH,6DAA+C;AAG/C,0CAA4E;AAC5E,gDAAiF;AAO1E,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAIX;IACA;IACA;IACA;IANJ,MAAM,GAAG,IAAI,eAAM,CAAC,yBAAuB,CAAC,IAAI,CAAC,CAAC;IAEnE,YACqB,uBAAgD,EAChD,oBAA0C,EAC1C,sBAA8C,EAC9C,uBAAgD;QAHhD,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,4BAAuB,GAAvB,uBAAuB,CAAyB;IACjE,CAAC;IAEG,KAAK,CAAC,wBAAwB,CAAC,cAAwB;QAC3D,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC3E,IAAI,CAAC,YAAY,EAAE,CAAC;YAChB,MAAM,IAAI,4BAAmB,CAAC,wBAAwB,CAAC,CAAC;QAC5D,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,0BAA0B,CAAC,MAGxC;QACG,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;QAC7C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,gCAAgC,CAAC;YAClF,SAAS;YACT,cAAc,EAAE;gBACZ,MAAM,CAAC,SAAS,CAAC,KAAK;gBACtB,MAAM,CAAC,SAAS,CAAC,KAAK;aACzB;YACD,sBAAsB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;YAC3E,cAAc,EAAE,cAAc;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;gBACzC,UAAU,EAAE,MAAM,CAAC,sBAAsB,CAAC,kBAAkB;gBAC5D,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBAClC,cAAc,EAAE,SAAS,CAAC,cAAc;gBACxC,OAAO,EAAE,0EAA0E,cAAc,EAAE;gBACnG,MAAM,EAAE,yBAAuB,CAAC,IAAI;aACvC,CAAC,CAAC;YACH,iIAAiI;YACjI,IAAI,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1C;gBACG,MAAM,CAAC,SAAS,CAAC,KAAK;gBACtB,MAAM,CAAC,SAAS,CAAC,KAAK;gBACtB,MAAM,CAAC,SAAS,CAAC,IAAI;gBACrB,MAAM,CAAC,SAAS,CAAC,MAAM;aAE1B,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,2BAAkB,CAAC,0EAA0E,cAAc,EAAE,CAAC,CAAC;YAC7H,CAAC;YACD,MAAM,IAAI,4BAAmB,CAAC,gBAAgB,cAAc,YAAY,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,SAAS,CACX,MAAoC,EACpC,SAA2B,EAC3B,YAAuC;QAEvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,IAAI,iBAAiB,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,cAAc,qBAAqB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;QAEvK,6BAA6B;QAC7B,MAAM,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAE5D,mEAAmE;QACnE,MAAM,IAAI,CAAC,0BAA0B,CAAC;YAClC,cAAc,EAAE,MAAM,CAAC,eAAe;YACtC,SAAS,EAAE,SAAS;SACvB,CAAC,CAAC;QAEH,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACpE,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,IAAI,4BAAmB,CAAC,2EAA2E,CAAC,CAAC;QAC/G,CAAC;QAED,kBAAkB;QAClB,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,IAAI,CACN,MAAkC,EAClC,SAA2B;QAE3B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,oDAAoD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9F,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;QACnC,+CAA+C;QAC/C,IAAI,CAAC,eAAe,EAAE,CAAC;YACnB,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC;YACpH,IAAI,CAAC,aAAa,EAAE,CAAC;gBACjB,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,CAAC,CAAC;YACjE,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,IAAI,CAAC,wBAAwB,CAAC,eAAe,CAAC,CAAC;QAErD,mEAAmE;QACnE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,gCAAgC,CAAC;YAClF,SAAS;YACT,cAAc,EAAE;gBACZ,MAAM,CAAC,SAAS,CAAC,KAAK;gBACtB,MAAM,CAAC,SAAS,CAAC,KAAK;aACzB;YACD,sBAAsB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;YAC3E,cAAc,EAAE,eAAe;SAClC,CAAC,CAAC;QACH,IAAI,YAAY,CAAC,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3D,CAAC;QAED,uFAAuF;QACvF,IAAI,MAAM,CAAC,YAAY;YACnB,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,4BAAmB,CAAC,yDAAyD,CAAC,CAAC;QAC7F,CAAC;QAED,oEAAoE;QACpE,IAAI,MAAM,CAAC,cAAc;YACrB,MAAM,CAAC,cAAc,KAAK,SAAS,CAAC,cAAc,EAAE,CAAC;YACrD,MAAM,IAAI,4BAAmB,CAAC,8DAA8D,CAAC,CAAC;QAClG,CAAC;QAED,OAAO,YAAY,CAAC,iBAAiB,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,GAAG,CACL,EAAY,EACZ,SAA2B;QAE3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,gCAAgC,CAAC;YAClF,SAAS;YACT,cAAc,EAAE;gBACZ,MAAM,CAAC,SAAS,CAAC,KAAK;gBACtB,MAAM,CAAC,SAAS,CAAC,KAAK;aACzB;YACD,sBAAsB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;YAC3E,cAAc,EAAE,IAAI,CAAC,eAAe;SACvC,CAAC,CAAC;QAEH,iFAAiF;QACjF,IAAI,CAAC,YAAY,CAAC,SAAS;YACvB,CAAC,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvC;gBACG,MAAM,CAAC,SAAS,CAAC,KAAK;gBACtB,MAAM,CAAC,SAAS,CAAC,KAAK;gBACtB,MAAM,CAAC,SAAS,CAAC,IAAI;gBACrB,MAAM,CAAC,SAAS,CAAC,MAAM;aACb,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EACzC,CAAC;YACC,MAAM,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;gBACzC,UAAU,EAAE,MAAM,CAAC,sBAAsB,CAAC,kBAAkB;gBAC5D,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBAClC,cAAc,EAAE,SAAS,CAAC,cAAc;gBACxC,OAAO,EAAE,wDAAwD,IAAI,CAAC,GAAG,qBAAqB,IAAI,CAAC,eAAe,EAAE;gBACpH,MAAM,EAAE,yBAAuB,CAAC,IAAI;aACvC,CAAC,CAAC;YAEH,MAAM,IAAI,4BAAmB,CAAC,qBAAqB,IAAI,CAAC,GAAG,+BAA+B,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QACtH,CAAC;QAED,wDAAwD;QACxD,IACI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;YAC/C,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,cAAc,EAClD,CAAC;YACC,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,SAAS,CACX,MAAgB,EAChB,SAA2B,EAC3B,YAAuC;QAEvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yCAAyC,MAAM,EAAE,CAAC,CAAC;QAEnE,gFAAgF;QAChF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,EAAE,CAAC;YACR,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;QAC/D,CAAC;QAED,wEAAwE;QACxE,MAAM,IAAI,CAAC,0BAA0B,CAAC;YAClC,cAAc,EAAE,IAAI,CAAC,eAAe;YACpC,SAAS,EAAE,SAAS;SACvB,CAAC,CAAC;QAEH,kBAAkB;QAClB,MAAM,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;CACJ,CAAA;AA3MY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,mBAAU,GAAE;qCAKqC,kCAAuB;QAC1B,+BAAoB;QAClB,oCAAsB;QACrB,qCAAuB;GAP5D,uBAAuB,CA2MnC"}

package/dist/managers/organization.manager.d.ts

@@ -0,0 +1,39 @@
+import { ObjectId } from 'mongodb';
+import * as models from '@trailmix-cms/models';
+import { Utils } from '@trailmix-cms/db';
+import { OrganizationCollection, SecurityAuditCollection } from '../collections';
+import { AuthorizationService, OrganizationRoleService, OrganizationService } from '../services';
+import { RequestPrincipal } from '../types';
+export type UpdateOrganizationParams = Partial<Utils.Creatable<models.Organization.Entity>>;
+export type FindOrganizationsParams = Partial<Utils.Creatable<models.Organization.Entity>>;
+export declare class OrganizationManager {
+    private readonly organizationCollection;
+    private readonly authorizationService;
+    private readonly organizationRoleService;
+    private readonly organizationService;
+    private readonly securityAuditCollection;
+    private readonly logger;
+    constructor(organizationCollection: OrganizationCollection, authorizationService: AuthorizationService, organizationRoleService: OrganizationRoleService, organizationService: OrganizationService, securityAuditCollection: SecurityAuditCollection);
+    private authorizeAdminOrganizationAccess;
+    private authorizeReaderOrganizationAccess;
+    find(filter: FindOrganizationsParams, principal: RequestPrincipal): Promise<import("mongodb").WithId<{
+        _id: ObjectId;
+        created_at: Date;
+        name: string;
+        updated_at?: Date | undefined;
+    }>[]>;
+    get(organization: models.Organization.Entity, principal: RequestPrincipal): Promise<{
+        _id: ObjectId;
+        created_at: Date;
+        name: string;
+        updated_at?: Date | undefined;
+    }>;
+    update(organization: models.Organization.Entity, update: UpdateOrganizationParams, principal: RequestPrincipal, auditContext: models.AuditContext.Model): Promise<import("mongodb").WithId<{
+        _id: ObjectId;
+        created_at: Date;
+        name: string;
+        updated_at?: Date | undefined;
+    }>>;
+    delete(organization: models.Organization.Entity, principal: RequestPrincipal, auditContext: models.AuditContext.Model): Promise<void>;
+}
+//# sourceMappingURL=organization.manager.d.ts.map

package/dist/managers/organization.manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.manager.d.ts","sourceRoot":"","sources":["../../src/managers/organization.manager.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEzC,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjG,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAG5C,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AAC5F,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AAE3F,qBACa,mBAAmB;IAIxB,OAAO,CAAC,QAAQ,CAAC,sBAAsB;IACvC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAP5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;gBAG1C,sBAAsB,EAAE,sBAAsB,EAC9C,oBAAoB,EAAE,oBAAoB,EAC1C,uBAAuB,EAAE,uBAAuB,EAChD,mBAAmB,EAAE,mBAAmB,EACxC,uBAAuB,EAAE,uBAAuB;YAGvD,gCAAgC;YAwChC,iCAAiC;IAiCzC,IAAI,CACN,MAAM,EAAE,uBAAuB,EAC/B,SAAS,EAAE,gBAAgB;;;;;;IAwCzB,GAAG,CACL,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,EACxC,SAAS,EAAE,gBAAgB;;;;;;IAYzB,MAAM,CACR,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,EACxC,MAAM,EAAE,wBAAwB,EAChC,SAAS,EAAE,gBAAgB,EAC3B,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK;;;;;;IAwBrC,MAAM,CACR,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,MAAM,EACxC,SAAS,EAAE,gBAAgB,EAC3B,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,GACxC,OAAO,CAAC,IAAI,CAAC;CAcnB"}

package/dist/managers/organization.manager.js

@@ -0,0 +1,196 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var OrganizationManager_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrganizationManager = void 0;
+const common_1 = require("@nestjs/common");
+const models = __importStar(require("@trailmix-cms/models"));
+const collections_1 = require("../collections");
+const services_1 = require("../services");
+let OrganizationManager = OrganizationManager_1 = class OrganizationManager {
+    organizationCollection;
+    authorizationService;
+    organizationRoleService;
+    organizationService;
+    securityAuditCollection;
+    logger = new common_1.Logger(OrganizationManager_1.name);
+    constructor(organizationCollection, authorizationService, organizationRoleService, organizationService, securityAuditCollection) {
+        this.organizationCollection = organizationCollection;
+        this.authorizationService = authorizationService;
+        this.organizationRoleService = organizationRoleService;
+        this.organizationService = organizationService;
+        this.securityAuditCollection = securityAuditCollection;
+    }
+    async authorizeAdminOrganizationAccess(params) {
+        const { organizationId, principal, securityAuditMessage } = params;
+        const accessResult = await this.authorizationService.resolveOrganizationAuthorization({
+            principal,
+            rolesAllowList: [
+                models.RoleValue.Admin,
+                models.RoleValue.Owner,
+            ],
+            principalTypeAllowList: [models.Principal.Account, models.Principal.ApiKey],
+            organizationId: organizationId,
+        });
+        if (!accessResult.hasAccess) {
+            await this.securityAuditCollection.insertOne({
+                event_type: models.SecurityAuditEventType.UnauthorizedAccess,
+                principal_id: principal.entity._id,
+                principal_type: principal.principal_type,
+                message: securityAuditMessage,
+                source: OrganizationManager_1.name,
+            });
+            // If the principal has at least reader organization role, throw a forbidden exception since they have access to the organization
+            if (accessResult.organizationRoles.some(role => [
+                models.RoleValue.Owner,
+                models.RoleValue.Admin,
+                models.RoleValue.User,
+                models.RoleValue.Reader,
+            ].includes(role.role))) {
+                throw new common_1.ForbiddenException(`Insufficient permissions to perform this action on organization ${organizationId}`);
+            }
+            throw new common_1.NotFoundException(`Organization ${organizationId} not found`);
+        }
+    }
+    async authorizeReaderOrganizationAccess(params) {
+        const { organizationId, principal, securityAuditMessage } = params;
+        const accessResult = await this.authorizationService.resolveOrganizationAuthorization({
+            principal,
+            rolesAllowList: [
+                models.RoleValue.Owner,
+                models.RoleValue.Admin,
+                models.RoleValue.User,
+                models.RoleValue.Reader,
+            ],
+            principalTypeAllowList: [models.Principal.Account, models.Principal.ApiKey],
+            organizationId: organizationId,
+        });
+        if (!accessResult.hasAccess) {
+            await this.securityAuditCollection.insertOne({
+                event_type: models.SecurityAuditEventType.UnauthorizedAccess,
+                principal_id: principal.entity._id,
+                principal_type: principal.principal_type,
+                message: securityAuditMessage,
+                source: OrganizationManager_1.name,
+            });
+            throw new common_1.NotFoundException(`Organization ${organizationId} not found`);
+        }
+        return accessResult;
+    }
+    async find(filter, principal) {
+        this.logger.log(`Finding organizations with filter: ${JSON.stringify(filter)}`);
+        // Global admins can see all organizations
+        const isGlobalAdmin = await this.authorizationService.isGlobalAdmin(principal.entity._id, principal.principal_type);
+        if (isGlobalAdmin) {
+            return await this.organizationCollection.find(filter);
+        }
+        // Non-global admins can only see organizations they belong to
+        const organizationRoles = await this.organizationRoleService.find({
+            principal_id: principal.entity._id,
+            principal_type: principal.principal_type,
+            role: {
+                $in: [
+                    models.RoleValue.Owner,
+                    models.RoleValue.Admin,
+                    models.RoleValue.User,
+                    models.RoleValue.Reader,
+                ]
+            },
+        });
+        const organizationIds = organizationRoles.map(role => role.organization_id);
+        if (organizationIds.length === 0) {
+            return [];
+        }
+        const query = {
+            ...filter,
+            _id: { $in: organizationIds },
+        };
+        return await this.organizationCollection.find(query);
+    }
+    async get(organization, principal) {
+        // Check authorization - user must be global admin or organization member
+        await this.authorizeReaderOrganizationAccess({
+            organizationId: organization._id,
+            principal,
+            securityAuditMessage: `Insufficient permissions to access organization ${organization._id}`,
+        });
+        return organization;
+    }
+    async update(organization, update, principal, auditContext) {
+        this.logger.log(`Updating organization ${organization._id}`);
+        // Check authorization - user must be global admin or organization admin
+        await this.authorizeAdminOrganizationAccess({
+            organizationId: organization._id,
+            principal,
+            securityAuditMessage: `Unauthorized attempt to update organization ${organization._id}`,
+        });
+        const updatedOrganization = await this.organizationCollection.findOneAndUpdate({ _id: organization._id }, update, auditContext);
+        if (!updatedOrganization) {
+            throw new common_1.InternalServerErrorException('Organization not found after update');
+        }
+        return updatedOrganization;
+    }
+    async delete(organization, principal, auditContext) {
+        this.logger.log(`Deleting organization ${organization._id}`);
+        // Check authorization - user must be global admin or organization admin
+        await this.authorizeAdminOrganizationAccess({
+            organizationId: organization._id,
+            principal,
+            securityAuditMessage: `Unauthorized attempt to delete organization ${organization._id}`,
+        });
+        // Use the service's deleteOrganization method which handles cascade delete with transactions
+        await this.organizationService.deleteOrganization(organization._id, auditContext);
+        this.logger.log(`Deleted organization ${organization._id}`);
+    }
+};
+exports.OrganizationManager = OrganizationManager;
+exports.OrganizationManager = OrganizationManager = OrganizationManager_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [collections_1.OrganizationCollection,
+        services_1.AuthorizationService,
+        services_1.OrganizationRoleService,
+        services_1.OrganizationService,
+        collections_1.SecurityAuditCollection])
+], OrganizationManager);
+//# sourceMappingURL=organization.manager.js.map

package/dist/managers/organization.manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.manager.js","sourceRoot":"","sources":["../../src/managers/organization.manager.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAyH;AAEzH,6DAA+C;AAG/C,gDAAiF;AACjF,0CAAiG;AAQ1F,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAIP;IACA;IACA;IACA;IACA;IAPJ,MAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;IAE/D,YACqB,sBAA8C,EAC9C,oBAA0C,EAC1C,uBAAgD,EAChD,mBAAwC,EACxC,uBAAgD;QAJhD,2BAAsB,GAAtB,sBAAsB,CAAwB;QAC9C,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,4BAAuB,GAAvB,uBAAuB,CAAyB;IACjE,CAAC;IAEG,KAAK,CAAC,gCAAgC,CAAC,MAI9C;QACG,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAAC;QAEnE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,gCAAgC,CAAC;YAClF,SAAS;YACT,cAAc,EAAE;gBACZ,MAAM,CAAC,SAAS,CAAC,KAAK;gBACtB,MAAM,CAAC,SAAS,CAAC,KAAK;aACzB;YACD,sBAAsB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;YAC3E,cAAc,EAAE,cAAc;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;gBACzC,UAAU,EAAE,MAAM,CAAC,sBAAsB,CAAC,kBAAkB;gBAC5D,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBAClC,cAAc,EAAE,SAAS,CAAC,cAAc;gBACxC,OAAO,EAAE,oBAAoB;gBAC7B,MAAM,EAAE,qBAAmB,CAAC,IAAI;aACnC,CAAC,CAAC;YACH,iIAAiI;YACjI,IAAI,YAAY,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC1C;gBACG,MAAM,CAAC,SAAS,CAAC,KAAK;gBACtB,MAAM,CAAC,SAAS,CAAC,KAAK;gBACtB,MAAM,CAAC,SAAS,CAAC,IAAI;gBACrB,MAAM,CAAC,SAAS,CAAC,MAAM;aAE1B,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,2BAAkB,CAAC,mEAAmE,cAAc,EAAE,CAAC,CAAC;YACtH,CAAC;YACD,MAAM,IAAI,0BAAiB,CAAC,gBAAgB,cAAc,YAAY,CAAC,CAAC;QAC5E,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,iCAAiC,CAAC,MAI/C;QACG,MAAM,EAAE,cAAc,EAAE,SAAS,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAAC;QAEnE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,gCAAgC,CAAC;YAClF,SAAS;YACT,cAAc,EAAE;gBACZ,MAAM,CAAC,SAAS,CAAC,KAAK;gBACtB,MAAM,CAAC,SAAS,CAAC,KAAK;gBACtB,MAAM,CAAC,SAAS,CAAC,IAAI;gBACrB,MAAM,CAAC,SAAS,CAAC,MAAM;aAC1B;YACD,sBAAsB,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC;YAC3E,cAAc,EAAE,cAAc;SACjC,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;gBACzC,UAAU,EAAE,MAAM,CAAC,sBAAsB,CAAC,kBAAkB;gBAC5D,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;gBAClC,cAAc,EAAE,SAAS,CAAC,cAAc;gBACxC,OAAO,EAAE,oBAAoB;gBAC7B,MAAM,EAAE,qBAAmB,CAAC,IAAI;aACnC,CAAC,CAAC;YACH,MAAM,IAAI,0BAAiB,CAAC,gBAAgB,cAAc,YAAY,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,IAAI,CACN,MAA+B,EAC/B,SAA2B;QAE3B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,sCAAsC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAEhF,0CAA0C;QAC1C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAC/D,SAAS,CAAC,MAAM,CAAC,GAAG,EACpB,SAAS,CAAC,cAAc,CAC3B,CAAC;QACF,IAAI,aAAa,EAAE,CAAC;YAChB,OAAO,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC;QAED,8DAA8D;QAC9D,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC;YAC9D,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;YAClC,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,IAAI,EAAE;gBACF,GAAG,EAAE;oBACD,MAAM,CAAC,SAAS,CAAC,KAAK;oBACtB,MAAM,CAAC,SAAS,CAAC,KAAK;oBACtB,MAAM,CAAC,SAAS,CAAC,IAAI;oBACrB,MAAM,CAAC,SAAS,CAAC,MAAM;iBAC1B;aACJ;SACqC,CAAC,CAAC;QAE5C,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC5E,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC;QACd,CAAC;QAED,MAAM,KAAK,GAAuC;YAC9C,GAAG,MAAM;YACT,GAAG,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;SAChC,CAAC;QAEF,OAAO,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,GAAG,CACL,YAAwC,EACxC,SAA2B;QAE3B,yEAAyE;QACzE,MAAM,IAAI,CAAC,iCAAiC,CAAC;YACzC,cAAc,EAAE,YAAY,CAAC,GAAG;YAChC,SAAS;YACT,oBAAoB,EAAE,mDAAmD,YAAY,CAAC,GAAG,EAAE;SAC9F,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,MAAM,CACR,YAAwC,EACxC,MAAgC,EAChC,SAA2B,EAC3B,YAAuC;QAEvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC;QAE7D,wEAAwE;QACxE,MAAM,IAAI,CAAC,gCAAgC,CAAC;YACxC,cAAc,EAAE,YAAY,CAAC,GAAG;YAChC,SAAS;YACT,oBAAoB,EAAE,+CAA+C,YAAY,CAAC,GAAG,EAAE;SAC1F,CAAC,CAAC;QAEH,MAAM,mBAAmB,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,gBAAgB,CAC1E,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,EACzB,MAAM,EACN,YAAY,CACf,CAAC;QAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACvB,MAAM,IAAI,qCAA4B,CAAC,qCAAqC,CAAC,CAAC;QAClF,CAAC;QAED,OAAO,mBAAmB,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,MAAM,CACR,YAAwC,EACxC,SAA2B,EAC3B,YAAuC;QAEvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC;QAE7D,wEAAwE;QACxE,MAAM,IAAI,CAAC,gCAAgC,CAAC;YACxC,cAAc,EAAE,YAAY,CAAC,GAAG;YAChC,SAAS;YACT,oBAAoB,EAAE,+CAA+C,YAAY,CAAC,GAAG,EAAE;SAC1F,CAAC,CAAC;QAEH,6FAA6F;QAC7F,MAAM,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,YAAY,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,wBAAwB,YAAY,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,CAAC;CACJ,CAAA;AA1LY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,mBAAU,GAAE;qCAKoC,oCAAsB;QACxB,+BAAoB;QACjB,kCAAuB;QAC3B,8BAAmB;QACf,qCAAuB;GAR5D,mBAAmB,CA0L/B"}

package/dist/module.d.ts

@@ -0,0 +1,92 @@
+import { OptionalUnlessRequiredId, Collection } from 'mongodb';
+import { ZodType } from 'zod';
+import * as models from '@trailmix-cms/models';
+import { type CollectionConfig } from './types';
+import * as Collections from './collections';
+import * as Services from './services';
+import * as Managers from './managers';
+import { type FeatureConfig } from './types';
+export interface TrailmixCMSOptions<AccountEntity extends models.Account.Entity = models.Account.Entity, AccountDtoEntity = AccountEntity, OrganizationEntity extends models.Organization.Entity = models.Organization.Entity, OrganizationDtoEntity = OrganizationEntity> {
+    entities?: {
+        accountSchema?: ZodType<OptionalUnlessRequiredId<AccountEntity>>;
+        accountSetup?: (collection: Collection<AccountEntity>) => Promise<void>;
+        accountDtoSchema?: ZodType<OptionalUnlessRequiredId<AccountDtoEntity>>;
+        accountMapEntity?: (entity: AccountEntity) => AccountDtoEntity;
+        accountConfig?: CollectionConfig;
+        organizationSchema?: ZodType<OptionalUnlessRequiredId<OrganizationEntity>>;
+        organizationSetup?: (collection: Collection<OrganizationEntity>) => Promise<void>;
+        organizationDtoSchema?: ZodType<OptionalUnlessRequiredId<OrganizationDtoEntity>>;
+        organizationMapEntity?: (entity: OrganizationEntity) => OrganizationDtoEntity;
+        organizationConfig?: CollectionConfig;
+    };
+    features?: FeatureConfig;
+}
+export declare function setupTrailmixCMS<AccountEntity extends models.Account.Entity = models.Account.Entity, AccountDtoEntity = AccountEntity, OrganizationEntity extends models.Organization.Entity = models.Organization.Entity, OrganizationDtoEntity = OrganizationEntity>(options?: TrailmixCMSOptions<AccountEntity, AccountDtoEntity, OrganizationEntity, OrganizationDtoEntity>): {
+    providers: (typeof Collections.AccountCollection | typeof Collections.OrganizationCollection | typeof Collections.RoleCollection | typeof Collections.SecurityAuditCollection | typeof Collections.ApiKeyCollection | typeof Services.AccountService | typeof Services.GlobalRoleService | typeof Services.AuthService | typeof Services.OrganizationRoleService | typeof Services.AuthorizationService | typeof Services.ApiKeyService | typeof Services.OrganizationService | typeof Managers.GlobalRoleManager | typeof Managers.OrganizationRoleManager | typeof Managers.OrganizationManager | typeof import("@trailmix-cms/db/dist/collections").AuditCollection | {
+        provide: string;
+        inject: {
+            new (internalConfig?: Record<string, any>): import("@nestjs/config").ConfigService<{
+                onModuleInit: boolean;
+                MONGODB_CONNECTION_STRING: string;
+                MONGODB_DATABASE_NAME: string;
+                GENERATE_SPEC: boolean;
+                isDevelopment: boolean;
+                isDev: boolean;
+                isTest: boolean;
+                isProduction: boolean;
+                isProd: boolean;
+            }, false>;
+        }[];
+        useFactory: (configService: import("@nestjs/config").ConfigService<import("@trailmix-cms/db").AppConfig>) => Promise<{
+            client: import("mongodb").MongoClient;
+            db: import("mongodb").Db;
+        }>;
+    } | typeof import("@trailmix-cms/db").DatabaseService | {
+        provide: string;
+        useFactory: (databaseService: import("@trailmix-cms/db").DatabaseService) => Promise<import("mongodb").Collection<import("bson").Document>>;
+        inject: (typeof import("@trailmix-cms/db").DatabaseService)[];
+    } | {
+        provide: string;
+        useFactory: (databaseService: import("@trailmix-cms/db").DatabaseService) => Promise<Collection<import("bson").Document>>;
+        inject: (typeof import("@trailmix-cms/db").DatabaseService)[];
+    } | {
+        provide: typeof Services.FeatureService;
+        useValue: Services.FeatureService;
+    } | {
+        provide: "TRAILMIXCMS_CMS_ACCOUNT_SCHEMA";
+        useValue: import("zod").ZodObject<{
+            _id: import("zod").ZodCodec<import("zod").ZodString, import("zod").ZodCustom<import("bson").ObjectId, import("bson").ObjectId>>;
+            created_at: import("zod").ZodCodec<import("zod").ZodISODateTime, import("zod").ZodDate>;
+            updated_at: import("zod").ZodOptional<import("zod").ZodCodec<import("zod").ZodISODateTime, import("zod").ZodDate>>;
+            user_id: import("zod").ZodString;
+        }, import("zod/v4/core").$strip> | ZodType<OptionalUnlessRequiredId<AccountEntity>, unknown, import("zod/v4/core").$ZodTypeInternals<OptionalUnlessRequiredId<AccountEntity>, unknown>>;
+    } | {
+        provide: "TRAILMIXCMS_CMS_ACCOUNT_SETUP";
+        useValue: (collection: Collection<AccountEntity>) => Promise<void>;
+    } | {
+        provide: "TRAILMIXCMS_CMS_ACCOUNT_CONFIG";
+        useValue: CollectionConfig;
+    } | {
+        provide: "TRAILMIXCMS_CMS_ACCOUNT_MAP_ENTITY";
+        useValue: ((entity: AccountEntity) => AccountDtoEntity) | ((entity: AccountEntity) => AccountEntity);
+    } | {
+        provide: "TRAILMIXCMS_CMS_ORGANIZATION_SCHEMA";
+        useValue: import("zod").ZodObject<{
+            _id: import("zod").ZodCodec<import("zod").ZodString, import("zod").ZodCustom<import("bson").ObjectId, import("bson").ObjectId>>;
+            created_at: import("zod").ZodCodec<import("zod").ZodISODateTime, import("zod").ZodDate>;
+            updated_at: import("zod").ZodOptional<import("zod").ZodCodec<import("zod").ZodISODateTime, import("zod").ZodDate>>;
+            name: import("zod").ZodString;
+        }, import("zod/v4/core").$strip> | ZodType<OptionalUnlessRequiredId<OrganizationEntity>, unknown, import("zod/v4/core").$ZodTypeInternals<OptionalUnlessRequiredId<OrganizationEntity>, unknown>>;
+    } | {
+        provide: "TRAILMIXCMS_CMS_ORGANIZATION_SETUP";
+        useValue: (collection: Collection<OrganizationEntity>) => Promise<void>;
+    } | {
+        provide: "TRAILMIXCMS_CMS_ORGANIZATION_CONFIG";
+        useValue: CollectionConfig;
+    } | {
+        provide: "TRAILMIXCMS_CMS_ORGANIZATION_MAP_ENTITY";
+        useValue: ((entity: OrganizationEntity) => OrganizationDtoEntity) | ((entity: OrganizationEntity) => OrganizationEntity);
+    })[];
+    controllers: any[];
+};
+//# sourceMappingURL=module.d.ts.map

package/dist/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,KAAK,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAC;AAK/C,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAEhD,OAAO,KAAK,WAAW,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,QAAQ,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAO7C,MAAM,WAAW,kBAAkB,CAC/B,aAAa,SAAS,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EACnE,gBAAgB,GAAG,aAAa,EAEhC,kBAAkB,SAAS,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,EAClF,qBAAqB,GAAG,kBAAkB;IAE1C,QAAQ,CAAC,EAAE;QACP,aAAa,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,aAAa,CAAC,CAAC,CAAC;QACjE,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,aAAa,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACxE,gBAAgB,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACvE,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK,gBAAgB,CAAC;QAC/D,aAAa,CAAC,EAAE,gBAAgB,CAAC;QAEjC,kBAAkB,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,kBAAkB,CAAC,CAAC,CAAC;QAC3E,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,kBAAkB,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAClF,qBAAqB,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,qBAAqB,CAAC,CAAC,CAAC;QACjF,qBAAqB,CAAC,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,qBAAqB,CAAC;QAC9E,kBAAkB,CAAC,EAAE,gBAAgB,CAAC;KACzC,CAAC;IACF,QAAQ,CAAC,EAAE,aAAa,CAAA;CAC3B;AAED,wBAAgB,gBAAgB,CAC5B,aAAa,SAAS,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EACnE,gBAAgB,GAAG,aAAa,EAEhC,kBAAkB,SAAS,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,EAClF,qBAAqB,GAAG,kBAAkB,EAE5C,OAAO,CAAC,EAAE,kBAAkB,CAC1B,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,CACxB;;;;+BAlDe,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6DAwBiD,OAAO,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;kEAMH,OAAO,CAAC,IAAI,CAAC;;;;;;;;;EAkHxF"}