@trailmix-cms/cms 0.4.4 → 0.7.2

package/dist/services/authorization.service.d.ts

@@ -1,14 +1,49 @@
+import { ObjectId } from 'mongodb';
 import * as models from '@trailmix-cms/models';
-export interface AccountAuthorization {
-    account?: models.Account.Entity;
-    roles: (models.Role | string)[];
-}
-export type AuthorizableEntity = models.Authorization.Model & models.Publishable.Model;
+import { GlobalRoleService } from './global-role.service';
+import { OrganizationRoleService } from './organization-role.service';
+import { RequestPrincipal } from '../types';
+import * as trailmixModels from '@trailmix-cms/models';
+import { SecurityAuditCollection } from '../collections/security-audit.collection';
 export declare class AuthorizationService {
+    private readonly globalRoleService;
+    private readonly organizationRoleService;
+    private readonly securityAuditCollection;
     private readonly logger;
-    constructor();
-    validateAuthorization<T extends AuthorizableEntity>(accountAuthorization: AccountAuthorization, entity: T): Promise<boolean>;
-    checkAccountAuthorizationOnEntity<T extends AuthorizableEntity>(accountAuthorization: AccountAuthorization, entity: T): boolean;
+    constructor(globalRoleService: GlobalRoleService, organizationRoleService: OrganizationRoleService, securityAuditCollection: SecurityAuditCollection);
+    /**
+     * Check if a principal is a global admin
+     * @param principalId - The principal's ID
+     * @param principalType - The principal's type (Account or ApiKey)
+     * @returns True if the principal is a global admin, false otherwise
+     */
+    isGlobalAdmin(principalId: ObjectId, principalType: models.Principal): Promise<boolean>;
+    resolveOrganizationAuthorization(params: {
+        principal: RequestPrincipal;
+        rolesAllowList: string[];
+        principalTypeAllowList: models.Principal[];
+        organizationId: ObjectId;
+    }): Promise<{
+        hasAccess: boolean;
+        isGlobalAdmin: boolean;
+        globalRoles: {
+            _id: ObjectId;
+            created_at: Date;
+            principal_id: ObjectId;
+            principal_type: "account" | "api_key";
+            role: string;
+            updated_at?: Date | undefined;
+        }[];
+        organizationRoles: {
+            _id: ObjectId;
+            created_at: Date;
+            principal_id: ObjectId;
+            principal_type: "account" | "api_key";
+            role: string;
+            organization_id: ObjectId;
+            updated_at?: Date | undefined;
+        }[];
+    }>;
+    authorizeApiKeyAccessForPrincipal(principal: RequestPrincipal, apiKeyScopeType: trailmixModels.ApiKeyScope, apiKeyScopeId?: ObjectId): Promise<boolean>;
 }
-export declare const AccountAuthorization: (...dataOrPipes: unknown[]) => ParameterDecorator;
 //# sourceMappingURL=authorization.service.d.ts.map

package/dist/services/authorization.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.service.d.ts","sourceRoot":"","sources":["../../src/services/authorization.service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAC;AAE/C,MAAM,WAAW,oBAAoB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC;CACnC;AAED,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC;AAEvF,qBACa,oBAAoB;IAC7B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;;IAI1D,qBAAqB,CAAC,CAAC,SAAS,kBAAkB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAS/G,iCAAiC,CAAC,CAAC,SAAS,kBAAkB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC;CAiCxH;AAED,eAAO,MAAM,oBAAoB,mDAUhC,CAAA"}
+{"version":3,"file":"authorization.service.d.ts","sourceRoot":"","sources":["../../src/services/authorization.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,cAAc,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAEnF,qBACa,oBAAoB;IAIzB,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IACxC,OAAO,CAAC,QAAQ,CAAC,uBAAuB;IAL5C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyC;gBAG3C,iBAAiB,EAAE,iBAAiB,EACpC,uBAAuB,EAAE,uBAAuB,EAChD,uBAAuB,EAAE,uBAAuB;IAGrE;;;;;OAKG;IACG,aAAa,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;IAUvF,gCAAgC,CAAC,MAAM,EAAE;QAC3C,SAAS,EAAE,gBAAgB,CAAC;QAC5B,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,sBAAsB,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC3C,cAAc,EAAE,QAAQ,CAAC;KAC5B;;;;;;;;;;;;;;;;;;;;;IA6BK,iCAAiC,CAAC,SAAS,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;CA8DhK"}

package/dist/services/authorization.service.js

@@ -43,59 +43,125 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 var AuthorizationService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AccountAuthorization = exports.AuthorizationService = void 0;
+exports.AuthorizationService = void 0;
 const common_1 = require("@nestjs/common");
 const models = __importStar(require("@trailmix-cms/models"));
+const global_role_service_1 = require("./global-role.service");
+const organization_role_service_1 = require("./organization-role.service");
+const trailmixModels = __importStar(require("@trailmix-cms/models"));
+const security_audit_collection_1 = require("../collections/security-audit.collection");
 let AuthorizationService = AuthorizationService_1 = class AuthorizationService {
+    globalRoleService;
+    organizationRoleService;
+    securityAuditCollection;
     logger = new common_1.Logger(AuthorizationService_1.name);
-    constructor() { }
-    async validateAuthorization(accountAuthorization, entity) {
-        const result = this.checkAccountAuthorizationOnEntity(accountAuthorization, entity);
-        if (!result) {
-            // TODO: security audit
-            throw new common_1.NotFoundException('Entity not found');
-        }
-        return result;
+    constructor(globalRoleService, organizationRoleService, securityAuditCollection) {
+        this.globalRoleService = globalRoleService;
+        this.organizationRoleService = organizationRoleService;
+        this.securityAuditCollection = securityAuditCollection;
     }
-    checkAccountAuthorizationOnEntity(accountAuthorization, entity) {
-        // console.log('checkAccountAuthorizationOnEntity', { accountAuthorization }, { entity });
-        const account = accountAuthorization.account;
-        if (accountAuthorization.roles.includes(models.Role.Admin)) {
-            return true;
-        }
-        if (!entity.authorization) {
-            // Only admin can access entities that have no "authorization"
-            // TODO: security audit
-            this.logger.warn('Entity has no authorization', { entity });
-            return false;
-        }
-        // IF entity does not have a published property, it is published
-        if (entity.published === false) {
-            return false;
-        }
-        if (entity.authorization.public) {
-            return true;
-        }
-        if (entity.authorization.roles?.some(role => accountAuthorization.roles.includes(role))) {
+    /**
+     * Check if a principal is a global admin
+     * @param principalId - The principal's ID
+     * @param principalType - The principal's type (Account or ApiKey)
+     * @returns True if the principal is a global admin, false otherwise
+     */
+    async isGlobalAdmin(principalId, principalType) {
+        const globalRoles = await this.globalRoleService.findOne({
+            principal_id: principalId,
+            principal_type: principalType,
+            role: models.RoleValue.Admin,
+        });
+        return !!globalRoles;
+    }
+    async resolveOrganizationAuthorization(params) {
+        const { principal, rolesAllowList, principalTypeAllowList, organizationId } = params;
+        const principal_id = principal.entity._id;
+        const principal_type = principal.principal_type;
+        const globalRoles = await this.globalRoleService.find({
+            principal_id,
+            principal_type
+        });
+        const isGlobalAdmin = globalRoles.some(role => role.role === models.RoleValue.Admin);
+        const organizationRoles = await this.organizationRoleService.find({
+            principal_id,
+            principal_type,
+            organization_id: organizationId,
+        });
+        const hasAccess = isGlobalAdmin ||
+            (organizationRoles.some(role => {
+                return rolesAllowList.includes(role.role);
+            }) &&
+                principalTypeAllowList.includes(principal_type));
+        return { hasAccess, isGlobalAdmin, globalRoles, organizationRoles };
+    }
+    async authorizeApiKeyAccessForPrincipal(principal, apiKeyScopeType, apiKeyScopeId) {
+        // Global admins have access to all API keys
+        const isGlobalAdmin = await this.isGlobalAdmin(principal.entity._id, principal.principal_type);
+        if (isGlobalAdmin) {
             return true;
         }
-        if (account && entity.authorization.accountIds?.some(id => account._id.equals(id))) {
-            return true;
+        switch (apiKeyScopeType) {
+            case trailmixModels.ApiKeyScope.Global: {
+                await this.securityAuditCollection.insertOne({
+                    event_type: trailmixModels.SecurityAuditEventType.UnauthorizedAccess,
+                    principal_id: principal.entity._id,
+                    principal_type: principal.principal_type,
+                    message: 'Unauthorized attempt to get global-scoped API key for non-global admins',
+                    source: AuthorizationService_1.name,
+                });
+                return false;
+            }
+            case trailmixModels.ApiKeyScope.Account: {
+                if (!apiKeyScopeId) {
+                    throw new Error('API key scope ID is required for account-scoped API keys');
+                }
+                if (!apiKeyScopeId.equals(principal.entity._id)) {
+                    await this.securityAuditCollection.insertOne({
+                        event_type: trailmixModels.SecurityAuditEventType.UnauthorizedAccess,
+                        principal_id: principal.entity._id,
+                        principal_type: principal.principal_type,
+                        message: 'Unauthorized attempt to get account-scoped API key for another principal',
+                        source: AuthorizationService_1.name,
+                    });
+                    return false;
+                }
+                return true;
+            }
+            case trailmixModels.ApiKeyScope.Organization: {
+                if (!apiKeyScopeId) {
+                    throw new Error('API key scope ID is required for organization-scoped API keys');
+                }
+                const requiredRoles = [trailmixModels.RoleValue.Admin, trailmixModels.RoleValue.Owner];
+                const accessResult = await this.resolveOrganizationAuthorization({
+                    principal,
+                    rolesAllowList: requiredRoles,
+                    principalTypeAllowList: [trailmixModels.Principal.Account],
+                    organizationId: apiKeyScopeId,
+                });
+                if (!accessResult.hasAccess) {
+                    await this.securityAuditCollection.insertOne({
+                        event_type: trailmixModels.SecurityAuditEventType.UnauthorizedAccess,
+                        principal_id: principal.entity._id,
+                        principal_type: principal.principal_type,
+                        message: `Unauthorized attempt to get organization-scoped API key without ${requiredRoles} role on the organization ${apiKeyScopeId}`,
+                        source: AuthorizationService_1.name,
+                    });
+                    return false;
+                }
+                return true;
+            }
+            default: {
+                throw new Error(`Invalid scope type: ${apiKeyScopeType}`);
+            }
         }
-        return false;
     }
 };
 exports.AuthorizationService = AuthorizationService;
 exports.AuthorizationService = AuthorizationService = AuthorizationService_1 = __decorate([
     (0, common_1.Injectable)(),
-    __metadata("design:paramtypes", [])
+    __metadata("design:paramtypes", [global_role_service_1.GlobalRoleService,
+        organization_role_service_1.OrganizationRoleService,
+        security_audit_collection_1.SecurityAuditCollection])
 ], AuthorizationService);
-exports.AccountAuthorization = (0, common_1.createParamDecorator)((data, ctx) => {
-    const request = ctx.switchToHttp().getRequest();
-    const accountAuthorization = {
-        account: request.account,
-        roles: request.account?.roles ? request.account.roles.map(role => role) : [],
-    };
-    return accountAuthorization;
-});
 //# sourceMappingURL=authorization.service.js.map

package/dist/services/authorization.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorization.service.js","sourceRoot":"","sources":["../../src/services/authorization.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA+G;AAE/G,6DAA+C;AAUxC,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IACZ,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEhE,gBAAgB,CAAC;IAEjB,KAAK,CAAC,qBAAqB,CAA+B,oBAA0C,EAAE,MAAS;QAC3G,MAAM,MAAM,GAAG,IAAI,CAAC,iCAAiC,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,uBAAuB;YACvB,MAAM,IAAI,0BAAiB,CAAC,kBAAkB,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,iCAAiC,CAA+B,oBAA0C,EAAE,MAAS;QACjH,0FAA0F;QAC1F,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC;QAE7C,IAAI,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YACxB,8DAA8D;YAC9D,uBAAuB;YACvB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5D,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,gEAAgE;QAChE,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;YAC7B,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACtF,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,OAAO,IAAI,MAAM,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;CACJ,CAAA;AA/CY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;;GACA,oBAAoB,CA+ChC;AAEY,QAAA,oBAAoB,GAAG,IAAA,6BAAoB,EACpD,CAAC,IAAa,EAAE,GAAqB,EAAE,EAAE;IACrC,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,EAAkB,CAAC;IAEhE,MAAM,oBAAoB,GAAyB;QAC/C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAmB,CAAC,CAAC,CAAC,CAAC,EAAE;KAC9F,CAAA;IACD,OAAO,oBAAoB,CAAC;AAChC,CAAC,CACJ,CAAA"}
+{"version":3,"file":"authorization.service.js","sourceRoot":"","sources":["../../src/services/authorization.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAyE;AAEzE,6DAA+C;AAC/C,+DAA0D;AAC1D,2EAAsE;AAEtE,qEAAuD;AACvD,wFAAmF;AAG5E,IAAM,oBAAoB,4BAA1B,MAAM,oBAAoB;IAIR;IACA;IACA;IALJ,MAAM,GAAG,IAAI,eAAM,CAAC,sBAAoB,CAAC,IAAI,CAAC,CAAC;IAEhE,YACqB,iBAAoC,EACpC,uBAAgD,EAChD,uBAAgD;QAFhD,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,4BAAuB,GAAvB,uBAAuB,CAAyB;QAChD,4BAAuB,GAAvB,uBAAuB,CAAyB;IACjE,CAAC;IAEL;;;;;OAKG;IACH,KAAK,CAAC,aAAa,CAAC,WAAqB,EAAE,aAA+B;QACtE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC;YACrD,YAAY,EAAE,WAAW;YACzB,cAAc,EAAE,aAAa;YAC7B,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK;SAC/B,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,WAAW,CAAC;IACzB,CAAC;IAGD,KAAK,CAAC,gCAAgC,CAAC,MAKtC;QACG,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,sBAAsB,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;QAErF,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;QAC1C,MAAM,cAAc,GAAG,SAAS,CAAC,cAAc,CAAC;QAChD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC;YAClD,YAAY;YACZ,cAAc;SACjB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAErF,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC;YAC9D,YAAY;YACZ,cAAc;YACd,eAAe,EAAE,cAAc;SAClC,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,aAAa;YAC3B,CACI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC1B,OAAO,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9C,CAAC,CAAC;gBACF,sBAAsB,CAAC,QAAQ,CAAC,cAAc,CAAC,CAClD,CAAC;QAEN,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACxE,CAAC;IAGD,KAAK,CAAC,iCAAiC,CAAC,SAA2B,EAAE,eAA2C,EAAE,aAAwB;QACtI,4CAA4C;QAC5C,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,cAAc,CAAC,CAAC;QAC/F,IAAI,aAAa,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,QAAQ,eAAe,EAAE,CAAC;YACtB,KAAK,cAAc,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;gBACrC,MAAM,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;oBACzC,UAAU,EAAE,cAAc,CAAC,sBAAsB,CAAC,kBAAkB;oBACpE,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;oBAClC,cAAc,EAAE,SAAS,CAAC,cAAc;oBACxC,OAAO,EAAE,yEAAyE;oBAClF,MAAM,EAAE,sBAAoB,CAAC,IAAI;iBACpC,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACjB,CAAC;YACD,KAAK,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;gBACtC,IAAI,CAAC,aAAa,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;gBAChF,CAAC;gBACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC9C,MAAM,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;wBACzC,UAAU,EAAE,cAAc,CAAC,sBAAsB,CAAC,kBAAkB;wBACpE,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;wBAClC,cAAc,EAAE,SAAS,CAAC,cAAc;wBACxC,OAAO,EAAE,0EAA0E;wBACnF,MAAM,EAAE,sBAAoB,CAAC,IAAI;qBACpC,CAAC,CAAC;oBACH,OAAO,KAAK,CAAC;gBACjB,CAAC;gBACD,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,KAAK,cAAc,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC3C,IAAI,CAAC,aAAa,EAAE,CAAC;oBACjB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;gBACrF,CAAC;gBACD,MAAM,aAAa,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,EAAE,cAAc,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBACvF,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,gCAAgC,CAAC;oBAC7D,SAAS;oBACT,cAAc,EAAE,aAAa;oBAC7B,sBAAsB,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC;oBAC1D,cAAc,EAAE,aAAc;iBACjC,CAAC,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;oBAC1B,MAAM,IAAI,CAAC,uBAAuB,CAAC,SAAS,CAAC;wBACzC,UAAU,EAAE,cAAc,CAAC,sBAAsB,CAAC,kBAAkB;wBACpE,YAAY,EAAE,SAAS,CAAC,MAAM,CAAC,GAAG;wBAClC,cAAc,EAAE,SAAS,CAAC,cAAc;wBACxC,OAAO,EAAE,mEAAmE,aAAa,6BAA6B,aAAa,EAAE;wBACrI,MAAM,EAAE,sBAAoB,CAAC,IAAI;qBACpC,CAAC,CAAC;oBACH,OAAO,KAAK,CAAC;gBACjB,CAAC;gBACD,OAAO,IAAI,CAAC;YAChB,CAAC;YACD,OAAO,CAAC,CAAC,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,uBAAuB,eAAe,EAAE,CAAC,CAAC;YAC9D,CAAC;QACL,CAAC;IACL,CAAC;CACJ,CAAA;AAzHY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAK+B,uCAAiB;QACX,mDAAuB;QACvB,mDAAuB;GAN5D,oBAAoB,CAyHhC"}

package/dist/services/feature.service.d.ts

@@ -0,0 +1,23 @@
+import { ApiKeyScope } from '@trailmix-cms/models';
+import { type FeatureConfig } from '../types';
+export declare class FeatureService {
+    private readonly features;
+    constructor(features?: FeatureConfig);
+    /**
+     * Check if the organizations feature is enabled
+     */
+    isOrganizationsEnabled(): boolean;
+    /**
+     * Check if the API keys feature is enabled
+     */
+    isApiKeysEnabled(): boolean;
+    /**
+     * Get the allowed API key scopes
+     */
+    getApiKeyScopes(): ApiKeyScope[];
+    /**
+     * Get all feature configurations
+     */
+    getFeatures(): FeatureConfig;
+}
+//# sourceMappingURL=feature.service.d.ts.map

package/dist/services/feature.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature.service.d.ts","sourceRoot":"","sources":["../../src/services/feature.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,UAAU,CAAC;AAE9C,qBACa,cAAc;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAgB;gBAE7B,QAAQ,GAAE,aAAkB;IAIxC;;OAEG;IACH,sBAAsB,IAAI,OAAO;IAIjC;;OAEG;IACH,gBAAgB,IAAI,OAAO;IAI3B;;OAEG;IACH,eAAe,IAAI,WAAW,EAAE;IAIhC;;OAEG;IACH,WAAW,IAAI,aAAa;CAG/B"}

package/dist/services/feature.service.js

@@ -0,0 +1,49 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FeatureService = void 0;
+const common_1 = require("@nestjs/common");
+let FeatureService = class FeatureService {
+    features;
+    constructor(features = {}) {
+        this.features = features;
+    }
+    /**
+     * Check if the organizations feature is enabled
+     */
+    isOrganizationsEnabled() {
+        return this.features.enableOrganizations === true;
+    }
+    /**
+     * Check if the API keys feature is enabled
+     */
+    isApiKeysEnabled() {
+        return this.features.apiKeys?.enabled === true;
+    }
+    /**
+     * Get the allowed API key scopes
+     */
+    getApiKeyScopes() {
+        return this.features.apiKeys?.scopes ?? [];
+    }
+    /**
+     * Get all feature configurations
+     */
+    getFeatures() {
+        return { ...this.features };
+    }
+};
+exports.FeatureService = FeatureService;
+exports.FeatureService = FeatureService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [Object])
+], FeatureService);
+//# sourceMappingURL=feature.service.js.map

package/dist/services/feature.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feature.service.js","sourceRoot":"","sources":["../../src/services/feature.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA4C;AAKrC,IAAM,cAAc,GAApB,MAAM,cAAc;IACN,QAAQ,CAAgB;IAEzC,YAAY,WAA0B,EAAE;QACpC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,sBAAsB;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,mBAAmB,KAAK,IAAI,CAAC;IACtD,CAAC;IAED;;OAEG;IACH,gBAAgB;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,eAAe;QACX,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,WAAW;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;IAChC,CAAC;CACJ,CAAA;AAlCY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;;GACA,cAAc,CAkC1B"}

package/dist/services/global-role.service.d.ts

@@ -0,0 +1,17 @@
+import { ObjectId, Filter } from 'mongodb';
+import * as models from '@trailmix-cms/models';
+import { RoleCollection } from '../collections/role.collection';
+import { Utils } from '@trailmix-cms/db';
+type GlobalRoleModel = models.GlobalRole.Model;
+export declare class GlobalRoleService {
+    private readonly roleCollection;
+    private readonly logger;
+    constructor(roleCollection: RoleCollection);
+    insertOne(params: Utils.Creatable<GlobalRoleModel>, auditContext: models.AuditContext.Model): Promise<GlobalRoleModel>;
+    find(filter?: Filter<GlobalRoleModel>): Promise<GlobalRoleModel[]>;
+    findOne(params: Filter<GlobalRoleModel>): Promise<GlobalRoleModel | null>;
+    deleteOne(id: ObjectId, auditContext: models.AuditContext.Model): Promise<void>;
+    private mapToModel;
+}
+export {};
+//# sourceMappingURL=global-role.service.d.ts.map

package/dist/services/global-role.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-role.service.d.ts","sourceRoot":"","sources":["../../src/services/global-role.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEzC,KAAK,eAAe,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;AAG/C,qBACa,iBAAiB;IAItB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAHnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsC;gBAGxC,cAAc,EAAE,cAAc;IAG7C,SAAS,CACX,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,eAAe,CAAC,EACxC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,GACxC,OAAO,CAAC,eAAe,CAAC;IAUrB,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IASlE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAazE,SAAS,CACX,EAAE,EAAE,QAAQ,EACZ,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,GACxC,OAAO,CAAC,IAAI,CAAC;IAIhB,OAAO,CAAC,UAAU;CAQrB"}

package/dist/services/global-role.service.js

@@ -0,0 +1,99 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var GlobalRoleService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GlobalRoleService = void 0;
+const common_1 = require("@nestjs/common");
+const models = __importStar(require("@trailmix-cms/models"));
+const role_collection_1 = require("../collections/role.collection");
+let GlobalRoleService = GlobalRoleService_1 = class GlobalRoleService {
+    roleCollection;
+    logger = new common_1.Logger(GlobalRoleService_1.name);
+    constructor(roleCollection) {
+        this.roleCollection = roleCollection;
+    }
+    async insertOne(params, auditContext) {
+        const insertParams = {
+            ...params,
+            type: models.RoleType.Global,
+        };
+        const entity = await this.roleCollection.insertOne(insertParams, auditContext);
+        return this.mapToModel(entity);
+    }
+    async find(filter) {
+        const query = {
+            ...filter,
+            type: models.RoleType.Global,
+        };
+        const entities = await this.roleCollection.find(query);
+        return entities.map(entity => this.mapToModel(entity));
+    }
+    async findOne(params) {
+        const query = {
+            ...params,
+            type: models.RoleType.Global,
+        };
+        const entity = await this.roleCollection.findOne(query);
+        if (!entity) {
+            return null;
+        }
+        return this.mapToModel(entity);
+    }
+    async deleteOne(id, auditContext) {
+        await this.roleCollection.deleteOne(id, auditContext);
+    }
+    mapToModel(entity) {
+        if (entity.type !== models.RoleType.Global) {
+            throw new Error('Entity is not a global role');
+        }
+        // TODO: Add mapping logic here
+        return entity;
+    }
+};
+exports.GlobalRoleService = GlobalRoleService;
+exports.GlobalRoleService = GlobalRoleService = GlobalRoleService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [role_collection_1.RoleCollection])
+], GlobalRoleService);
+//# sourceMappingURL=global-role.service.js.map

package/dist/services/global-role.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-role.service.js","sourceRoot":"","sources":["../../src/services/global-role.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAuE;AAEvE,6DAA+C;AAC/C,oEAAgE;AAOzD,IAAM,iBAAiB,yBAAvB,MAAM,iBAAiB;IAIL;IAHJ,MAAM,GAAG,IAAI,eAAM,CAAC,mBAAiB,CAAC,IAAI,CAAC,CAAC;IAE7D,YACqB,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAC/C,CAAC;IAEL,KAAK,CAAC,SAAS,CACX,MAAwC,EACxC,YAAuC;QAEvC,MAAM,YAAY,GAAgC;YAC9C,GAAG,MAAM;YACT,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;SAC/B,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAgC;QACvC,MAAM,KAAK,GAAuB;YAC9B,GAAG,MAAM;YACT,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;SAC/B,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAA+B;QACzC,MAAM,KAAK,GAAuB;YAC9B,GAAG,MAAM;YACT,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;SAC/B,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAGD,KAAK,CAAC,SAAS,CACX,EAAY,EACZ,YAAuC;QAEvC,MAAM,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC1D,CAAC;IAEO,UAAU,CAAC,MAAkB;QACjC,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACnD,CAAC;QAED,+BAA+B;QAC/B,OAAO,MAAyB,CAAC;IACrC,CAAC;CACJ,CAAA;AAzDY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAK4B,gCAAc;GAJ1C,iBAAiB,CAyD7B"}

package/dist/services/index.d.ts

@@ -0,0 +1,9 @@
+export * from './account.service';
+export * from './api-key.service';
+export * from './auth.service';
+export * from './authorization.service';
+export * from './feature.service';
+export * from './global-role.service';
+export * from './organization.service';
+export * from './organization-role.service';
+//# sourceMappingURL=index.d.ts.map

package/dist/services/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,uBAAuB,CAAC;AACtC,cAAc,wBAAwB,CAAC;AACvC,cAAc,6BAA6B,CAAC"}

package/dist/services/index.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./account.service"), exports);
+__exportStar(require("./api-key.service"), exports);
+__exportStar(require("./auth.service"), exports);
+__exportStar(require("./authorization.service"), exports);
+__exportStar(require("./feature.service"), exports);
+__exportStar(require("./global-role.service"), exports);
+__exportStar(require("./organization.service"), exports);
+__exportStar(require("./organization-role.service"), exports);
+//# sourceMappingURL=index.js.map

package/dist/services/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,oDAAkC;AAClC,iDAA+B;AAC/B,0DAAwC;AACxC,oDAAkC;AAClC,wDAAsC;AACtC,yDAAuC;AACvC,8DAA4C"}

package/dist/services/organization-role.service.d.ts

@@ -0,0 +1,33 @@
+import { Filter, ObjectId } from 'mongodb';
+import * as models from '@trailmix-cms/models';
+import { RoleCollection } from '../collections/role.collection';
+import { Utils } from '@trailmix-cms/db';
+type OrganizationRoleModel = models.OrganizationRole.Model;
+export declare class OrganizationRoleService {
+    private readonly roleCollection;
+    private readonly logger;
+    constructor(roleCollection: RoleCollection);
+    insertOne(params: Utils.Creatable<OrganizationRoleModel>, auditContext: models.AuditContext.Model): Promise<OrganizationRoleModel>;
+    find(filter: Filter<OrganizationRoleModel>): Promise<{
+        _id: ObjectId;
+        created_at: Date;
+        principal_id: ObjectId;
+        principal_type: "account" | "api_key";
+        role: string;
+        organization_id: ObjectId;
+        updated_at?: Date | undefined;
+    }[]>;
+    findOne(params: Filter<OrganizationRoleModel>): Promise<{
+        _id: ObjectId;
+        created_at: Date;
+        principal_id: ObjectId;
+        principal_type: "account" | "api_key";
+        role: string;
+        organization_id: ObjectId;
+        updated_at?: Date | undefined;
+    } | null>;
+    deleteOne(id: ObjectId, auditContext: models.AuditContext.Model): Promise<void>;
+    private mapToModel;
+}
+export {};
+//# sourceMappingURL=organization-role.service.d.ts.map

package/dist/services/organization-role.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-role.service.d.ts","sourceRoot":"","sources":["../../src/services/organization-role.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEzC,KAAK,qBAAqB,GAAG,MAAM,CAAC,gBAAgB,CAAC,KAAK,CAAC;AAG3D,qBACa,uBAAuB;IAI5B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAHnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4C;gBAG9C,cAAc,EAAE,cAAc;IAG7C,SAAS,CACX,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,qBAAqB,CAAC,EAC9C,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,GACxC,OAAO,CAAC,qBAAqB,CAAC;IAU3B,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,qBAAqB,CAAC;;;;;;;;;IAS1C,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,qBAAqB,CAAC;;;;;;;;;IAY7C,SAAS,CACX,EAAE,EAAE,QAAQ,EACZ,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,GACxC,OAAO,CAAC,IAAI,CAAC;IAIhB,OAAO,CAAC,UAAU;CAYrB"}