@tstdl/base 0.93.35 → 0.93.36

package/tstdl-features.xml

@@ -0,0 +1,1239 @@
+This file is a merged representation of the entire codebase, combined into a single document by Repomix.
+
+<file_summary>
+This section contains a summary of this file.
+
+<purpose>
+This file contains a packed representation of the entire repository's contents.
+It is designed to be easily consumable by AI systems for analysis, code review,
+or other automated processes.
+</purpose>
+
+<file_format>
+The content is organized as follows:
+1. This summary section
+2. Repository information
+3. Directory structure
+4. Repository files (if enabled)
+5. Multiple file entries, each consisting of:
+  - File path as an attribute
+  - Full contents of the file
+</file_format>
+
+<usage_guidelines>
+- This file should be treated as read-only. Any changes should be made to the
+  original repository files, not this packed version.
+- When processing this file, use the file path to distinguish
+  between different files in the repository.
+- Be aware that this file may contain sensitive information. Handle it with
+  the same level of security as you would the original repository.
+</usage_guidelines>
+
+<notes>
+- Some files may have been excluded based on .gitignore rules and Repomix's configuration
+- Binary files are not included in this packed representation. Please refer to the Repository Structure section for a complete list of file paths, including binary files
+- Files matching patterns in .gitignore are excluded
+- Files matching default ignore patterns are excluded
+- Files are sorted by Git change count (files with more changes are at the bottom)
+</notes>
+
+</file_summary>
+
+<directory_structure>
+api/
+  core/
+    document-management.api.ts
+    index.ts
+    person.api.ts
+    tenant.api.ts
+    user.api.ts
+mails/
+  index.ts
+  mail-template.tsx
+  reset-password.tsx
+services/
+  core/
+    document-management.service.ts
+    index.ts
+    tenant.service.ts
+    user.service.ts
+  tstdl/
+    authentication-ancillary.service.ts
+    document-management-ancillary.service.ts
+    index.ts
+    vitrass-document-management-authorization.service.ts
+tools/
+  create-tenant-admin.ts
+  create-tenant.ts
+  reset-password.ts
+  set-super-user.ts
+app.ts
+bootstrap-data.ts
+bootstrap.ts
+config.ts
+drizzle.config.ts
+keys.ts
+schemas.ts
+tokens.ts
+types.ts
+</directory_structure>
+
+<files>
+This section contains the contents of the repository's files.
+
+<file path="api/core/document-management.api.ts">
+import type { ApiController, ApiRequestContext, ApiServerResult } from '@tstdl/base/api';
+import { apiController } from '@tstdl/base/api/server';
+import { ForbiddenError } from '@tstdl/base/errors';
+import { inject } from '@tstdl/base/injector';
+import { isUndefined } from '@tstdl/base/utils';
+
+import { VitrassDocumentManagementService } from '#/services/core/document-management.service.js';
+import { vitrassDocumentManagementApiDefinition, type VitrassDocumentManagementApiDefinition } from '#/shared/api/core/index.js';
+import type { VitrassToken } from '#/shared/token.js';
+
+@apiController(vitrassDocumentManagementApiDefinition)
+export class VitrassDocumentManagementApi implements ApiController<VitrassDocumentManagementApiDefinition> {
+  readonly #documentManagementService = inject(VitrassDocumentManagementService);
+
+  async loadTenantDocumentCollection({ getToken }: ApiRequestContext<VitrassDocumentManagementApiDefinition, 'loadTenantDocumentCollection'>): Promise<ApiServerResult<VitrassDocumentManagementApiDefinition, 'loadTenantDocumentCollection'>> {
+    const token = await getToken<VitrassToken>();
+
+    if (isUndefined(token.payload.tenantId)) {
+      throw new ForbiddenError('Tenant required.');
+    }
+
+    return await this.#documentManagementService.loadRealEstateCollection(token.payload.tenantId);
+  }
+}
+</file>
+
+<file path="api/core/index.ts">
+export * from './document-management.api.js';
+export * from './person.api.js';
+export * from './tenant.api.js';
+export * from './user.api.js';
+</file>
+
+<file path="api/core/person.api.ts">
+import type { ApiController, ApiRequestContext, ApiServerResult } from '@tstdl/base/api';
+import { apiController } from '@tstdl/base/api/server';
+import { ForbiddenError } from '@tstdl/base/errors';
+import { injectRepository } from '@tstdl/base/orm/server';
+import { isUndefined } from '@tstdl/base/utils';
+
+import { type PersonApiDefinition, personApiDefinition } from '#/shared/api/core/index.js';
+import { Person } from '#/shared/models/core/index.js';
+import type { VitrassToken } from '#/shared/token.js';
+
+@apiController(personApiDefinition)
+export class PersonApi implements ApiController<PersonApiDefinition> {
+  readonly #personService = injectRepository(Person);
+
+  async create({ parameters, getToken }: ApiRequestContext<PersonApiDefinition, 'create'>): Promise<ApiServerResult<PersonApiDefinition, 'create'>> {
+    const token = await getToken<VitrassToken>();
+
+    if (isUndefined(token.payload.tenantId)) {
+      throw new ForbiddenError();
+    }
+
+    return this.#personService.insert({
+      tenantId: token.payload.tenantId,
+      firstName: parameters.firstName ?? null,
+      lastName: parameters.lastName,
+      gender: parameters.gender ?? null,
+      mail: parameters.mail ?? null,
+      phone: parameters.phone ?? null
+    });
+  }
+
+  async update({ parameters, getToken }: ApiRequestContext<PersonApiDefinition, 'update'>): Promise<ApiServerResult<PersonApiDefinition, 'update'>> {
+    const token = await getToken<VitrassToken>();
+
+    if (isUndefined(token.payload.tenantId)) {
+      throw new ForbiddenError();
+    }
+
+    return this.#personService.updateByQuery({ tenantId: token.payload.tenantId, id: parameters.id }, {
+      firstName: parameters.firstName,
+      lastName: parameters.lastName,
+      gender: parameters.gender,
+      mail: parameters.mail,
+      phone: parameters.phone
+    });
+  }
+}
+</file>
+
+<file path="api/core/tenant.api.ts">
+import type { ApiController, ApiRequestContext, ApiServerResult } from '@tstdl/base/api';
+import { apiController } from '@tstdl/base/api/server';
+import { inject } from '@tstdl/base/injector';
+import { isDefined } from '@tstdl/base/utils';
+import { toArray } from '@tstdl/base/utils/array';
+
+import { TenantService } from '#/services/core/tenant.service.js';
+import { tenantApiDefinition, type TenantApiDefinition } from '#/shared/api/core/tenant.api.js';
+import type { VitrassToken } from '#/shared/token.js';
+
+@apiController(tenantApiDefinition)
+export class TenantApi implements ApiController<TenantApiDefinition> {
+  readonly tenantService = inject(TenantService);
+
+  async get({ parameters, getToken }: ApiRequestContext<TenantApiDefinition, 'get'>): Promise<ApiServerResult<TenantApiDefinition, 'get'>> {
+    await getToken<VitrassToken>();
+    return this.tenantService.load(parameters.id);
+  }
+
+  async getMany({ parameters: { ids }, getToken }: ApiRequestContext<TenantApiDefinition, 'getMany'>): Promise<ApiServerResult<TenantApiDefinition, 'getMany'>> {
+    await getToken<VitrassToken>();
+    return this.tenantService.getMany({ ids: isDefined(ids) ? toArray(ids) : undefined });
+  }
+}
+</file>
+
+<file path="api/core/user.api.ts">
+import type { ApiController, ApiRequestContext, ApiServerResult } from '@tstdl/base/api';
+import { apiController } from '@tstdl/base/api/server';
+import { inject } from '@tstdl/base/injector';
+
+import { UserService } from '#/services/core/index.js';
+import { type UserApiDefinition, userApiDefinition } from '#/shared/api/core/user.api.js';
+import type { VitrassToken } from '#/shared/token.js';
+
+@apiController(userApiDefinition)
+export class UserApi implements ApiController<UserApiDefinition> {
+  readonly userService = inject(UserService);
+
+  async get({ parameters, getToken }: ApiRequestContext<UserApiDefinition, 'get'>): Promise<ApiServerResult<UserApiDefinition, 'get'>> {
+    await getToken<VitrassToken>();
+    return this.userService.load(parameters.id);
+  }
+
+  async getMany({ getToken }: ApiRequestContext<UserApiDefinition, 'getMany'>): Promise<ApiServerResult<UserApiDefinition, 'getMany'>> {
+    await getToken<VitrassToken>();
+    return this.userService.loadAll();
+  }
+
+  async update({ parameters, getToken }: ApiRequestContext<UserApiDefinition, 'update'>): Promise<ApiServerResult<UserApiDefinition, 'update'>> {
+    await getToken<VitrassToken>();
+    return this.userService.update(parameters.id, parameters);
+  }
+}
+</file>
+
+<file path="mails/index.ts">
+export * from './mail-template.js';
+export * from './reset-password.js';
+</file>
+
+<file path="mails/mail-template.tsx">
+import type { RenderableProps } from 'preact';
+
+type MailTemplateProperties = {
+  subject: string,
+};
+
+export function MailTemplate({ children, subject }: RenderableProps<MailTemplateProperties>) {
+  return (
+    <mjml>
+      <mj-head>
+        <mj-title>Vitrass - {subject}</mj-title>
+      </mj-head>
+      <mj-body>
+        <mj-section background-color="#002145" padding-top="50px" padding-bottom="30px">
+          <mj-column>
+            <mj-text color="#ffffff" font-size="35px" font-weight="bold">Vitrass</mj-text>
+            <mj-text color="#ffffff" font-size="25px">{subject}</mj-text>
+          </mj-column>
+        </mj-section>
+        <mj-section background-color="#f3f3f3">
+          {children}
+        </mj-section>
+      </mj-body>
+    </mjml>
+  );
+}
+</file>
+
+<file path="mails/reset-password.tsx">
+import { mailTemplate } from '@tstdl/base/mail';
+import type { MjmlTemplateRenderer, StringTemplateRenderer } from '@tstdl/base/templates/renderers';
+import { jsxTemplateField, stringTemplateField } from '@tstdl/base/templates/resolvers';
+
+import { MailTemplate } from './mail-template.js';
+
+export type ResetPasswordMailData = { firstName: string | null, resetPasswordUrl: string };
+
+export const resetPasswordMailTemplate = mailTemplate<ResetPasswordMailData>('reset-password', {
+  subject: stringTemplateField<StringTemplateRenderer>({ renderer: 'string', template: 'Passwort zurücksetzen' }),
+  html: jsxTemplateField<MjmlTemplateRenderer>({
+    renderer: 'mjml-jsx',
+    template: ({ firstName, resetPasswordUrl }: ResetPasswordMailData) => (
+      <MailTemplate subject="Passwort zurücksetzen">
+        <mj-column>
+          <mj-text>
+            <p>Hallo {firstName ?? ''},</p>
+            <p>für dein Konto bei Vitrass wurde das zurücksetzen des Passworts angefordert. Um dein Passwort zurückzusetzen, klicke bitte auf folgenden Button.</p>
+          </mj-text>
+
+          <mj-button href={resetPasswordUrl}>Passwort zurücksetzen</mj-button>
+
+          <mj-text>
+            <p>Wenn Du diese E-Mail nicht angefordert hast, kannst du sie gefahrlos ignorieren.</p>
+          </mj-text>
+        </mj-column>
+      </MailTemplate>
+    ),
+  }),
+});
+</file>
+
+<file path="services/core/document-management.service.ts">
+import { DocumentCategory, DocumentType, type DocumentCollection, type DocumentProperty } from '@tstdl/base/document-management';
+import { DocumentCollectionService, DocumentManagementService } from '@tstdl/base/document-management/server';
+import { inject, registerAfterResolve, Singleton } from '@tstdl/base/injector';
+import { injectRepository } from '@tstdl/base/orm/server';
+import type { Writable } from '@tstdl/base/types';
+import { isDefined } from '@tstdl/base/utils';
+import { objectKeys } from '@tstdl/base/utils/object';
+
+import { DocumentCollectionMapping } from '#/shared/models/core/document-collection-mapping.js';
+import { VitrassCategoryParents, VitrassDocumentCategoryLabels, VitrassDocumentPropertyConfiguration, VitrassDocumentTypeCategories, VitrassDocumentTypeLabels, VitrassDocumentTypeProperties, type VitrassDocumentCategory, type VitrassDocumentProperty, type VitrassDocumentType } from '#/shared/models/core/index.js';
+
+@Singleton()
+export class VitrassDocumentManagementService extends DocumentManagementService {
+  readonly #documentCollectionService = inject(DocumentCollectionService);
+  readonly #documentCollectionMappingService = injectRepository(DocumentCollectionMapping);
+
+  readonly categories: Record<VitrassDocumentCategory, DocumentCategory>;
+  readonly types: Record<VitrassDocumentType, DocumentType>;
+  readonly properties: Record<VitrassDocumentProperty, DocumentProperty>;
+
+  constructor() {
+    super();
+
+    registerAfterResolve(async () => {
+      const x = await this.initializeCategoriesAndTypes(null, {
+        categoryLabels: VitrassDocumentCategoryLabels,
+        categoryParents: VitrassCategoryParents,
+        typeLabels: VitrassDocumentTypeLabels,
+        typeCategories: VitrassDocumentTypeCategories,
+        propertyConfigurations: VitrassDocumentPropertyConfiguration,
+        typeProperties: VitrassDocumentTypeProperties,
+      });
+
+      (this as Writable<this>).categories = x.categories;
+      (this as Writable<this>).types = x.types;
+      (this as Writable<this>).properties = x.properties;
+    });
+  }
+
+  async loadRealEstateCollection(tenantId: string): Promise<DocumentCollection> {
+    return await this.loadCollection(tenantId, { tenantId });
+  }
+
+  private async loadCollection(tenantId: string, filter: Partial<Pick<DocumentCollectionMapping, 'tenantId' | 'personId'>>): Promise<DocumentCollection> {
+    if (objectKeys(filter).length != 1) {
+      throw new Error('Exactly one of tenantId or personId must be specified in the filter');
+    }
+
+    return await this.#documentCollectionMappingService.transaction(async (transaction) => {
+      const mapping = await this.#documentCollectionMappingService.withTransaction(transaction).tryLoadByQuery(filter);
+
+      if (isDefined(mapping)) {
+        return await this.#documentCollectionService.withTransaction(transaction).repository.loadByQuery({ tenantId, id: mapping.collectionId });
+      }
+
+      const collection = await this.#documentCollectionService.withTransaction(transaction).createCollection(tenantId, null);
+      await this.#documentCollectionMappingService.withTransaction(transaction).insert({ collectionId: collection.id, tenantId: null, personId: null, ...filter });
+
+      return collection;
+    });
+  }
+}
+</file>
+
+<file path="services/core/index.ts">
+export * from './document-management.service.js';
+export * from './tenant.service.js';
+export * from './user.service.js';
+</file>
+
+<file path="services/core/tenant.service.ts">
+import { Singleton, inject } from '@tstdl/base/injector';
+import { getRepository, injectRepository } from '@tstdl/base/orm/server';
+import { isDefined } from '@tstdl/base/utils';
+
+import { Role, StaffMemberSettings, Tenant } from '#/shared/models/core/index.js';
+import { GetManyTenantsFilter } from '#/shared/service-models/index.js';
+import { UserService } from './user.service.js';
+
+export type StaffMemberUpdate = {
+  roles: Role[]
+};
+
+@Singleton()
+export class TenantService extends getRepository(Tenant) {
+  readonly staffMemberSettingsService = injectRepository(StaffMemberSettings);
+  readonly userService = inject(UserService);
+
+  async getMany(filter: GetManyTenantsFilter): Promise<Tenant[]> {
+    const userStaffMembers = isDefined(filter.staffMemberUserId)
+      ? await this.staffMemberSettingsService.loadManyByQuery({ userId: filter.staffMemberUserId })
+      : undefined;
+
+    const staffMemberTenantIds = userStaffMembers?.map((staffMember) => staffMember.tenantId);
+
+    return await this.loadManyByQuery({
+      $and: [
+        isDefined(staffMemberTenantIds) ? { id: { $in: staffMemberTenantIds } } : undefined,
+        isDefined(filter.ids) ? { id: { $in: filter.ids } } : undefined,
+      ].filter(isDefined),
+    });
+  }
+}
+</file>
+
+<file path="services/core/user.service.ts">
+import { Singleton } from '@tstdl/base/injector';
+import type { LoadManyOptions, Query } from '@tstdl/base/orm';
+import { getRepository } from '@tstdl/base/orm/server';
+
+import { User } from '#/shared/models/core/index.js';
+import { LightPersonView, toLightPersonView } from '#/shared/service-models/index.js';
+
+@Singleton()
+export class UserService extends getRepository(User) {
+  async loadManyLightViewsByQuery(filter: Query<User>, options?: LoadManyOptions<User>): Promise<LightPersonView[]> {
+    const users = await this.loadManyByQuery(filter, options);
+    return users.map(toLightPersonView);
+  }
+}
+</file>
+
+<file path="services/tstdl/authentication-ancillary.service.ts">
+import { InitSecretResetData, type TokenPayload } from '@tstdl/base/authentication';
+import { AuthenticationAncillaryService, type GetTokenPayloadContext, type ResolveSubjectResult } from '@tstdl/base/authentication/server';
+import { BadRequestError, NotFoundError, UnauthorizedError } from '@tstdl/base/errors';
+import { Singleton, inject, provide } from '@tstdl/base/injector';
+import { MailService } from '@tstdl/base/mail';
+import { EntityRepositoryConfig, injectRepository } from '@tstdl/base/orm/server';
+import type { Record } from '@tstdl/base/types';
+import { isDefined, isNull } from '@tstdl/base/utils';
+import { distinct } from '@tstdl/base/utils/array';
+
+import { config } from '#/config.js';
+import { type ResetPasswordMailData, resetPasswordMailTemplate } from '#/mails/index.js';
+import { StaffMemberSettings, SuperUser, rolePermissions } from '#/shared/models/core/index.js';
+import { AdditionalVitrassTokenPayload, VitrassAuthenticationData } from '#/shared/token.js';
+import { UserService } from '../core/index.js';
+
+@Singleton({
+  providers: [provide(EntityRepositoryConfig, { useValue: { schema: 'vitrass' } })],
+})
+export class VitrassAuthenticationAncillaryService extends AuthenticationAncillaryService<AdditionalVitrassTokenPayload, VitrassAuthenticationData> {
+  readonly #userService = inject(UserService);
+  readonly #mailService = inject(MailService);
+  readonly #staffMemberSettingsService = injectRepository(StaffMemberSettings);
+  readonly #superUserService = injectRepository(SuperUser);
+
+  async resolveSubject(providedSubject: string): Promise<ResolveSubjectResult> {
+    if (providedSubject.includes('@')) {
+      const users = await this.#userService.loadManyByQuery({ mail: providedSubject.toLowerCase() });
+
+      if (users.length == 1) {
+        return { success: true, subject: users[0]!.id };
+      }
+
+      if (users.length > 1) {
+        throw new UnauthorizedError('User mail is not unique.');
+      }
+
+      throw new NotFoundError('User not found.');
+    }
+
+    return { success: true, subject: providedSubject };
+  }
+
+  override async getTokenPayload(subject: string, _authenticationData: VitrassAuthenticationData, _context: GetTokenPayloadContext): Promise<AdditionalVitrassTokenPayload> {
+    const [staffMemberSettings, superUser] = await Promise.all([
+      this.#staffMemberSettingsService.tryLoadByQuery({ userId: subject }),
+      this.#superUserService.tryLoadByQuery({ userId: subject }),
+    ]);
+
+    const rolesPermissions = staffMemberSettings?.roles.flatMap((role) => rolePermissions[role]);
+
+    const permissions = distinct([
+      ...(staffMemberSettings?.permissions ?? []),
+      ...(rolesPermissions ?? []),
+    ]);
+
+    return {
+      tenantId: staffMemberSettings?.tenantId,
+      staffMemberId: staffMemberSettings?.id,
+      permissions,
+      isSuperUser: isDefined(superUser),
+    };
+  }
+
+  override async handleInitSecretReset(data: InitSecretResetData & Record<never>): Promise<void> {
+    const user = await this.#userService.load(data.subject);
+
+    const mailData: ResetPasswordMailData = {
+      firstName: user.firstName,
+      resetPasswordUrl: `${config.appUrl}/reset-password/${data.token}`,
+    };
+
+    if (isNull(user.mail)) {
+      throw new BadRequestError('User has no mail address.');
+    }
+
+    await this.#mailService.sendTemplate(resetPasswordMailTemplate, { to: user.mail }, mailData);
+  }
+
+  override canImpersonate(token: TokenPayload<AdditionalVitrassTokenPayload>, _subject: string, _authenticationData: VitrassAuthenticationData): boolean {
+    return (token.isSuperUser == true);
+  }
+}
+</file>
+
+<file path="services/tstdl/document-management-ancillary.service.ts">
+import type { DocumentCollection, DocumentCollectionMetadata } from '@tstdl/base/document-management';
+import { DocumentManagementAncillaryService } from '@tstdl/base/document-management/server';
+import { formatPersonName } from '@tstdl/base/formats';
+import { inject, Singleton } from '@tstdl/base/injector';
+import { injectRepository } from '@tstdl/base/orm/server';
+import { assertDefinedPass, isNotNull } from '@tstdl/base/utils';
+
+import { DocumentCollectionMapping } from '#/shared/models/core/document-collection-mapping.js';
+import { Person } from '#/shared/models/core/person.model.js';
+import { TenantService } from '../core/tenant.service.js';
+
+@Singleton()
+export class VitrassDocumentManagementAncillaryService extends DocumentManagementAncillaryService {
+  readonly #tenantService = inject(TenantService);
+  readonly #personService = injectRepository(Person);
+  readonly #documentCollectionMappingService = injectRepository(DocumentCollectionMapping);
+
+  override async resolveMetadata(collections: DocumentCollection[]): Promise<DocumentCollectionMetadata[]> {
+    const collectionIds = collections.map((collection) => collection.id);
+
+    const mappings = await this.#documentCollectionMappingService.loadManyByQuery({ id: { $in: collectionIds } });
+
+    const tenantIds = mappings.filter((mapping) => isNotNull(mapping.tenantId)).map((mapping) => mapping.tenantId!);
+    const personIds = mappings.filter((mapping) => isNotNull(mapping.personId)).map((mapping) => mapping.personId!);
+
+    const [tenants, persons] = await Promise.all([
+      this.#tenantService.loadManyByQuery({ id: { $in: tenantIds } }),
+      this.#personService.loadManyByQuery({ id: { $in: personIds } }),
+    ]);
+
+    return collections.map((collection) => {
+      const mapping = assertDefinedPass(mappings.find((mapping) => mapping.id == collection.id), `Mapping for collection "${collection.id}" not found.`);
+
+      if (isNotNull(mapping.personId)) {
+        const person = assertDefinedPass(persons.find((person) => person.id == mapping.personId), `Person "${mapping.personId}" not found.`);
+        return { name: formatPersonName(person), group: null };
+      }
+
+      if (isNotNull(mapping.tenantId)) {
+        const tenant = assertDefinedPass(tenants.find((tenant) => tenant.id == mapping.tenantId), `Tenant "${mapping.tenantId}" not found.`);
+        return { name: `${tenant.name} ${tenant.nameAddition ?? ''}`.trim(), group: null };
+      }
+
+      throw new Error('Collection mapping type not supported.');
+    });
+  }
+}
+</file>
+
+<file path="services/tstdl/index.ts">
+export * from './authentication-ancillary.service.js';
+export * from './document-management-ancillary.service.js';
+export * from './vitrass-document-management-authorization.service.js';
+</file>
+
+<file path="services/tstdl/vitrass-document-management-authorization.service.ts">
+import { DocumentManagementAuthorizationService } from '@tstdl/base/document-management';
+import { DocumentCollectionService, DocumentService } from '@tstdl/base/document-management/server';
+import { ForbiddenError } from '@tstdl/base/errors';
+import { inject, Singleton } from '@tstdl/base/injector';
+import { isUndefined } from '@tstdl/base/utils';
+
+import type { VitrassToken } from '#/shared/token.js';
+
+@Singleton()
+export class VitrassDocumentManagementAuthorizationService extends DocumentManagementAuthorizationService {
+  readonly #collectionService = inject(DocumentCollectionService);
+  readonly #documentService = inject(DocumentService);
+
+  override getTenantId(token?: VitrassToken): string | Promise<string> {
+    const tenantId = token?.payload.tenantId;
+
+    if (isUndefined(tenantId)) {
+      throw new ForbiddenError('No tenantId provided.');
+    }
+
+    return tenantId;
+  }
+
+  override getSubject(token?: VitrassToken): string | Promise<string> {
+    const subject = token?.payload.subject;
+
+    if (isUndefined(subject)) {
+      throw new ForbiddenError('No subject provided.');
+    }
+
+    return subject;
+  }
+
+  override async canReadCollection(collectionId: string, token?: VitrassToken): Promise<boolean> {
+    const collection = await this.#collectionService.repository.load(collectionId);
+    return collection.tenantId == token?.payload.tenantId;
+  }
+
+  override async canCreateDocuments(collectionId: string, token?: VitrassToken): Promise<boolean> {
+    return await this.canReadCollection(collectionId, token);
+  }
+
+  override async canDeleteDocuments(collectionId: string, token?: VitrassToken): Promise<boolean> {
+    return await this.canReadCollection(collectionId, token);
+  }
+
+  override async canAssignDocuments(collectionId: string, token?: VitrassToken): Promise<boolean> {
+    return await this.canReadCollection(collectionId, token);
+  }
+
+  override async canUpdateDocument(collectionId: string, token?: VitrassToken): Promise<boolean> {
+    return await this.canReadCollection(collectionId, token);
+  }
+
+  override async canApproveDocument(documentId: string, token?: VitrassToken): Promise<boolean> {
+    const document = await this.#documentService.repository.load(documentId);
+    return document.tenantId == token?.payload.tenantId;
+  }
+
+  override async canRejectDocument(documentId: string, token?: VitrassToken): Promise<boolean> {
+    return await this.canApproveDocument(documentId, token);
+  }
+
+  override async canManageRequests(collectionId: string, token?: VitrassToken): Promise<boolean> {
+    return await this.canReadCollection(collectionId, token);
+  }
+
+  override async canManageCategoriesAndTypes(_token?: VitrassToken): Promise<boolean> {
+    return false;
+  }
+
+  override async canReadDocumentRequestsTemplates(_token?: VitrassToken): Promise<boolean> {
+    return false;
+  }
+
+  override async canManageDocumentRequestsTemplates(_token?: VitrassToken): Promise<boolean> {
+    return false;
+  }
+
+  override async canManageValidationDefinitions(_token?: VitrassToken): Promise<boolean> {
+    return false;
+  }
+
+  override async canProgressDocumentWorkflow(documentId: string, token?: VitrassToken): Promise<boolean> {
+    return await this.canApproveDocument(documentId, token);
+  }
+}
+</file>
+
+<file path="tools/create-tenant-admin.ts">
+import '@tstdl/base/polyfills';
+
+import { createInterface } from 'node:readline/promises';
+
+import { Application, provideInitializer, provideModules } from '@tstdl/base/application';
+import { AuthenticationService } from '@tstdl/base/authentication/server';
+import { formatPersonName } from '@tstdl/base/formats';
+import { injectManyAsync } from '@tstdl/base/injector';
+import { injectRepository } from '@tstdl/base/orm/server';
+import { isDefined, timeout } from '@tstdl/base/utils';
+
+import { TenantService } from '#/services/core/index.js';
+import type { Gender } from '#/shared/models/core/gender.model.js';
+import { StaffMemberSettings } from '#/shared/models/core/index.js';
+import { bootstrap } from '../bootstrap.js';
+import { UserService } from '../services/core/user.service.js';
+import { Role } from '../shared/models/core/role-and-permission.model.js';
+import { UserRole } from '../shared/models/core/user.model.js';
+
+async function main(): Promise<void> {
+  const staffMemberSettingsService = injectRepository(StaffMemberSettings);
+  const [tenantService, userService, authenticationService] = await injectManyAsync(TenantService, UserService, AuthenticationService);
+
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+
+  const tenantName = (await rl.question('Tenant name: ')).trim();
+  const tenant = await tenantService.loadByQuery({ name: tenantName });
+
+  const mail = (await rl.question('User mail: ')).trim();
+
+  let user = await userService.tryLoadByQuery({ mail });
+
+  if (isDefined(user)) {
+    console.log(`Using existing user ${formatPersonName(user)}`);
+  }
+  else {
+    const firstName = (await rl.question('First name: ')).trim();
+    const lastName = (await rl.question('Last name: ')).trim();
+    const gender = (await rl.question(`gender (male, female): `)).trim() as Gender;
+    const password = (await rl.question('Password: ')).trim();
+
+    console.log('Creating user in 5 seconds');
+
+    await timeout(5000);
+
+    user = await userService.insert({
+      tenantId: tenant.id,
+      role: UserRole.StaffMember,
+      firstName,
+      lastName,
+      mail,
+      phone: null,
+      gender,
+    });
+
+    await authenticationService.setCredentials(user.id, password, { skipValidation: true });
+
+    console.log(user);
+  }
+
+  console.log('Assiging role in 5 seconds');
+
+  await timeout(5000);
+
+  await staffMemberSettingsService.insert({
+    tenantId: tenant.id,
+    userId: user.id,
+    roles: [Role.TenantAdmin],
+    permissions: [],
+  });
+}
+
+Application.run('CreateTenantAdmin', [
+  provideInitializer(bootstrap),
+  provideModules(main),
+]);
+</file>
+
+<file path="tools/create-tenant.ts">
+import '@tstdl/base/polyfills';
+
+import { createInterface } from 'node:readline/promises';
+
+import { Application, provideInitializer, provideModules } from '@tstdl/base/application';
+import { injectManyAsync } from '@tstdl/base/injector';
+import { enumeration } from '@tstdl/base/schema';
+import { timeout } from '@tstdl/base/utils';
+
+import { TenantService } from '#/services/core/index.js';
+import { Country } from '#/shared/models/core/address.model.js';
+import { bootstrap } from '../bootstrap.js';
+
+async function main(): Promise<void> {
+  const [tenantService] = await injectManyAsync(TenantService);
+
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+
+  console.log('Enter tenant data:');
+  const name = (await rl.question('name: ')).trim();
+  const mail = (await rl.question('mail: ')).trim();
+  const phone = (await rl.question('phone: ')).trim();
+  const street = (await rl.question('street: ')).trim();
+  const houseNumber = (await rl.question('house number: ')).trim();
+  const addition = (await rl.question('addition: ')).trim();
+  const postCode = (await rl.question('post code: ')).trim();
+  const city = (await rl.question('city: ')).trim();
+  const countryCode = (await rl.question('country (de, ch, at): ')).trim();
+
+  const country = enumeration(Country).parse(countryCode.toLowerCase());
+
+  console.log('Creating tenant in 5 seconds');
+
+  await timeout(5000);
+
+  const tenant = await tenantService.insert({
+    name,
+    nameAddition: null,
+    legalName: null,
+    mail,
+    phone: (phone.length == 0) ? null : phone,
+    address: {
+      street,
+      houseNumber,
+      addition,
+      postCode,
+      city,
+      country,
+    },
+  });
+
+  console.log(tenant);
+}
+
+Application.run('CreateTenant', [
+  provideInitializer(bootstrap),
+  provideModules(main),
+]);
+</file>
+
+<file path="tools/reset-password.ts">
+import '@tstdl/base/polyfills';
+
+import { createInterface } from 'node:readline/promises';
+
+import { Application, provideInitializer, provideModules } from '@tstdl/base/application';
+import { AuthenticationService } from '@tstdl/base/authentication/server';
+import { injectManyAsync } from '@tstdl/base/injector';
+
+import { UserService } from '#/services/core/user.service.js';
+import { bootstrap } from '../bootstrap.js';
+
+async function main(): Promise<void> {
+  const [userService, authenticationService] = await injectManyAsync(UserService, AuthenticationService);
+
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+
+  const mail = await rl.question('User mail: ');
+  const password = await rl.question('Password: ');
+  const user = await userService.loadByQuery({ mail });
+
+  await authenticationService.setCredentials(user.id, password);
+}
+
+Application.run('ResetPassword', [
+  provideInitializer(bootstrap),
+  provideModules(main),
+]);
+</file>
+
+<file path="tools/set-super-user.ts">
+import '@tstdl/base/polyfills';
+
+import { createInterface } from 'node:readline/promises';
+
+import { Application, provideInitializer, provideModules } from '@tstdl/base/application';
+import { injectManyAsync } from '@tstdl/base/injector';
+import { EntityRepository } from '@tstdl/base/orm/server';
+import { timeout } from '@tstdl/base/utils';
+
+import { UserService } from '#/services/core/index.js';
+import { SuperUser } from '#/shared/models/core/super-user.model.js';
+import { systemId } from '#/shared/system-id.js';
+import { bootstrap } from '../bootstrap.js';
+
+async function main(): Promise<void> {
+  const [userService, superUserServce] = await injectManyAsync(UserService, [EntityRepository<SuperUser>, SuperUser]);
+
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+
+  const userIdOrMail = await rl.question('User id/mail: ');
+  const user = userIdOrMail.includes('@') ? await userService.loadByQuery({ mail: userIdOrMail }) : await userService.load(userIdOrMail);
+
+  console.log(`Setting super-user for following user in 5 seconds: ${user.firstName} ${user.lastName} (${user.mail}).`);
+
+  await timeout(5000);
+
+  const superUser = await superUserServce.insert({ userId: user.id, metadata: { attributes: { createUserId: systemId } } });
+
+  console.log(superUser);
+}
+
+Application.run('SetSuperUser', [
+  provideInitializer(bootstrap),
+  provideModules(main),
+]);
+</file>
+
+<file path="app.ts">
+import '@tstdl/base/polyfills';
+
+import { Application, provideInitializer, provideModules } from '@tstdl/base/application';
+import { WebServerModule } from '@tstdl/base/module';
+
+import { bootstrapData } from './bootstrap-data.js';
+import { bootstrap } from './bootstrap.js';
+import { config } from './config.js';
+
+async function main(): Promise<void> {
+  if (config.bootstrapData) {
+    await bootstrapData();
+  }
+}
+
+Application.run('Vitrass', [
+  provideInitializer(bootstrap),
+  provideModules(main, WebServerModule),
+]);
+</file>
+
+<file path="bootstrap-data.ts">
+import { AuthenticationService } from '@tstdl/base/authentication/server';
+import { Singleton, inject, injectAsync } from '@tstdl/base/injector';
+import type { NewEntity } from '@tstdl/base/orm';
+import { injectRepository } from '@tstdl/base/orm/server';
+
+import { TenantService, UserService } from '#/services/core/index.js';
+import { Country, Gender, Role, StaffMemberSettings, SuperUser, Tenant, User, UserRole } from '#/shared/models/core/index.js';
+import { systemId } from '#/shared/system-id.js';
+
+@Singleton()
+class Context {
+  readonly tenantService = inject(TenantService);
+  readonly userService = inject(UserService);
+  readonly authenticationService = inject(AuthenticationService);
+  readonly superUserService = injectRepository(SuperUser);
+  readonly staffMemberSettingsService = injectRepository(StaffMemberSettings);
+};
+
+export async function bootstrapData(): Promise<void> {
+  const context = await injectAsync(Context);
+
+  const tenantsCount = await context.tenantService.count();
+
+  if (tenantsCount > 0) {
+    return;
+  }
+
+  await bootstrapMuster(context);
+}
+
+export async function bootstrapMuster(context: Context): Promise<[User, Tenant]> {
+  const existingUser = await context.userService.tryLoadByQuery({ mail: 'max@mustermann.com' });
+  const existingTenant = await context.tenantService.tryLoadByQuery({ name: 'Muster und Partner' });
+
+  if (existingUser && existingTenant) {
+    return [existingUser, existingTenant];
+  }
+
+  const newUser: NewEntity<User> = {
+    tenantId: null,
+    role: UserRole.StaffMember,
+    mail: 'max@mustermann.com',
+    phone: '+49123456789',
+    firstName: 'Max',
+    lastName: 'Mustermann',
+    gender: Gender.Male,
+    metadata: { attributes: { createUserId: systemId } },
+  };
+
+  const user = existingUser ?? await context.userService.insert(newUser);
+
+  console.log('Bootstrapping Muster und Partner');
+
+  const tenant = existingTenant ?? await context.tenantService.insert({
+    name: 'Muster und Partner',
+    nameAddition: null,
+    legalName: null,
+    mail: 'service@muster-und-partner.de',
+    phone: '+49 1234 56789',
+    address: { street: 'Musterstraße', houseNumber: '1', postCode: '12345', city: 'Musterstadt', addition: null, country: Country.Germany },
+    metadata: { attributes: { createUserId: systemId } },
+  });
+
+  await context.staffMemberSettingsService.insert({ tenantId: tenant.id, userId: user.id, roles: [Role.TenantAdmin], permissions: [], metadata: { attributes: { createUserId: systemId } } });
+  await context.superUserService.insert({ userId: user.id, metadata: { attributes: { createUserId: systemId } } });
+
+  await context.authenticationService.setCredentials(user.id, '!123foobar!');
+
+  return [user, tenant];
+}
+</file>
+
+<file path="bootstrap.ts">
+import { enableProdMode, isDevMode } from '@tstdl/base';
+import { configureAiService } from '@tstdl/base/ai';
+import { configureApiServer } from '@tstdl/base/api/server';
+import { AuthenticationApiController, AuthenticationApiRequestTokenProvider, configureAuthenticationServer, migrateAuthenticationSchema } from '@tstdl/base/authentication/server';
+import { configureDocumentManagement, migrateDocumentManagementSchema } from '@tstdl/base/document-management/server';
+import { configureNodeHttpServer } from '@tstdl/base/http/node';
+import { configureUndiciHttpClientAdapter } from '@tstdl/base/http/undici';
+import { inject, Injector, runInInjectionContext } from '@tstdl/base/injector';
+import { configurePostgresKeyValueStore } from '@tstdl/base/key-value-store/postgres';
+import { configureMail, migrateMailSchema, NodemailerMailClient } from '@tstdl/base/mail';
+import { configureLocalMessageBus } from '@tstdl/base/message-bus';
+import { configureS3ObjectStorage } from '@tstdl/base/object-storage';
+import { configureOrm, Database, migrate } from '@tstdl/base/orm/server';
+import { configurePostgresQueue, migratePostgresQueueSchema } from '@tstdl/base/queue/postgres';
+import { configureDefaultSignalsImplementation } from '@tstdl/base/signals/implementation';
+import { configureTemplates } from '@tstdl/base/templates';
+import { JsxTemplateRenderer, MjmlTemplateRenderer } from '@tstdl/base/templates/renderers';
+import { deriveBytesMultiple, importPbkdf2Key, isDefined, isUndefined, millisecondsPerHour } from '@tstdl/base/utils';
+
+import { PersonApi, TenantApi, UserApi, VitrassDocumentManagementApi } from './api/core/index.js';
+import { config } from './config.js';
+import { VitrassAuthenticationAncillaryService, VitrassDocumentManagementAncillaryService, VitrassDocumentManagementAuthorizationService } from './services/tstdl/index.js';
+import { defaultAccessControlAllowHeaders } from './shared/api/defaults.js';
+import { SECRETS } from './tokens.js';
+
+export async function bootstrap(): Promise<void> {
+  const injector = inject(Injector);
+
+  if (!config.development) {
+    enableProdMode();
+  }
+
+  configureNodeHttpServer();
+  configureUndiciHttpClientAdapter();
+  configurePostgresKeyValueStore();
+  configurePostgresQueue();
+  configureLocalMessageBus();
+  configureDefaultSignalsImplementation();
+
+  configureAuthenticationServer({
+    authenticationAncillaryService: VitrassAuthenticationAncillaryService,
+    serviceOptions: {
+      useFactory: (_, context) => {
+        const { tokenSigningSecret, refreshTokenSigningSecret, secretResetTokenSigningSecret } = context.resolve(SECRETS);
+
+        return {
+          secret: { tokenSigningSecret, refreshTokenSigningSecret, secretResetTokenSigningSecret },
+          tokenTimeToLive: isDevMode() ? (10 * millisecondsPerHour) : undefined,
+        };
+      },
+    },
+  });
+
+  configureS3ObjectStorage({
+    endpoint: config.s3.endpoint,
+    bucket: config.s3.bucket,
+    bucketPerModule: config.s3.bucketPerModule,
+    accessKey: config.s3.accessKey,
+    secretKey: config.s3.secretKey,
+  });
+
+  configureTemplates({
+    templateRenderers: [JsxTemplateRenderer, MjmlTemplateRenderer],
+  });
+
+  configureDocumentManagement({
+    ancillaryService: VitrassDocumentManagementAncillaryService,
+    authorizationService: VitrassDocumentManagementAuthorizationService,
+    fileObjectStorageModule: 'document-files',
+    fileUploadObjectStorageModule: 'document-uploads',
+    filePreviewObjectStorageModule: 'document-previews',
+  });
+
+  configureMail({
+    client: NodemailerMailClient,
+    defaultClientConfig: {
+      host: config.mail.host,
+      port: config.mail.port,
+      auth: (isUndefined(config.mail.user) || isUndefined(config.mail.password))
+        ? undefined
+        : {
+          user: config.mail.user,
+          password: config.mail.password,
+        },
+    },
+    defaultData: {
+      from: config.mail.from,
+    },
+  });
+
+  configureAiService({
+    apiKey: config.ai.apiKey,
+    keyFile: config.ai.keyFile,
+    vertex: isDefined(config.ai.vertex.project) && isDefined(config.ai.vertex.location)
+      ? {
+        project: config.ai.vertex.project,
+        location: config.ai.vertex.location,
+        bucket: 'vitrass-document-processing',
+      }
+      : undefined,
+  });
+
+  /** Secrets */
+
+  const key = await importPbkdf2Key(config.deploymentSecret);
+  const algorithm = { name: 'PBKDF2', hash: 'SHA-512', iterations: 500000, salt: new Uint8Array() };
+  const [tokenSigningSecret, refreshTokenSigningSecret, secretResetTokenSigningSecret, databaseEncryptionSecret] = await deriveBytesMultiple(algorithm, key, [64, 64, 64, 32]);
+
+  Injector.registerSingleton(SECRETS, { useValue: { tokenSigningSecret, refreshTokenSigningSecret, secretResetTokenSigningSecret, databaseEncryptionSecret } });
+
+  configureOrm({
+    connection: {
+      host: config.database.host,
+      port: config.database.port,
+      user: config.database.user,
+      password: config.database.pass,
+      database: config.database.database,
+    },
+    repositoryConfig: { schema: 'vitrass' },
+    encryptionSecret: databaseEncryptionSecret,
+  });
+
+  await runInInjectionContext(injector, migrateAuthenticationSchema);
+  await runInInjectionContext(injector, migrateDocumentManagementSchema);
+  await runInInjectionContext(injector, migratePostgresQueueSchema);
+  await runInInjectionContext(injector, migrateMailSchema);
+  await runInInjectionContext(injector, migrateSchema);
+
+  configureApiServer({
+    controllers: [AuthenticationApiController, UserApi, PersonApi, TenantApi, VitrassDocumentManagementApi],
+    requestTokenProvider: AuthenticationApiRequestTokenProvider,
+    gatewayOptions: {
+      prefix: null,
+      cors: {
+        default: {
+          autoAccessControlAllowOrigin: [...config.appUrl],
+          accessControlAllowHeaders: defaultAccessControlAllowHeaders,
+        },
+      },
+    },
+  });
+}
+
+async function migrateSchema(): Promise<void> {
+  const database = inject(Database);
+
+  await migrate(
+    database,
+    {
+      migrationsSchema: 'vitrass',
+      migrationsTable: '_migrations',
+      migrationsFolder: import.meta.resolve('./drizzle').replace('file://', ''),
+    }
+  );
+}
+</file>
+
+<file path="config.ts">
+import { LogLevel } from '@tstdl/base/logger';
+import { boolean, positiveInteger, string } from '@tstdl/base/utils';
+
+export const config = {
+  development: boolean('DEVELOPMENT', false),
+  verbosity: positiveInteger('VERBOSITY', LogLevel.Trace) as LogLevel,
+  deploymentSecret: string('DEPLOYMENT_SECRET', 'DEBUGSECRET'),
+  bootstrapData: boolean('BOOTSTRAP_DATA', false),
+  database: {
+    host: string('DATABASE_HOST', '127.0.0.1'),
+    port: positiveInteger('DATABASE_PORT', 5432),
+    user: string('DATABASE_USER', 'vitrass'),
+    pass: string('DATABASE_PASS', '6zv7edvqv9vvzz6u4kuk'),
+    database: string('DATABASE_NAME', 'vitrass'),
+  },
+  ai: {
+    apiKey: string('AI_API_KEY', '---'),
+    keyFile: string('AI_API_KEY_FILE', undefined),
+    vertex: {
+      project: string('AI_VERTEX_PROJECT', undefined),
+      location: string('AI_VERTEX_LOCATION', undefined),
+    },
+  },
+  s3: {
+    endpoint: string('S3_ENDPOINT', 'http://localhost:9000'),
+    accessKey: string('S3_ACCESS_KEY', 'vitrass-dev'),
+    secretKey: string('S3_SECRET_KEY', 'vitrass-dev'),
+    bucket: string('S3_BUCKET', undefined),
+    bucketPerModule: boolean('S3_BUCKET_PER_MODULE', true),
+  },
+  appUrl: string('APP_URL', 'http://localhost:4200').split(',').map((url) => url.trim()),
+  mail: {
+    host: string('MAIL_HOST', '127.0.0.1'),
+    port: positiveInteger('MAIL_PORT', 25),
+    user: string('MAIL_USER', undefined),
+    password: string('MAIL_PASS', undefined),
+    from: string('MAIL_FROM', undefined),
+  },
+};
+
+if (config.deploymentSecret == 'DEBUGSECRET') {
+  console.warn('!!! DEPLOYMENT_SECRET NOT SET !!!');
+}
+</file>
+
+<file path="drizzle.config.ts">
+import { relative, resolve } from 'node:path';
+
+import { defineConfig } from 'drizzle-kit';
+import { config } from './config.js';
+
+export default defineConfig({
+  dialect: 'postgresql',
+  out: relative('./', resolve(__dirname, './drizzle/').replace('dist', 'source')),
+  schema: resolve(__dirname, './schemas.js'),
+  schemaFilter: ['vitrass'],
+  dbCredentials: {
+    host: config.database.host,
+    port: config.database.port,
+    user: config.database.user,
+    password: config.database.pass,
+    database: config.database.database,
+    ssl: false
+  },
+  migrations: {
+    schema: 'vitrass',
+    table: '_migrations'
+  },
+  introspect: {
+    casing: 'camel'
+  }
+});
+</file>
+
+<file path="keys.ts">
+export const objectStorageKeys = {
+  deviceImages: 'device-images'
+};
+</file>
+
+<file path="schemas.ts">
+import { databaseSchema } from '@tstdl/base/orm/server';
+
+import { Country, DocumentCollectionMapping, Gender, Permission, Person, Role, StaffMemberSettings, SuperUser, Tenant, User, UserRole } from './shared/models/core/index.js';
+
+export const schema = databaseSchema('vitrass');
+
+export const country = schema.getEnum(Country);
+export const gender = schema.getEnum(Gender);
+export const permission = schema.getEnum(Permission);
+export const role = schema.getEnum(Role);
+export const userRole = schema.getEnum(UserRole);
+
+export const documentCollectionMapping = schema.getTable(DocumentCollectionMapping);
+export const person = schema.getTable(Person);
+export const staffMemberSettings = schema.getTable(StaffMemberSettings);
+export const superUser = schema.getTable(SuperUser);
+export const tenant = schema.getTable(Tenant);
+export const user = schema.getTable(User);
+</file>
+
+<file path="tokens.ts">
+import { injectionToken } from '@tstdl/base/injector';
+
+type Secrets = {
+  tokenSigningSecret: Uint8Array<ArrayBuffer>,
+  refreshTokenSigningSecret: Uint8Array<ArrayBuffer>,
+  secretResetTokenSigningSecret: Uint8Array<ArrayBuffer>,
+  databaseEncryptionSecret: Uint8Array<ArrayBuffer>,
+};
+
+export const SECRETS = injectionToken<Secrets>('SECRETS');
+</file>
+
+<file path="types.ts">
+import '@tstdl/base/templates/types';
+</file>
+
+</files>