@tstdl/base 0.93.36 → 0.93.37

package/tstdl-features.xml

@@ -1,1239 +0,0 @@
-This file is a merged representation of the entire codebase, combined into a single document by Repomix.
-
-<file_summary>
-This section contains a summary of this file.
-
-<purpose>
-This file contains a packed representation of the entire repository's contents.
-It is designed to be easily consumable by AI systems for analysis, code review,
-or other automated processes.
-</purpose>
-
-<file_format>
-The content is organized as follows:
-1. This summary section
-2. Repository information
-3. Directory structure
-4. Repository files (if enabled)
-5. Multiple file entries, each consisting of:
-  - File path as an attribute
-  - Full contents of the file
-</file_format>
-
-<usage_guidelines>
-- This file should be treated as read-only. Any changes should be made to the
-  original repository files, not this packed version.
-- When processing this file, use the file path to distinguish
-  between different files in the repository.
-- Be aware that this file may contain sensitive information. Handle it with
-  the same level of security as you would the original repository.
-</usage_guidelines>
-
-<notes>
-- Some files may have been excluded based on .gitignore rules and Repomix's configuration
-- Binary files are not included in this packed representation. Please refer to the Repository Structure section for a complete list of file paths, including binary files
-- Files matching patterns in .gitignore are excluded
-- Files matching default ignore patterns are excluded
-- Files are sorted by Git change count (files with more changes are at the bottom)
-</notes>
-
-</file_summary>
-
-<directory_structure>
-api/
-  core/
-    document-management.api.ts
-    index.ts
-    person.api.ts
-    tenant.api.ts
-    user.api.ts
-mails/
-  index.ts
-  mail-template.tsx
-  reset-password.tsx
-services/
-  core/
-    document-management.service.ts
-    index.ts
-    tenant.service.ts
-    user.service.ts
-  tstdl/
-    authentication-ancillary.service.ts
-    document-management-ancillary.service.ts
-    index.ts
-    vitrass-document-management-authorization.service.ts
-tools/
-  create-tenant-admin.ts
-  create-tenant.ts
-  reset-password.ts
-  set-super-user.ts
-app.ts
-bootstrap-data.ts
-bootstrap.ts
-config.ts
-drizzle.config.ts
-keys.ts
-schemas.ts
-tokens.ts
-types.ts
-</directory_structure>
-
-<files>
-This section contains the contents of the repository's files.
-
-<file path="api/core/document-management.api.ts">
-import type { ApiController, ApiRequestContext, ApiServerResult } from '@tstdl/base/api';
-import { apiController } from '@tstdl/base/api/server';
-import { ForbiddenError } from '@tstdl/base/errors';
-import { inject } from '@tstdl/base/injector';
-import { isUndefined } from '@tstdl/base/utils';
-
-import { VitrassDocumentManagementService } from '#/services/core/document-management.service.js';
-import { vitrassDocumentManagementApiDefinition, type VitrassDocumentManagementApiDefinition } from '#/shared/api/core/index.js';
-import type { VitrassToken } from '#/shared/token.js';
-
-@apiController(vitrassDocumentManagementApiDefinition)
-export class VitrassDocumentManagementApi implements ApiController<VitrassDocumentManagementApiDefinition> {
-  readonly #documentManagementService = inject(VitrassDocumentManagementService);
-
-  async loadTenantDocumentCollection({ getToken }: ApiRequestContext<VitrassDocumentManagementApiDefinition, 'loadTenantDocumentCollection'>): Promise<ApiServerResult<VitrassDocumentManagementApiDefinition, 'loadTenantDocumentCollection'>> {
-    const token = await getToken<VitrassToken>();
-
-    if (isUndefined(token.payload.tenantId)) {
-      throw new ForbiddenError('Tenant required.');
-    }
-
-    return await this.#documentManagementService.loadRealEstateCollection(token.payload.tenantId);
-  }
-}
-</file>
-
-<file path="api/core/index.ts">
-export * from './document-management.api.js';
-export * from './person.api.js';
-export * from './tenant.api.js';
-export * from './user.api.js';
-</file>
-
-<file path="api/core/person.api.ts">
-import type { ApiController, ApiRequestContext, ApiServerResult } from '@tstdl/base/api';
-import { apiController } from '@tstdl/base/api/server';
-import { ForbiddenError } from '@tstdl/base/errors';
-import { injectRepository } from '@tstdl/base/orm/server';
-import { isUndefined } from '@tstdl/base/utils';
-
-import { type PersonApiDefinition, personApiDefinition } from '#/shared/api/core/index.js';
-import { Person } from '#/shared/models/core/index.js';
-import type { VitrassToken } from '#/shared/token.js';
-
-@apiController(personApiDefinition)
-export class PersonApi implements ApiController<PersonApiDefinition> {
-  readonly #personService = injectRepository(Person);
-
-  async create({ parameters, getToken }: ApiRequestContext<PersonApiDefinition, 'create'>): Promise<ApiServerResult<PersonApiDefinition, 'create'>> {
-    const token = await getToken<VitrassToken>();
-
-    if (isUndefined(token.payload.tenantId)) {
-      throw new ForbiddenError();
-    }
-
-    return this.#personService.insert({
-      tenantId: token.payload.tenantId,
-      firstName: parameters.firstName ?? null,
-      lastName: parameters.lastName,
-      gender: parameters.gender ?? null,
-      mail: parameters.mail ?? null,
-      phone: parameters.phone ?? null
-    });
-  }
-
-  async update({ parameters, getToken }: ApiRequestContext<PersonApiDefinition, 'update'>): Promise<ApiServerResult<PersonApiDefinition, 'update'>> {
-    const token = await getToken<VitrassToken>();
-
-    if (isUndefined(token.payload.tenantId)) {
-      throw new ForbiddenError();
-    }
-
-    return this.#personService.updateByQuery({ tenantId: token.payload.tenantId, id: parameters.id }, {
-      firstName: parameters.firstName,
-      lastName: parameters.lastName,
-      gender: parameters.gender,
-      mail: parameters.mail,
-      phone: parameters.phone
-    });
-  }
-}
-</file>
-
-<file path="api/core/tenant.api.ts">
-import type { ApiController, ApiRequestContext, ApiServerResult } from '@tstdl/base/api';
-import { apiController } from '@tstdl/base/api/server';
-import { inject } from '@tstdl/base/injector';
-import { isDefined } from '@tstdl/base/utils';
-import { toArray } from '@tstdl/base/utils/array';
-
-import { TenantService } from '#/services/core/tenant.service.js';
-import { tenantApiDefinition, type TenantApiDefinition } from '#/shared/api/core/tenant.api.js';
-import type { VitrassToken } from '#/shared/token.js';
-
-@apiController(tenantApiDefinition)
-export class TenantApi implements ApiController<TenantApiDefinition> {
-  readonly tenantService = inject(TenantService);
-
-  async get({ parameters, getToken }: ApiRequestContext<TenantApiDefinition, 'get'>): Promise<ApiServerResult<TenantApiDefinition, 'get'>> {
-    await getToken<VitrassToken>();
-    return this.tenantService.load(parameters.id);
-  }
-
-  async getMany({ parameters: { ids }, getToken }: ApiRequestContext<TenantApiDefinition, 'getMany'>): Promise<ApiServerResult<TenantApiDefinition, 'getMany'>> {
-    await getToken<VitrassToken>();
-    return this.tenantService.getMany({ ids: isDefined(ids) ? toArray(ids) : undefined });
-  }
-}
-</file>
-
-<file path="api/core/user.api.ts">
-import type { ApiController, ApiRequestContext, ApiServerResult } from '@tstdl/base/api';
-import { apiController } from '@tstdl/base/api/server';
-import { inject } from '@tstdl/base/injector';
-
-import { UserService } from '#/services/core/index.js';
-import { type UserApiDefinition, userApiDefinition } from '#/shared/api/core/user.api.js';
-import type { VitrassToken } from '#/shared/token.js';
-
-@apiController(userApiDefinition)
-export class UserApi implements ApiController<UserApiDefinition> {
-  readonly userService = inject(UserService);
-
-  async get({ parameters, getToken }: ApiRequestContext<UserApiDefinition, 'get'>): Promise<ApiServerResult<UserApiDefinition, 'get'>> {
-    await getToken<VitrassToken>();
-    return this.userService.load(parameters.id);
-  }
-
-  async getMany({ getToken }: ApiRequestContext<UserApiDefinition, 'getMany'>): Promise<ApiServerResult<UserApiDefinition, 'getMany'>> {
-    await getToken<VitrassToken>();
-    return this.userService.loadAll();
-  }
-
-  async update({ parameters, getToken }: ApiRequestContext<UserApiDefinition, 'update'>): Promise<ApiServerResult<UserApiDefinition, 'update'>> {
-    await getToken<VitrassToken>();
-    return this.userService.update(parameters.id, parameters);
-  }
-}
-</file>
-
-<file path="mails/index.ts">
-export * from './mail-template.js';
-export * from './reset-password.js';
-</file>
-
-<file path="mails/mail-template.tsx">
-import type { RenderableProps } from 'preact';
-
-type MailTemplateProperties = {
-  subject: string,
-};
-
-export function MailTemplate({ children, subject }: RenderableProps<MailTemplateProperties>) {
-  return (
-    <mjml>
-      <mj-head>
-        <mj-title>Vitrass - {subject}</mj-title>
-      </mj-head>
-      <mj-body>
-        <mj-section background-color="#002145" padding-top="50px" padding-bottom="30px">
-          <mj-column>
-            <mj-text color="#ffffff" font-size="35px" font-weight="bold">Vitrass</mj-text>
-            <mj-text color="#ffffff" font-size="25px">{subject}</mj-text>
-          </mj-column>
-        </mj-section>
-        <mj-section background-color="#f3f3f3">
-          {children}
-        </mj-section>
-      </mj-body>
-    </mjml>
-  );
-}
-</file>
-
-<file path="mails/reset-password.tsx">
-import { mailTemplate } from '@tstdl/base/mail';
-import type { MjmlTemplateRenderer, StringTemplateRenderer } from '@tstdl/base/templates/renderers';
-import { jsxTemplateField, stringTemplateField } from '@tstdl/base/templates/resolvers';
-
-import { MailTemplate } from './mail-template.js';
-
-export type ResetPasswordMailData = { firstName: string | null, resetPasswordUrl: string };
-
-export const resetPasswordMailTemplate = mailTemplate<ResetPasswordMailData>('reset-password', {
-  subject: stringTemplateField<StringTemplateRenderer>({ renderer: 'string', template: 'Passwort zurücksetzen' }),
-  html: jsxTemplateField<MjmlTemplateRenderer>({
-    renderer: 'mjml-jsx',
-    template: ({ firstName, resetPasswordUrl }: ResetPasswordMailData) => (
-      <MailTemplate subject="Passwort zurücksetzen">
-        <mj-column>
-          <mj-text>
-            <p>Hallo {firstName ?? ''},</p>
-            <p>für dein Konto bei Vitrass wurde das zurücksetzen des Passworts angefordert. Um dein Passwort zurückzusetzen, klicke bitte auf folgenden Button.</p>
-          </mj-text>
-
-          <mj-button href={resetPasswordUrl}>Passwort zurücksetzen</mj-button>
-
-          <mj-text>
-            <p>Wenn Du diese E-Mail nicht angefordert hast, kannst du sie gefahrlos ignorieren.</p>
-          </mj-text>
-        </mj-column>
-      </MailTemplate>
-    ),
-  }),
-});
-</file>
-
-<file path="services/core/document-management.service.ts">
-import { DocumentCategory, DocumentType, type DocumentCollection, type DocumentProperty } from '@tstdl/base/document-management';
-import { DocumentCollectionService, DocumentManagementService } from '@tstdl/base/document-management/server';
-import { inject, registerAfterResolve, Singleton } from '@tstdl/base/injector';
-import { injectRepository } from '@tstdl/base/orm/server';
-import type { Writable } from '@tstdl/base/types';
-import { isDefined } from '@tstdl/base/utils';
-import { objectKeys } from '@tstdl/base/utils/object';
-
-import { DocumentCollectionMapping } from '#/shared/models/core/document-collection-mapping.js';
-import { VitrassCategoryParents, VitrassDocumentCategoryLabels, VitrassDocumentPropertyConfiguration, VitrassDocumentTypeCategories, VitrassDocumentTypeLabels, VitrassDocumentTypeProperties, type VitrassDocumentCategory, type VitrassDocumentProperty, type VitrassDocumentType } from '#/shared/models/core/index.js';
-
-@Singleton()
-export class VitrassDocumentManagementService extends DocumentManagementService {
-  readonly #documentCollectionService = inject(DocumentCollectionService);
-  readonly #documentCollectionMappingService = injectRepository(DocumentCollectionMapping);
-
-  readonly categories: Record<VitrassDocumentCategory, DocumentCategory>;
-  readonly types: Record<VitrassDocumentType, DocumentType>;
-  readonly properties: Record<VitrassDocumentProperty, DocumentProperty>;
-
-  constructor() {
-    super();
-
-    registerAfterResolve(async () => {
-      const x = await this.initializeCategoriesAndTypes(null, {
-        categoryLabels: VitrassDocumentCategoryLabels,
-        categoryParents: VitrassCategoryParents,
-        typeLabels: VitrassDocumentTypeLabels,
-        typeCategories: VitrassDocumentTypeCategories,
-        propertyConfigurations: VitrassDocumentPropertyConfiguration,
-        typeProperties: VitrassDocumentTypeProperties,
-      });
-
-      (this as Writable<this>).categories = x.categories;
-      (this as Writable<this>).types = x.types;
-      (this as Writable<this>).properties = x.properties;
-    });
-  }
-
-  async loadRealEstateCollection(tenantId: string): Promise<DocumentCollection> {
-    return await this.loadCollection(tenantId, { tenantId });
-  }
-
-  private async loadCollection(tenantId: string, filter: Partial<Pick<DocumentCollectionMapping, 'tenantId' | 'personId'>>): Promise<DocumentCollection> {
-    if (objectKeys(filter).length != 1) {
-      throw new Error('Exactly one of tenantId or personId must be specified in the filter');
-    }
-
-    return await this.#documentCollectionMappingService.transaction(async (transaction) => {
-      const mapping = await this.#documentCollectionMappingService.withTransaction(transaction).tryLoadByQuery(filter);
-
-      if (isDefined(mapping)) {
-        return await this.#documentCollectionService.withTransaction(transaction).repository.loadByQuery({ tenantId, id: mapping.collectionId });
-      }
-
-      const collection = await this.#documentCollectionService.withTransaction(transaction).createCollection(tenantId, null);
-      await this.#documentCollectionMappingService.withTransaction(transaction).insert({ collectionId: collection.id, tenantId: null, personId: null, ...filter });
-
-      return collection;
-    });
-  }
-}
-</file>
-
-<file path="services/core/index.ts">
-export * from './document-management.service.js';
-export * from './tenant.service.js';
-export * from './user.service.js';
-</file>
-
-<file path="services/core/tenant.service.ts">
-import { Singleton, inject } from '@tstdl/base/injector';
-import { getRepository, injectRepository } from '@tstdl/base/orm/server';
-import { isDefined } from '@tstdl/base/utils';
-
-import { Role, StaffMemberSettings, Tenant } from '#/shared/models/core/index.js';
-import { GetManyTenantsFilter } from '#/shared/service-models/index.js';
-import { UserService } from './user.service.js';
-
-export type StaffMemberUpdate = {
-  roles: Role[]
-};
-
-@Singleton()
-export class TenantService extends getRepository(Tenant) {
-  readonly staffMemberSettingsService = injectRepository(StaffMemberSettings);
-  readonly userService = inject(UserService);
-
-  async getMany(filter: GetManyTenantsFilter): Promise<Tenant[]> {
-    const userStaffMembers = isDefined(filter.staffMemberUserId)
-      ? await this.staffMemberSettingsService.loadManyByQuery({ userId: filter.staffMemberUserId })
-      : undefined;
-
-    const staffMemberTenantIds = userStaffMembers?.map((staffMember) => staffMember.tenantId);
-
-    return await this.loadManyByQuery({
-      $and: [
-        isDefined(staffMemberTenantIds) ? { id: { $in: staffMemberTenantIds } } : undefined,
-        isDefined(filter.ids) ? { id: { $in: filter.ids } } : undefined,
-      ].filter(isDefined),
-    });
-  }
-}
-</file>
-
-<file path="services/core/user.service.ts">
-import { Singleton } from '@tstdl/base/injector';
-import type { LoadManyOptions, Query } from '@tstdl/base/orm';
-import { getRepository } from '@tstdl/base/orm/server';
-
-import { User } from '#/shared/models/core/index.js';
-import { LightPersonView, toLightPersonView } from '#/shared/service-models/index.js';
-
-@Singleton()
-export class UserService extends getRepository(User) {
-  async loadManyLightViewsByQuery(filter: Query<User>, options?: LoadManyOptions<User>): Promise<LightPersonView[]> {
-    const users = await this.loadManyByQuery(filter, options);
-    return users.map(toLightPersonView);
-  }
-}
-</file>
-
-<file path="services/tstdl/authentication-ancillary.service.ts">
-import { InitSecretResetData, type TokenPayload } from '@tstdl/base/authentication';
-import { AuthenticationAncillaryService, type GetTokenPayloadContext, type ResolveSubjectResult } from '@tstdl/base/authentication/server';
-import { BadRequestError, NotFoundError, UnauthorizedError } from '@tstdl/base/errors';
-import { Singleton, inject, provide } from '@tstdl/base/injector';
-import { MailService } from '@tstdl/base/mail';
-import { EntityRepositoryConfig, injectRepository } from '@tstdl/base/orm/server';
-import type { Record } from '@tstdl/base/types';
-import { isDefined, isNull } from '@tstdl/base/utils';
-import { distinct } from '@tstdl/base/utils/array';
-
-import { config } from '#/config.js';
-import { type ResetPasswordMailData, resetPasswordMailTemplate } from '#/mails/index.js';
-import { StaffMemberSettings, SuperUser, rolePermissions } from '#/shared/models/core/index.js';
-import { AdditionalVitrassTokenPayload, VitrassAuthenticationData } from '#/shared/token.js';
-import { UserService } from '../core/index.js';
-
-@Singleton({
-  providers: [provide(EntityRepositoryConfig, { useValue: { schema: 'vitrass' } })],
-})
-export class VitrassAuthenticationAncillaryService extends AuthenticationAncillaryService<AdditionalVitrassTokenPayload, VitrassAuthenticationData> {
-  readonly #userService = inject(UserService);
-  readonly #mailService = inject(MailService);
-  readonly #staffMemberSettingsService = injectRepository(StaffMemberSettings);
-  readonly #superUserService = injectRepository(SuperUser);
-
-  async resolveSubject(providedSubject: string): Promise<ResolveSubjectResult> {
-    if (providedSubject.includes('@')) {
-      const users = await this.#userService.loadManyByQuery({ mail: providedSubject.toLowerCase() });
-
-      if (users.length == 1) {
-        return { success: true, subject: users[0]!.id };
-      }
-
-      if (users.length > 1) {
-        throw new UnauthorizedError('User mail is not unique.');
-      }
-
-      throw new NotFoundError('User not found.');
-    }
-
-    return { success: true, subject: providedSubject };
-  }
-
-  override async getTokenPayload(subject: string, _authenticationData: VitrassAuthenticationData, _context: GetTokenPayloadContext): Promise<AdditionalVitrassTokenPayload> {
-    const [staffMemberSettings, superUser] = await Promise.all([
-      this.#staffMemberSettingsService.tryLoadByQuery({ userId: subject }),
-      this.#superUserService.tryLoadByQuery({ userId: subject }),
-    ]);
-
-    const rolesPermissions = staffMemberSettings?.roles.flatMap((role) => rolePermissions[role]);
-
-    const permissions = distinct([
-      ...(staffMemberSettings?.permissions ?? []),
-      ...(rolesPermissions ?? []),
-    ]);
-
-    return {
-      tenantId: staffMemberSettings?.tenantId,
-      staffMemberId: staffMemberSettings?.id,
-      permissions,
-      isSuperUser: isDefined(superUser),
-    };
-  }
-
-  override async handleInitSecretReset(data: InitSecretResetData & Record<never>): Promise<void> {
-    const user = await this.#userService.load(data.subject);
-
-    const mailData: ResetPasswordMailData = {
-      firstName: user.firstName,
-      resetPasswordUrl: `${config.appUrl}/reset-password/${data.token}`,
-    };
-
-    if (isNull(user.mail)) {
-      throw new BadRequestError('User has no mail address.');
-    }
-
-    await this.#mailService.sendTemplate(resetPasswordMailTemplate, { to: user.mail }, mailData);
-  }
-
-  override canImpersonate(token: TokenPayload<AdditionalVitrassTokenPayload>, _subject: string, _authenticationData: VitrassAuthenticationData): boolean {
-    return (token.isSuperUser == true);
-  }
-}
-</file>
-
-<file path="services/tstdl/document-management-ancillary.service.ts">
-import type { DocumentCollection, DocumentCollectionMetadata } from '@tstdl/base/document-management';
-import { DocumentManagementAncillaryService } from '@tstdl/base/document-management/server';
-import { formatPersonName } from '@tstdl/base/formats';
-import { inject, Singleton } from '@tstdl/base/injector';
-import { injectRepository } from '@tstdl/base/orm/server';
-import { assertDefinedPass, isNotNull } from '@tstdl/base/utils';
-
-import { DocumentCollectionMapping } from '#/shared/models/core/document-collection-mapping.js';
-import { Person } from '#/shared/models/core/person.model.js';
-import { TenantService } from '../core/tenant.service.js';
-
-@Singleton()
-export class VitrassDocumentManagementAncillaryService extends DocumentManagementAncillaryService {
-  readonly #tenantService = inject(TenantService);
-  readonly #personService = injectRepository(Person);
-  readonly #documentCollectionMappingService = injectRepository(DocumentCollectionMapping);
-
-  override async resolveMetadata(collections: DocumentCollection[]): Promise<DocumentCollectionMetadata[]> {
-    const collectionIds = collections.map((collection) => collection.id);
-
-    const mappings = await this.#documentCollectionMappingService.loadManyByQuery({ id: { $in: collectionIds } });
-
-    const tenantIds = mappings.filter((mapping) => isNotNull(mapping.tenantId)).map((mapping) => mapping.tenantId!);
-    const personIds = mappings.filter((mapping) => isNotNull(mapping.personId)).map((mapping) => mapping.personId!);
-
-    const [tenants, persons] = await Promise.all([
-      this.#tenantService.loadManyByQuery({ id: { $in: tenantIds } }),
-      this.#personService.loadManyByQuery({ id: { $in: personIds } }),
-    ]);
-
-    return collections.map((collection) => {
-      const mapping = assertDefinedPass(mappings.find((mapping) => mapping.id == collection.id), `Mapping for collection "${collection.id}" not found.`);
-
-      if (isNotNull(mapping.personId)) {
-        const person = assertDefinedPass(persons.find((person) => person.id == mapping.personId), `Person "${mapping.personId}" not found.`);
-        return { name: formatPersonName(person), group: null };
-      }
-
-      if (isNotNull(mapping.tenantId)) {
-        const tenant = assertDefinedPass(tenants.find((tenant) => tenant.id == mapping.tenantId), `Tenant "${mapping.tenantId}" not found.`);
-        return { name: `${tenant.name} ${tenant.nameAddition ?? ''}`.trim(), group: null };
-      }
-
-      throw new Error('Collection mapping type not supported.');
-    });
-  }
-}
-</file>
-
-<file path="services/tstdl/index.ts">
-export * from './authentication-ancillary.service.js';
-export * from './document-management-ancillary.service.js';
-export * from './vitrass-document-management-authorization.service.js';
-</file>
-
-<file path="services/tstdl/vitrass-document-management-authorization.service.ts">
-import { DocumentManagementAuthorizationService } from '@tstdl/base/document-management';
-import { DocumentCollectionService, DocumentService } from '@tstdl/base/document-management/server';
-import { ForbiddenError } from '@tstdl/base/errors';
-import { inject, Singleton } from '@tstdl/base/injector';
-import { isUndefined } from '@tstdl/base/utils';
-
-import type { VitrassToken } from '#/shared/token.js';
-
-@Singleton()
-export class VitrassDocumentManagementAuthorizationService extends DocumentManagementAuthorizationService {
-  readonly #collectionService = inject(DocumentCollectionService);
-  readonly #documentService = inject(DocumentService);
-
-  override getTenantId(token?: VitrassToken): string | Promise<string> {
-    const tenantId = token?.payload.tenantId;
-
-    if (isUndefined(tenantId)) {
-      throw new ForbiddenError('No tenantId provided.');
-    }
-
-    return tenantId;
-  }
-
-  override getSubject(token?: VitrassToken): string | Promise<string> {
-    const subject = token?.payload.subject;
-
-    if (isUndefined(subject)) {
-      throw new ForbiddenError('No subject provided.');
-    }
-
-    return subject;
-  }
-
-  override async canReadCollection(collectionId: string, token?: VitrassToken): Promise<boolean> {
-    const collection = await this.#collectionService.repository.load(collectionId);
-    return collection.tenantId == token?.payload.tenantId;
-  }
-
-  override async canCreateDocuments(collectionId: string, token?: VitrassToken): Promise<boolean> {
-    return await this.canReadCollection(collectionId, token);
-  }
-
-  override async canDeleteDocuments(collectionId: string, token?: VitrassToken): Promise<boolean> {
-    return await this.canReadCollection(collectionId, token);
-  }
-
-  override async canAssignDocuments(collectionId: string, token?: VitrassToken): Promise<boolean> {
-    return await this.canReadCollection(collectionId, token);
-  }
-
-  override async canUpdateDocument(collectionId: string, token?: VitrassToken): Promise<boolean> {
-    return await this.canReadCollection(collectionId, token);
-  }
-
-  override async canApproveDocument(documentId: string, token?: VitrassToken): Promise<boolean> {
-    const document = await this.#documentService.repository.load(documentId);
-    return document.tenantId == token?.payload.tenantId;
-  }
-
-  override async canRejectDocument(documentId: string, token?: VitrassToken): Promise<boolean> {
-    return await this.canApproveDocument(documentId, token);
-  }
-
-  override async canManageRequests(collectionId: string, token?: VitrassToken): Promise<boolean> {
-    return await this.canReadCollection(collectionId, token);
-  }
-
-  override async canManageCategoriesAndTypes(_token?: VitrassToken): Promise<boolean> {
-    return false;
-  }
-
-  override async canReadDocumentRequestsTemplates(_token?: VitrassToken): Promise<boolean> {
-    return false;
-  }
-
-  override async canManageDocumentRequestsTemplates(_token?: VitrassToken): Promise<boolean> {
-    return false;
-  }
-
-  override async canManageValidationDefinitions(_token?: VitrassToken): Promise<boolean> {
-    return false;
-  }
-
-  override async canProgressDocumentWorkflow(documentId: string, token?: VitrassToken): Promise<boolean> {
-    return await this.canApproveDocument(documentId, token);
-  }
-}
-</file>
-
-<file path="tools/create-tenant-admin.ts">
-import '@tstdl/base/polyfills';
-
-import { createInterface } from 'node:readline/promises';
-
-import { Application, provideInitializer, provideModules } from '@tstdl/base/application';
-import { AuthenticationService } from '@tstdl/base/authentication/server';
-import { formatPersonName } from '@tstdl/base/formats';
-import { injectManyAsync } from '@tstdl/base/injector';
-import { injectRepository } from '@tstdl/base/orm/server';
-import { isDefined, timeout } from '@tstdl/base/utils';
-
-import { TenantService } from '#/services/core/index.js';
-import type { Gender } from '#/shared/models/core/gender.model.js';
-import { StaffMemberSettings } from '#/shared/models/core/index.js';
-import { bootstrap } from '../bootstrap.js';
-import { UserService } from '../services/core/user.service.js';
-import { Role } from '../shared/models/core/role-and-permission.model.js';
-import { UserRole } from '../shared/models/core/user.model.js';
-
-async function main(): Promise<void> {
-  const staffMemberSettingsService = injectRepository(StaffMemberSettings);
-  const [tenantService, userService, authenticationService] = await injectManyAsync(TenantService, UserService, AuthenticationService);
-
-  const rl = createInterface({
-    input: process.stdin,
-    output: process.stdout,
-  });
-
-  const tenantName = (await rl.question('Tenant name: ')).trim();
-  const tenant = await tenantService.loadByQuery({ name: tenantName });
-
-  const mail = (await rl.question('User mail: ')).trim();
-
-  let user = await userService.tryLoadByQuery({ mail });
-
-  if (isDefined(user)) {
-    console.log(`Using existing user ${formatPersonName(user)}`);
-  }
-  else {
-    const firstName = (await rl.question('First name: ')).trim();
-    const lastName = (await rl.question('Last name: ')).trim();
-    const gender = (await rl.question(`gender (male, female): `)).trim() as Gender;
-    const password = (await rl.question('Password: ')).trim();
-
-    console.log('Creating user in 5 seconds');
-
-    await timeout(5000);
-
-    user = await userService.insert({
-      tenantId: tenant.id,
-      role: UserRole.StaffMember,
-      firstName,
-      lastName,
-      mail,
-      phone: null,
-      gender,
-    });
-
-    await authenticationService.setCredentials(user.id, password, { skipValidation: true });
-
-    console.log(user);
-  }
-
-  console.log('Assiging role in 5 seconds');
-
-  await timeout(5000);
-
-  await staffMemberSettingsService.insert({
-    tenantId: tenant.id,
-    userId: user.id,
-    roles: [Role.TenantAdmin],
-    permissions: [],
-  });
-}
-
-Application.run('CreateTenantAdmin', [
-  provideInitializer(bootstrap),
-  provideModules(main),
-]);
-</file>
-
-<file path="tools/create-tenant.ts">
-import '@tstdl/base/polyfills';
-
-import { createInterface } from 'node:readline/promises';
-
-import { Application, provideInitializer, provideModules } from '@tstdl/base/application';
-import { injectManyAsync } from '@tstdl/base/injector';
-import { enumeration } from '@tstdl/base/schema';
-import { timeout } from '@tstdl/base/utils';
-
-import { TenantService } from '#/services/core/index.js';
-import { Country } from '#/shared/models/core/address.model.js';
-import { bootstrap } from '../bootstrap.js';
-
-async function main(): Promise<void> {
-  const [tenantService] = await injectManyAsync(TenantService);
-
-  const rl = createInterface({
-    input: process.stdin,
-    output: process.stdout,
-  });
-
-  console.log('Enter tenant data:');
-  const name = (await rl.question('name: ')).trim();
-  const mail = (await rl.question('mail: ')).trim();
-  const phone = (await rl.question('phone: ')).trim();
-  const street = (await rl.question('street: ')).trim();
-  const houseNumber = (await rl.question('house number: ')).trim();
-  const addition = (await rl.question('addition: ')).trim();
-  const postCode = (await rl.question('post code: ')).trim();
-  const city = (await rl.question('city: ')).trim();
-  const countryCode = (await rl.question('country (de, ch, at): ')).trim();
-
-  const country = enumeration(Country).parse(countryCode.toLowerCase());
-
-  console.log('Creating tenant in 5 seconds');
-
-  await timeout(5000);
-
-  const tenant = await tenantService.insert({
-    name,
-    nameAddition: null,
-    legalName: null,
-    mail,
-    phone: (phone.length == 0) ? null : phone,
-    address: {
-      street,
-      houseNumber,
-      addition,
-      postCode,
-      city,
-      country,
-    },
-  });
-
-  console.log(tenant);
-}
-
-Application.run('CreateTenant', [
-  provideInitializer(bootstrap),
-  provideModules(main),
-]);
-</file>
-
-<file path="tools/reset-password.ts">
-import '@tstdl/base/polyfills';
-
-import { createInterface } from 'node:readline/promises';
-
-import { Application, provideInitializer, provideModules } from '@tstdl/base/application';
-import { AuthenticationService } from '@tstdl/base/authentication/server';
-import { injectManyAsync } from '@tstdl/base/injector';
-
-import { UserService } from '#/services/core/user.service.js';
-import { bootstrap } from '../bootstrap.js';
-
-async function main(): Promise<void> {
-  const [userService, authenticationService] = await injectManyAsync(UserService, AuthenticationService);
-
-  const rl = createInterface({
-    input: process.stdin,
-    output: process.stdout
-  });
-
-  const mail = await rl.question('User mail: ');
-  const password = await rl.question('Password: ');
-  const user = await userService.loadByQuery({ mail });
-
-  await authenticationService.setCredentials(user.id, password);
-}
-
-Application.run('ResetPassword', [
-  provideInitializer(bootstrap),
-  provideModules(main),
-]);
-</file>
-
-<file path="tools/set-super-user.ts">
-import '@tstdl/base/polyfills';
-
-import { createInterface } from 'node:readline/promises';
-
-import { Application, provideInitializer, provideModules } from '@tstdl/base/application';
-import { injectManyAsync } from '@tstdl/base/injector';
-import { EntityRepository } from '@tstdl/base/orm/server';
-import { timeout } from '@tstdl/base/utils';
-
-import { UserService } from '#/services/core/index.js';
-import { SuperUser } from '#/shared/models/core/super-user.model.js';
-import { systemId } from '#/shared/system-id.js';
-import { bootstrap } from '../bootstrap.js';
-
-async function main(): Promise<void> {
-  const [userService, superUserServce] = await injectManyAsync(UserService, [EntityRepository<SuperUser>, SuperUser]);
-
-  const rl = createInterface({
-    input: process.stdin,
-    output: process.stdout,
-  });
-
-  const userIdOrMail = await rl.question('User id/mail: ');
-  const user = userIdOrMail.includes('@') ? await userService.loadByQuery({ mail: userIdOrMail }) : await userService.load(userIdOrMail);
-
-  console.log(`Setting super-user for following user in 5 seconds: ${user.firstName} ${user.lastName} (${user.mail}).`);
-
-  await timeout(5000);
-
-  const superUser = await superUserServce.insert({ userId: user.id, metadata: { attributes: { createUserId: systemId } } });
-
-  console.log(superUser);
-}
-
-Application.run('SetSuperUser', [
-  provideInitializer(bootstrap),
-  provideModules(main),
-]);
-</file>
-
-<file path="app.ts">
-import '@tstdl/base/polyfills';
-
-import { Application, provideInitializer, provideModules } from '@tstdl/base/application';
-import { WebServerModule } from '@tstdl/base/module';
-
-import { bootstrapData } from './bootstrap-data.js';
-import { bootstrap } from './bootstrap.js';
-import { config } from './config.js';
-
-async function main(): Promise<void> {
-  if (config.bootstrapData) {
-    await bootstrapData();
-  }
-}
-
-Application.run('Vitrass', [
-  provideInitializer(bootstrap),
-  provideModules(main, WebServerModule),
-]);
-</file>
-
-<file path="bootstrap-data.ts">
-import { AuthenticationService } from '@tstdl/base/authentication/server';
-import { Singleton, inject, injectAsync } from '@tstdl/base/injector';
-import type { NewEntity } from '@tstdl/base/orm';
-import { injectRepository } from '@tstdl/base/orm/server';
-
-import { TenantService, UserService } from '#/services/core/index.js';
-import { Country, Gender, Role, StaffMemberSettings, SuperUser, Tenant, User, UserRole } from '#/shared/models/core/index.js';
-import { systemId } from '#/shared/system-id.js';
-
-@Singleton()
-class Context {
-  readonly tenantService = inject(TenantService);
-  readonly userService = inject(UserService);
-  readonly authenticationService = inject(AuthenticationService);
-  readonly superUserService = injectRepository(SuperUser);
-  readonly staffMemberSettingsService = injectRepository(StaffMemberSettings);
-};
-
-export async function bootstrapData(): Promise<void> {
-  const context = await injectAsync(Context);
-
-  const tenantsCount = await context.tenantService.count();
-
-  if (tenantsCount > 0) {
-    return;
-  }
-
-  await bootstrapMuster(context);
-}
-
-export async function bootstrapMuster(context: Context): Promise<[User, Tenant]> {
-  const existingUser = await context.userService.tryLoadByQuery({ mail: 'max@mustermann.com' });
-  const existingTenant = await context.tenantService.tryLoadByQuery({ name: 'Muster und Partner' });
-
-  if (existingUser && existingTenant) {
-    return [existingUser, existingTenant];
-  }
-
-  const newUser: NewEntity<User> = {
-    tenantId: null,
-    role: UserRole.StaffMember,
-    mail: 'max@mustermann.com',
-    phone: '+49123456789',
-    firstName: 'Max',
-    lastName: 'Mustermann',
-    gender: Gender.Male,
-    metadata: { attributes: { createUserId: systemId } },
-  };
-
-  const user = existingUser ?? await context.userService.insert(newUser);
-
-  console.log('Bootstrapping Muster und Partner');
-
-  const tenant = existingTenant ?? await context.tenantService.insert({
-    name: 'Muster und Partner',
-    nameAddition: null,
-    legalName: null,
-    mail: 'service@muster-und-partner.de',
-    phone: '+49 1234 56789',
-    address: { street: 'Musterstraße', houseNumber: '1', postCode: '12345', city: 'Musterstadt', addition: null, country: Country.Germany },
-    metadata: { attributes: { createUserId: systemId } },
-  });
-
-  await context.staffMemberSettingsService.insert({ tenantId: tenant.id, userId: user.id, roles: [Role.TenantAdmin], permissions: [], metadata: { attributes: { createUserId: systemId } } });
-  await context.superUserService.insert({ userId: user.id, metadata: { attributes: { createUserId: systemId } } });
-
-  await context.authenticationService.setCredentials(user.id, '!123foobar!');
-
-  return [user, tenant];
-}
-</file>
-
-<file path="bootstrap.ts">
-import { enableProdMode, isDevMode } from '@tstdl/base';
-import { configureAiService } from '@tstdl/base/ai';
-import { configureApiServer } from '@tstdl/base/api/server';
-import { AuthenticationApiController, AuthenticationApiRequestTokenProvider, configureAuthenticationServer, migrateAuthenticationSchema } from '@tstdl/base/authentication/server';
-import { configureDocumentManagement, migrateDocumentManagementSchema } from '@tstdl/base/document-management/server';
-import { configureNodeHttpServer } from '@tstdl/base/http/node';
-import { configureUndiciHttpClientAdapter } from '@tstdl/base/http/undici';
-import { inject, Injector, runInInjectionContext } from '@tstdl/base/injector';
-import { configurePostgresKeyValueStore } from '@tstdl/base/key-value-store/postgres';
-import { configureMail, migrateMailSchema, NodemailerMailClient } from '@tstdl/base/mail';
-import { configureLocalMessageBus } from '@tstdl/base/message-bus';
-import { configureS3ObjectStorage } from '@tstdl/base/object-storage';
-import { configureOrm, Database, migrate } from '@tstdl/base/orm/server';
-import { configurePostgresQueue, migratePostgresQueueSchema } from '@tstdl/base/queue/postgres';
-import { configureDefaultSignalsImplementation } from '@tstdl/base/signals/implementation';
-import { configureTemplates } from '@tstdl/base/templates';
-import { JsxTemplateRenderer, MjmlTemplateRenderer } from '@tstdl/base/templates/renderers';
-import { deriveBytesMultiple, importPbkdf2Key, isDefined, isUndefined, millisecondsPerHour } from '@tstdl/base/utils';
-
-import { PersonApi, TenantApi, UserApi, VitrassDocumentManagementApi } from './api/core/index.js';
-import { config } from './config.js';
-import { VitrassAuthenticationAncillaryService, VitrassDocumentManagementAncillaryService, VitrassDocumentManagementAuthorizationService } from './services/tstdl/index.js';
-import { defaultAccessControlAllowHeaders } from './shared/api/defaults.js';
-import { SECRETS } from './tokens.js';
-
-export async function bootstrap(): Promise<void> {
-  const injector = inject(Injector);
-
-  if (!config.development) {
-    enableProdMode();
-  }
-
-  configureNodeHttpServer();
-  configureUndiciHttpClientAdapter();
-  configurePostgresKeyValueStore();
-  configurePostgresQueue();
-  configureLocalMessageBus();
-  configureDefaultSignalsImplementation();
-
-  configureAuthenticationServer({
-    authenticationAncillaryService: VitrassAuthenticationAncillaryService,
-    serviceOptions: {
-      useFactory: (_, context) => {
-        const { tokenSigningSecret, refreshTokenSigningSecret, secretResetTokenSigningSecret } = context.resolve(SECRETS);
-
-        return {
-          secret: { tokenSigningSecret, refreshTokenSigningSecret, secretResetTokenSigningSecret },
-          tokenTimeToLive: isDevMode() ? (10 * millisecondsPerHour) : undefined,
-        };
-      },
-    },
-  });
-
-  configureS3ObjectStorage({
-    endpoint: config.s3.endpoint,
-    bucket: config.s3.bucket,
-    bucketPerModule: config.s3.bucketPerModule,
-    accessKey: config.s3.accessKey,
-    secretKey: config.s3.secretKey,
-  });
-
-  configureTemplates({
-    templateRenderers: [JsxTemplateRenderer, MjmlTemplateRenderer],
-  });
-
-  configureDocumentManagement({
-    ancillaryService: VitrassDocumentManagementAncillaryService,
-    authorizationService: VitrassDocumentManagementAuthorizationService,
-    fileObjectStorageModule: 'document-files',
-    fileUploadObjectStorageModule: 'document-uploads',
-    filePreviewObjectStorageModule: 'document-previews',
-  });
-
-  configureMail({
-    client: NodemailerMailClient,
-    defaultClientConfig: {
-      host: config.mail.host,
-      port: config.mail.port,
-      auth: (isUndefined(config.mail.user) || isUndefined(config.mail.password))
-        ? undefined
-        : {
-          user: config.mail.user,
-          password: config.mail.password,
-        },
-    },
-    defaultData: {
-      from: config.mail.from,
-    },
-  });
-
-  configureAiService({
-    apiKey: config.ai.apiKey,
-    keyFile: config.ai.keyFile,
-    vertex: isDefined(config.ai.vertex.project) && isDefined(config.ai.vertex.location)
-      ? {
-        project: config.ai.vertex.project,
-        location: config.ai.vertex.location,
-        bucket: 'vitrass-document-processing',
-      }
-      : undefined,
-  });
-
-  /** Secrets */
-
-  const key = await importPbkdf2Key(config.deploymentSecret);
-  const algorithm = { name: 'PBKDF2', hash: 'SHA-512', iterations: 500000, salt: new Uint8Array() };
-  const [tokenSigningSecret, refreshTokenSigningSecret, secretResetTokenSigningSecret, databaseEncryptionSecret] = await deriveBytesMultiple(algorithm, key, [64, 64, 64, 32]);
-
-  Injector.registerSingleton(SECRETS, { useValue: { tokenSigningSecret, refreshTokenSigningSecret, secretResetTokenSigningSecret, databaseEncryptionSecret } });
-
-  configureOrm({
-    connection: {
-      host: config.database.host,
-      port: config.database.port,
-      user: config.database.user,
-      password: config.database.pass,
-      database: config.database.database,
-    },
-    repositoryConfig: { schema: 'vitrass' },
-    encryptionSecret: databaseEncryptionSecret,
-  });
-
-  await runInInjectionContext(injector, migrateAuthenticationSchema);
-  await runInInjectionContext(injector, migrateDocumentManagementSchema);
-  await runInInjectionContext(injector, migratePostgresQueueSchema);
-  await runInInjectionContext(injector, migrateMailSchema);
-  await runInInjectionContext(injector, migrateSchema);
-
-  configureApiServer({
-    controllers: [AuthenticationApiController, UserApi, PersonApi, TenantApi, VitrassDocumentManagementApi],
-    requestTokenProvider: AuthenticationApiRequestTokenProvider,
-    gatewayOptions: {
-      prefix: null,
-      cors: {
-        default: {
-          autoAccessControlAllowOrigin: [...config.appUrl],
-          accessControlAllowHeaders: defaultAccessControlAllowHeaders,
-        },
-      },
-    },
-  });
-}
-
-async function migrateSchema(): Promise<void> {
-  const database = inject(Database);
-
-  await migrate(
-    database,
-    {
-      migrationsSchema: 'vitrass',
-      migrationsTable: '_migrations',
-      migrationsFolder: import.meta.resolve('./drizzle').replace('file://', ''),
-    }
-  );
-}
-</file>
-
-<file path="config.ts">
-import { LogLevel } from '@tstdl/base/logger';
-import { boolean, positiveInteger, string } from '@tstdl/base/utils';
-
-export const config = {
-  development: boolean('DEVELOPMENT', false),
-  verbosity: positiveInteger('VERBOSITY', LogLevel.Trace) as LogLevel,
-  deploymentSecret: string('DEPLOYMENT_SECRET', 'DEBUGSECRET'),
-  bootstrapData: boolean('BOOTSTRAP_DATA', false),
-  database: {
-    host: string('DATABASE_HOST', '127.0.0.1'),
-    port: positiveInteger('DATABASE_PORT', 5432),
-    user: string('DATABASE_USER', 'vitrass'),
-    pass: string('DATABASE_PASS', '6zv7edvqv9vvzz6u4kuk'),
-    database: string('DATABASE_NAME', 'vitrass'),
-  },
-  ai: {
-    apiKey: string('AI_API_KEY', '---'),
-    keyFile: string('AI_API_KEY_FILE', undefined),
-    vertex: {
-      project: string('AI_VERTEX_PROJECT', undefined),
-      location: string('AI_VERTEX_LOCATION', undefined),
-    },
-  },
-  s3: {
-    endpoint: string('S3_ENDPOINT', 'http://localhost:9000'),
-    accessKey: string('S3_ACCESS_KEY', 'vitrass-dev'),
-    secretKey: string('S3_SECRET_KEY', 'vitrass-dev'),
-    bucket: string('S3_BUCKET', undefined),
-    bucketPerModule: boolean('S3_BUCKET_PER_MODULE', true),
-  },
-  appUrl: string('APP_URL', 'http://localhost:4200').split(',').map((url) => url.trim()),
-  mail: {
-    host: string('MAIL_HOST', '127.0.0.1'),
-    port: positiveInteger('MAIL_PORT', 25),
-    user: string('MAIL_USER', undefined),
-    password: string('MAIL_PASS', undefined),
-    from: string('MAIL_FROM', undefined),
-  },
-};
-
-if (config.deploymentSecret == 'DEBUGSECRET') {
-  console.warn('!!! DEPLOYMENT_SECRET NOT SET !!!');
-}
-</file>
-
-<file path="drizzle.config.ts">
-import { relative, resolve } from 'node:path';
-
-import { defineConfig } from 'drizzle-kit';
-import { config } from './config.js';
-
-export default defineConfig({
-  dialect: 'postgresql',
-  out: relative('./', resolve(__dirname, './drizzle/').replace('dist', 'source')),
-  schema: resolve(__dirname, './schemas.js'),
-  schemaFilter: ['vitrass'],
-  dbCredentials: {
-    host: config.database.host,
-    port: config.database.port,
-    user: config.database.user,
-    password: config.database.pass,
-    database: config.database.database,
-    ssl: false
-  },
-  migrations: {
-    schema: 'vitrass',
-    table: '_migrations'
-  },
-  introspect: {
-    casing: 'camel'
-  }
-});
-</file>
-
-<file path="keys.ts">
-export const objectStorageKeys = {
-  deviceImages: 'device-images'
-};
-</file>
-
-<file path="schemas.ts">
-import { databaseSchema } from '@tstdl/base/orm/server';
-
-import { Country, DocumentCollectionMapping, Gender, Permission, Person, Role, StaffMemberSettings, SuperUser, Tenant, User, UserRole } from './shared/models/core/index.js';
-
-export const schema = databaseSchema('vitrass');
-
-export const country = schema.getEnum(Country);
-export const gender = schema.getEnum(Gender);
-export const permission = schema.getEnum(Permission);
-export const role = schema.getEnum(Role);
-export const userRole = schema.getEnum(UserRole);
-
-export const documentCollectionMapping = schema.getTable(DocumentCollectionMapping);
-export const person = schema.getTable(Person);
-export const staffMemberSettings = schema.getTable(StaffMemberSettings);
-export const superUser = schema.getTable(SuperUser);
-export const tenant = schema.getTable(Tenant);
-export const user = schema.getTable(User);
-</file>
-
-<file path="tokens.ts">
-import { injectionToken } from '@tstdl/base/injector';
-
-type Secrets = {
-  tokenSigningSecret: Uint8Array<ArrayBuffer>,
-  refreshTokenSigningSecret: Uint8Array<ArrayBuffer>,
-  secretResetTokenSigningSecret: Uint8Array<ArrayBuffer>,
-  databaseEncryptionSecret: Uint8Array<ArrayBuffer>,
-};
-
-export const SECRETS = injectionToken<Secrets>('SECRETS');
-</file>
-
-<file path="types.ts">
-import '@tstdl/base/templates/types';
-</file>
-
-</files>