@wtfalch/foundry 0.71.0 → 0.72.0

package/dist/plan/zitadel-machine-user.js

@@ -86,6 +86,14 @@ export class ZitadelLoginClientRoleConflictError extends Error {
 }
 /** The read-only organisation role a directory reader holds. It lists the organisation's users and changes nothing. */
 export const ORG_DIRECTORY_READER_ROLE = 'ORG_OWNER_VIEWER';
+/**
+ * Boule removes a customer with this credential (boule#495). ZITADEL's narrowest built-in organisation role
+ * that holds `user.delete` is `ORG_USER_MANAGER`; it cannot be cut down to delete alone (it also lets the
+ * holder change users in that organisation). It is granted in the customers organisation only, never in the
+ * company's.
+ */
+export const ORG_DIRECTORY_USER_MANAGER_ROLE = 'ORG_USER_MANAGER';
+const ORG_DIRECTORY_ROLES = [ORG_DIRECTORY_READER_ROLE, ORG_DIRECTORY_USER_MANAGER_ROLE];
 /**
  * C3: thrown by `mintOrgDirectoryReader` when the user already exists with an organisation role other
  * than the read-only one. That user was not made by foundry; granting it more or handing out its PAT
@@ -95,12 +103,20 @@ export class ZitadelDirectoryRoleConflictError extends Error {
     userId;
     roles;
     constructor(userId, roles) {
-        super(`ZITADEL machine user ${userId} already exists with organisation role(s) [${roles.join(', ') || 'none'}], not only [${ORG_DIRECTORY_READER_ROLE}] -- refusing to reuse it as a directory reader`);
+        super(`ZITADEL machine user ${userId} already exists with organisation role(s) [${roles.join(', ') || 'none'}], not only [${ORG_DIRECTORY_ROLES.join(', ')}] -- refusing to reuse it as a directory reader`);
         this.userId = userId;
         this.roles = roles;
         this.name = 'ZitadelDirectoryRoleConflictError';
     }
 }
+/** Each call to ZITADEL gives up after this long. */
+const CALL_TIMEOUT_MS = 30_000;
+/**
+ * The organisation role of the broker's registrar user in each organisation it serves: it may make
+ * projects there, and a project it makes it owns. No member, user or login-policy rights, which
+ * `ORG_OWNER` would add.
+ */
+export const REGISTRAR_ROLE = 'ORG_PROJECT_CREATOR';
 export function createZitadelAdminMinter(options) {
     const fetchImpl = options.fetchImpl ?? globalThis.fetch;
     async function call(method, path, body, orgId) {
@@ -119,6 +135,7 @@ export function createZitadelAdminMinter(options) {
                 ...(orgId ? { 'x-zitadel-orgid': orgId } : {}),
             },
             body: body === undefined ? undefined : JSON.stringify(body),
+            signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
         });
         const text = await response.text();
         let data = {};
@@ -306,21 +323,12 @@ export function createZitadelAdminMinter(options) {
         if (!userId)
             throw new Error('ZITADEL did not return the machine user id');
         if (existing) {
-            const members = await call('POST', '/management/v1/orgs/me/members/_search', { queries: [{ userIdQuery: { userId } }] }, orgId);
-            const roles = (members.result ?? [])
-                .filter((m) => m.userId === userId)
-                .flatMap((m) => m.roles ?? []);
-            if (roles.some((role) => role !== ORG_DIRECTORY_READER_ROLE)) {
+            const roles = await memberRoles(orgId, userId);
+            if (roles.some((role) => !ORG_DIRECTORY_ROLES.includes(role))) {
                 throw new ZitadelDirectoryRoleConflictError(userId, roles);
             }
         }
-        try {
-            await call('POST', '/management/v1/orgs/me/members', { userId, roles: [ORG_DIRECTORY_READER_ROLE] }, orgId);
-        }
-        catch (e) {
-            if (!(e instanceof ZitadelHttpError && e.status === 409))
-                throw e;
-        }
+        await ensureOrgDirectoryRoles(orgId, userId);
         await revokeAllPats(orgId, userId);
         const pat = await call('POST', `/management/v1/users/${userId}/pats`, {}, orgId);
         const patId = typeof pat.tokenId === 'string' && pat.tokenId !== '' ? pat.tokenId : undefined;
@@ -329,6 +337,78 @@ export function createZitadelAdminMinter(options) {
         }
         return { userId, token: pat.token, patId };
     }
+    /**
+     * The broker's registrar user: a machine user of its own in `orgIds[0]` (found by `userName`, else made)
+     * holding {@link REGISTRAR_ROLE} in every org of `orgIds`, each grant added only when the org does not
+     * have it yet (a 409 is the same). Mints no token, so it is safe to repeat whenever an org joins the
+     * list. Calls follow ZITADEL's published v1 management API and have not been run against a live
+     * instance.
+     */
+    async function ensureRegistrarUser(orgIds, input) {
+        const home = orgIds[0];
+        if (!home)
+            throw new Error('the registrar user needs at least one organisation');
+        const found = await call('POST', '/management/v1/users/_search', {
+            queries: [
+                { userNameQuery: { userName: input.userName, method: 'TEXT_QUERY_METHOD_EQUALS' } },
+            ],
+        }, home);
+        let userId = found.result?.[0]?.id;
+        if (!userId) {
+            const created = await call('POST', '/management/v1/users/machine', {
+                userName: input.userName,
+                name: input.name,
+                accessTokenType: 'ACCESS_TOKEN_TYPE_BEARER',
+            }, home);
+            userId = typeof created.userId === 'string' ? created.userId : undefined;
+        }
+        if (!userId)
+            throw new Error('ZITADEL did not return the machine user id');
+        for (const orgId of new Set(orgIds)) {
+            try {
+                await call('POST', '/management/v1/orgs/me/members', { userId, roles: [REGISTRAR_ROLE] }, orgId);
+            }
+            catch (e) {
+                if (!(e instanceof ZitadelHttpError && e.status === 409))
+                    throw e;
+            }
+        }
+        return { userId };
+    }
+    /** A fresh token for the registrar user; every token it holds is revoked first, so one stays live. */
+    async function mintRegistrarToken(homeOrgId, userId) {
+        await revokeAllPats(homeOrgId, userId);
+        const pat = await call('POST', `/management/v1/users/${userId}/pats`, {}, homeOrgId);
+        const patId = typeof pat.tokenId === 'string' && pat.tokenId !== '' ? pat.tokenId : undefined;
+        if (typeof pat.token !== 'string' || pat.token === '' || !patId) {
+            throw new Error(`ZITADEL returned no token for machine user ${userId}`);
+        }
+        return { token: pat.token, patId };
+    }
+    /**
+     * The directory user's roles in one organisation: {@link ORG_DIRECTORY_ROLES}, set whether it is a member
+     * yet or not (a 409 on the add means it is, and the roles are then replaced with a `PUT`). Calls follow
+     * ZITADEL's published v1 management API and have not been run against a live instance.
+     */
+    async function ensureOrgDirectoryRoles(orgId, userId) {
+        try {
+            await call('POST', '/management/v1/orgs/me/members', { userId, roles: ORG_DIRECTORY_ROLES }, orgId);
+        }
+        catch (e) {
+            if (!(e instanceof ZitadelHttpError && e.status === 409))
+                throw e;
+            // The PUT replaces every role, so the roles a person added stay: ours join the existing set.
+            const existing = await memberRoles(orgId, userId);
+            await call('PUT', `/management/v1/orgs/me/members/${userId}`, { roles: [...existing, ...ORG_DIRECTORY_ROLES.filter((r) => !existing.includes(r))] }, orgId);
+        }
+    }
+    /** The organisation roles one user holds in an organisation. */
+    async function memberRoles(orgId, userId) {
+        const members = await call('POST', '/management/v1/orgs/me/members/_search', { queries: [{ userIdQuery: { userId } }] }, orgId);
+        return (members.result ?? [])
+            .filter((m) => m.userId === userId)
+            .flatMap((m) => m.roles ?? []);
+    }
     /** Deletes every PAT of a user; a PAT already gone (404) is the outcome wanted. */
     async function revokeAllPats(orgId, userId) {
         for (const patId of await listPats(orgId, userId)) {
@@ -342,7 +422,10 @@ export function createZitadelAdminMinter(options) {
         }
     }
     return {
+        ensureRegistrarUser,
+        mintRegistrarToken,
         mintOrgDirectoryReader,
+        ensureOrgDirectoryRoles,
         revokeOrgDirectoryReader: revokeAllPats,
         mintAdminMachineUser: (orgId, input) => mintMachineUser(orgId, input, 'IAM_OWNER').then(({ userId, token }) => ({ userId, token })),
         mintLoginClientMachineUser: (orgId, input) => mintMachineUser(orgId, input, 'IAM_LOGIN_CLIENT'),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.71.0",
+  "version": "0.72.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -54,7 +54,7 @@
     "status": "node scripts/status.mjs"
   },
   "peerDependencies": {
-    "@wtfalch/providers": ">=0.12.0",
+    "@wtfalch/providers": ">=0.16.0",
     "drizzle-orm": ">=0.45.2"
   },
   "dependencies": {
@@ -63,7 +63,7 @@
     "@wtfalch/auth": "^0.26.0",
     "@wtfalch/edge": "0.23.0",
     "@wtfalch/email": "^0.20.0",
-    "@wtfalch/providers": "0.12.0",
+    "@wtfalch/providers": "0.16.0",
     "bcryptjs": "3.0.3",
     "ssh2": "1.17.0",
     "zod": "4.6.5"