alepha 0.19.3 → 0.19.4

package/dist/api/invitations/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/api/invitations/entities/invitations.ts","../../../src/orm/core/schemas/insertSchema.ts","../../../src/orm/core/schemas/updateSchema.ts","../../../src/orm/core/primitives/$entity.ts","../../../src/orm/core/constants/PG_SYMBOLS.ts","../../../src/orm/core/helpers/pgAttr.ts","../../../src/orm/core/schemas/databaseEnvSchema.ts","../../../src/api/invitations/providers/InvitationProvider.ts","../../../src/api/invitations/schemas/createInvitationSchema.ts","../../../src/api/invitations/schemas/invitationQuerySchema.ts","../../../src/api/invitations/schemas/invitationWithResourceInfoSchema.ts","../../../src/api/invitations/schemas/myInvitationsQuerySchema.ts","../../../src/api/invitations/services/InvitationService.ts","../../../src/api/invitations/controllers/AdminInvitationController.ts","../../../src/api/invitations/controllers/InvitationController.ts","../../../src/api/invitations/jobs/InvitationJobs.ts","../../../src/api/invitations/schemas/invitationConfigAtom.ts","../../../src/api/invitations/schemas/invitationResourceSchema.ts","../../../src/api/invitations/index.ts"],"mappings":";;;;;;;;;;;;;cAIa,WAAA,EAAW,aAAA,CAAA,eAAA,UAAA,OAAA;gDA0BtB,QAAA,CAAA,OAAA;;;;;;;;;;;;;;;;KAEU,gBAAA,GAAmB,MAAA,QAAc,WAAA,CAAY,MAAA;;;;;;;;;;;;KCnB7C,aAAA,WAAwB,OAAA,IAAW,OAAA,eACjC,CAAA,kBAAmB,CAAA,eAAgB,CAAA;EAAA,CAC5C,YAAA;AAAA,YAGC,CAAA,GAAI,CAAA,eAAgB,CAAA;EAAA,CACjB,UAAA;AAAA;EACD,WAAA;AAAA,IACF,SAAA,CAAU,CAAA,eAAgB,CAAA,KAC1B,CAAA,eAAgB,CAAA;;;;;;;;;;;;KCJV,aAAA,WAAwB,OAAA,IAAW,OAAA,eACjC,CAAA,kBAAmB,CAAA,eAAgB,CAAA;EAAA,CAC5C,YAAA;AAAA,YAGC,CAAA,GAAI,CAAA,eAAgB,CAAA,UAAW,SAAA,YAC/B,SAAA,CAAU,MAAA,EAAQ,CAAA,EAAG,KAAA,MACrB,CAAA,eAAgB,CAAA;;;UCWL,sBAAA,WACL,OAAA,eACG,MAAA,CAAO,CAAA;;;;;EAMpB,IAAA;;;;EAKA,MAAA,EAAQ,CAAA;;;;EAKR,OAAA,IACI,IAAA;;;;IAKE,MAAA,EAAQ,IAAA;;;;IAIR,MAAA;;;;IAIA,IAAA;;;;IAIA,KAAA,GAAQ,GAAA;EAAA;;;;IAMR,OAAA,EAAS,IAAA;;;;IAIT,MAAA;;;;IAIA,IAAA;IHlFgB;;;IGsFhB,KAAA,GAAQ,GAAA;EAAA;;;;;;;;;;;;;;;;;IAmBR,WAAA,GAAc,IAAA,EAAM,MAAA,CAAO,IAAA,qBAAyB,GAAA;;;;IAIpD,MAAA;;;;IAIA,IAAA;;;;IAIA,KAAA,GAAQ,GAAA;EAAA;;;;EAOd,WAAA,GAAc,KAAA;;;;IAIZ,IAAA;;;;IAIA,OAAA,EAAS,KAAA,OAAY,MAAA,CAAO,CAAA;;;;;IAK5B,cAAA,EAAgB,KAAA,OAAY,YAAA;EAAA;;;;;;;;AH7GhC;;;;;;;;;;;;ACnBA;;;;;;;;;;;;EEkKE,WAAA,GAAc,KAAA;IF1JgB;;;IE8J5B,OAAA,EAAS,KAAA,OAAY,MAAA,CAAO,CAAA;IFtKe;;;IE0K3C,IAAA;IF1KgC;;;IE8KhC,MAAA;IF7K6B;;;IEiL7B,KAAA,GAAQ,GAAA;EAAA;EF7Kc;;;EEmLxB,MAAA,IACE,IAAA,EAAM,uBAAA,SAAgC,UAAA,CAAW,CAAA,aAC9C,uBAAA;AAAA;AAAA,cAKM,eAAA,WAA0B,OAAA,GAAU,OAAA;EAAA,SAC/B,OAAA,EAAS,sBAAA,CAAuB,CAAA;cAEpC,OAAA,EAAS,sBAAA,CAAuB,CAAA;EAI5C,KAAA,CAAM,KAAA;EAAA,IAYF,IAAA,CAAA,GAAQ,aAAA,CAAc,CAAA;EAAA,IActB,IAAA,CAAA;EAAA,IAIA,MAAA,CAAA,GAAU,CAAA;EAAA,IAIV,YAAA,CAAA,GAAgB,aAAA,CAAc,CAAA;EAAA,IAI9B,YAAA,CAAA,GAAgB,aAAA,CAAc,CAAA;AAAA;;;;KAYxB,UAAA,WAAqB,OAAA,oBACjB,CAAA,iBAAkB,mBAAA;AAAA,KAYtB,YAAA,WAAuB,OAAA;EACjC,IAAA;EACA,MAAA,EAAQ,eAAA,CAAgB,CAAA;AAAA;AAAA,KAGd,aAAA,WAAwB,OAAA,oBACpB,CAAA,iBAAkB,YAAA,CAAa,CAAA;;;cCjRlC,UAAA;AAAA,cACA,cAAA;AAAA,cACA,aAAA;AAAA,cACA,aAAA;AAAA,cACA,aAAA;AAAA,cACA,UAAA;AAAA,cACA,WAAA;AAAA,cACA,OAAA;AAAA,cACA,MAAA;AAAA,cACA,YAAA;AAAA,cACA,eAAA;;;;cAKA,SAAA;AAAA,KAMD,SAAA;EAAA,CACT,UAAA;EAAA,CACA,cAAA;EAAA,CACA,aAAA;EAAA,CACA,aAAA;EAAA,CACA,aAAA;EAAA,CACA,UAAA;EAAA,CACA,WAAA,GAAc,iBAAA;EAAA,CACd,MAAA,GAAS,YAAA;EAAA,CACT,OAAA,GAAU,aAAA;EAAA,CACV,YAAA,GAAe,kBAAA;EAAA,CACf,eAAA;;;;GAKA,SAAA;AAAA;AAAA,KAGS,YAAA,SAAqB,SAAA;AAAA,KAErB,iBAAA;EACV,IAAA;AAAA,IACE,iBAAA;EACA,IAAA;AAAA;AAAA,UAGa,aAAA;EACf,IAAA;EACA,WAAA;AAAA;AAAA,UAGe,kBAAA;;;;EAIf,UAAA,EAAY,GAAA;;;;;;EAOZ,IAAA;AAAA;AAAA,UAGe,YAAA;EACf,GAAA;IACE,IAAA;IACA,MAAA,EAAQ,eAAA;EAAA;EAEV,OAAA;IACE,QAAA,GAAW,kBAAA;IACX,QAAA,GAAW,kBAAA;EAAA;AAAA;;;AJ7Ef;;;AAAA,KKiDY,MAAA,WAAiB,OAAA,gBAAuB,YAAA,IAAgB,CAAA,WAC5D,KAAA,GAAQ,SAAA,CAAU,CAAA;;;;;;;;;;;;;;;;cCvCb,iBAAA,WAAiB,OAAA;mCAW5B,QAAA,CAAA,OAAA;;;;;;;ANtBF;;;;YMyBY,GAAA,SAAY,OAAA,CAAQ,MAAA,QAAc,iBAAA;AAAA;;;;;;;uBCvBxB,kBAAA;;;;;WAKX,gBAAA,CACP,YAAA,UACA,UAAA,UACA,OAAA;IAAW,EAAA;IAAY,KAAA;EAAA,IACtB,OAAA;;;;;WAMM,QAAA,CACP,YAAA,UACA,UAAA,UACA,KAAA,UACA,MAAA,YACC,OAAA;;;;APtBL;WO4BW,QAAA,CACP,UAAA,EAAY,gBAAA,EACZ,UAAA;IAAc,EAAA;IAAY,KAAA;EAAA,IACzB,OAAA;;;;WAKM,eAAA,CACP,YAAA,UACA,UAAA,WACC,OAAA;IAAU,IAAA;IAAc,WAAA;IAAsB,GAAA;EAAA;AAAA;;;cCxCtC,sBAAA,WAAsB,OAAA;SAMjC,QAAA,CAAA,OAAA;;;;;;KAEU,gBAAA,GAAmB,MAAA,QAAc,sBAAA;;;cCPhC,qBAAA,WAAqB,OAAA;2BAQhC,QAAA,CAAA,QAAA;;;;;;;;;KAEU,eAAA,GAAkB,MAAA,QAAc,qBAAA;;;cCX/B,gCAAA,WAAgC,OAAA;MAc3C,QAAA,CAAA,OAAA;;;;;;;;;;;;;;KAEU,0BAAA,GAA6B,MAAA,QAChC,gCAAA;;;cCjBI,wBAAA,WAAwB,OAAA;6BAInC,QAAA,CAAA,OAAA;AAAA;AAAA,KAEU,kBAAA,GAAqB,MAAA,QAAc,wBAAA;;;cCMlC,iBAAA;EAAA,mBACQ,MAAA,EAAM,MAAA;EAAA,mBACN,GAAA,EADM,gBAAA,CACH,MAAA;EAAA,mBACH,IAAA,EAAI,aAAA,CAAA,UAAA,UAAA,OAAA;kDADD,QAAA,CAAA,OAAA;;;;;;;;;;;;;;;;qBAEH,KAAA,EAAK,aAAA,CAAA,UAAA,UAAA,OAAA;kDADD,QAAA,CAAA,OAAA;;;;;;;;;;;;;;;;qBAEJ,MAAA,EAAM,cAAA;EAAA,mBACN,QAAA,EAAQ,gBAAA;EAAA,mBACR,QAAA,EAAQ,kBAAA;;;;EAOd,OAAA,CAAQ,EAAA,WAAa,OAAA,CAAQ,gBAAA;;;;EAS7B,MAAA,CACX,IAAA,EAAM,gBAAA,EACN,OAAA;IAAW,EAAA;IAAY,KAAA;EAAA,IACtB,OAAA,CAAQ,gBAAA;;;;EA6GE,MAAA,CACX,YAAA,UACA,UAAA;IAAc,EAAA;IAAY,KAAA;EAAA,IACzB,OAAA;EZrJmB;;;EY6NT,OAAA,CACX,YAAA,UACA,UAAA;IAAc,EAAA;IAAY,KAAA;EAAA,IACzB,OAAA;;;;EAwCU,MAAA,CACX,YAAA,UACA,SAAA;IAAa,EAAA;EAAA,IACZ,OAAA;;;;EAoCU,WAAA,CACX,KAAA,UACA,KAAA,GAAO,kBAAA,GACN,OAAA,CAAQ,0BAAA;;;;EAgEE,cAAA,CACX,YAAA,UACA,UAAA,UACA,MAAA,YACC,OAAA,CAAQ,gBAAA;;;;EAoBE,eAAA,CACX,KAAA,GAAO,eAAA,GACN,OAAA,CAAQ,IAAA,CAAK,gBAAA;;;;EAiCH,gBAAA,CAAiB,EAAA,WAAa,OAAA;;;;;EAoB9B,aAAA,CAAA,GAAiB,OAAA;;;;;EAyCjB,aAAA,CAAA,GAAiB,OAAA;;;;YA6Bd,YAAA,CACd,GAAA,aACC,OAAA,CAAQ,GAAA,SAAY,UAAA;;;;YAeb,iBAAA,CAAkB,IAAA,GAAO,UAAA;AAAA;;;cCrhBxB,yBAAA;EAAA,mBACQ,GAAA;EAAA,mBACA,KAAA;EAAA,mBACA,iBAAA,EAAiB,iBAAA;;;;WAKpB,eAAA,mBAAe,iBAAA;;+BALK,QAAA,CAAA,QAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WAoBpB,aAAA,mBAAa,iBAAA;;UAfE,QAAA,CAAA,OAAA;IAAA;;;;;;;;;;;;;;;;;;;;;;WAgCf,gBAAA,mBAAgB,iBAAA;;UAjBH,QAAA,CAAA,OAAA;IAAA;;;;;;;;;;WAsCb,gBAAA,mBAAgB,iBAAA;;UArBA,QAAA,CAAA,OAAA;IAAA;;;;;;;;;;cCtCrB,oBAAA;EAAA,mBACQ,GAAA;EAAA,mBACA,KAAA;EAAA,mBACA,iBAAA,EAAiB,iBAAA;;;;WAKpB,gBAAA,mBAAgB,iBAAA;;aALI,QAAA,CAAA,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;WAqBpB,gBAAA,mBAAgB,iBAAA;;iCAhBA,QAAA,CAAA,OAAA;IAAA;;;;;;;;;;;;;;;;;;;;WAgChB,gBAAA,mBAAgB,iBAAA;;UAhBA,QAAA,CAAA,OAAA;IAAA;;;;;;;Ed7BV;;;EAAA,ScgEN,iBAAA,mBAAiB,iBAAA;;UAnBD,QAAA,CAAA,OAAA;IAAA;;;;;;;;;;cC5CrB,cAAA;EAAA,mBACQ,GAAA,EADM,gBAAA,CACH,MAAA;EAAA,mBACH,iBAAA,EAAiB,iBAAA;;;;WAKpB,iBAAA,EAAiB,kBAAA,CAAA,YAAA,CALG,QAAA,CAKH,OAAA;;;;WAcjB,gBAAA,EAAgB,kBAAA,CAAA,YAAA,CAdC,QAAA,CAcD,OAAA;AAAA;;;cCxBrB,oBAAA,EAAoB,QAAA,CAAA,IAAA,UAAA,OAAA;kBAiB/B,QAAA,CAAA,QAAA;;;;;;;cChBW,wBAAA,WAAwB,OAAA;oBAAqB,QAAA,CAAA,OAAA;;;;;;;;;;;;;;;;KAE9C,kBAAA,GAAqB,MAAA,QAAc,wBAAA;;;;YCenC,KAAA;IACR,oBAAA;MACE,UAAA,EAL0C,gBAAA;MAM1C,KAAA;MACA,OAAA;QAAW,EAAA;QAAY,KAAA;MAAA;IAAA;IAEzB,qBAAA;MACE,UAAA,EALgE,gBAAA;MAMhE,UAAA;QAAc,EAAA;QAAY,KAAA;MAAA;IAAA;IAE5B,qBAAA;MACE,UAAA,EAJgE,gBAAA;MAKhE,UAAA;QAAc,EAAA;QAAY,KAAA;MAAA;IAAA;IAE5B,oBAAA;MACE,UAAA,EAJgE,gBAAA;IAAA;IAMlE,oBAAA;MACE,UAAA,EAHgE,gBAAA;MAIhE,SAAA;QAAa,EAAA;MAAA;IAAA;EAAA;AAAA;;;;;;cAUN,oBAAA,EAAoB,QAAA,CAAA,OAAA,CAe/B,QAAA,CAf+B,MAAA"}

package/dist/api/invitations/index.js

@@ -0,0 +1,665 @@
+import { $atom, $inject, $module, Alepha, t } from "alepha";
+import { $secure } from "alepha/security";
+import { $action, BadRequestError, ForbiddenError, okSchema } from "alepha/server";
+import { $entity, $repository, db, pageQuerySchema } from "alepha/orm";
+import { users } from "alepha/api/users";
+import { CryptoProvider } from "alepha/crypto";
+import { DateTimeProvider } from "alepha/datetime";
+import { $logger } from "alepha/logger";
+import { $job } from "alepha/api/jobs";
+//#region ../../src/api/invitations/schemas/invitationQuerySchema.ts
+const invitationQuerySchema = t.extend(pageQuerySchema, {
+	email: t.optional(t.text({ description: "Filter by invited email" })),
+	resourceType: t.optional(t.text({ description: "Filter by resource type" })),
+	resourceId: t.optional(t.text({ description: "Filter by resource ID" })),
+	status: t.optional(t.enum([
+		"pending",
+		"accepted",
+		"declined",
+		"expired",
+		"revoked"
+	])),
+	invitedBy: t.optional(t.uuid())
+});
+//#endregion
+//#region ../../src/api/invitations/entities/invitations.ts
+const invitations = $entity({
+	name: "invitations",
+	schema: t.object({
+		id: db.primaryKey(t.uuid()),
+		version: db.version(),
+		createdAt: db.createdAt(),
+		updatedAt: db.updatedAt(),
+		invitedBy: db.ref(t.uuid(), () => users.cols.id, { onDelete: "cascade" }),
+		email: t.string({ format: "email" }),
+		resourceType: t.text({
+			minLength: 1,
+			maxLength: 100
+		}),
+		resourceId: t.text({
+			minLength: 1,
+			maxLength: 255
+		}),
+		status: t.enum([
+			"pending",
+			"accepted",
+			"declined",
+			"expired",
+			"revoked"
+		]),
+		roles: t.optional(t.array(t.text())),
+		metadata: t.optional(t.record(t.text(), t.any())),
+		token: t.text(),
+		expiresAt: t.datetime(),
+		resolvedAt: t.optional(t.datetime()),
+		resolvedBy: t.optional(db.ref(t.uuid(), () => users.cols.id))
+	}),
+	indexes: [
+		{ columns: ["email", "status"] },
+		{ columns: [
+			"resourceType",
+			"resourceId",
+			"email",
+			"status"
+		] },
+		{ columns: ["invitedBy"] },
+		{ columns: ["expiresAt"] },
+		{
+			columns: ["token"],
+			unique: true
+		}
+	]
+});
+//#endregion
+//#region ../../src/api/invitations/schemas/invitationResourceSchema.ts
+const invitationResourceSchema = invitations.schema;
+//#endregion
+//#region ../../src/api/invitations/providers/InvitationProvider.ts
+/**
+* Abstract provider that apps implement to customize invitation behavior
+* per resource type.
+*/
+var InvitationProvider = class {};
+//#endregion
+//#region ../../src/api/invitations/schemas/invitationConfigAtom.ts
+const invitationConfigAtom = $atom({
+	name: "alepha.api.invitations.config",
+	schema: t.object({
+		expirationDays: t.integer({
+			minimum: 1,
+			maximum: 90
+		}),
+		maxPendingPerResource: t.integer({
+			minimum: 1,
+			maximum: 500
+		}),
+		maxPendingPerInviter: t.integer({
+			minimum: 1,
+			maximum: 1e3
+		}),
+		purgeDays: t.integer({
+			minimum: 0,
+			maximum: 365
+		})
+	}),
+	default: {
+		expirationDays: 7,
+		maxPendingPerResource: 50,
+		maxPendingPerInviter: 100,
+		purgeDays: 90
+	}
+});
+//#endregion
+//#region ../../src/api/invitations/services/InvitationService.ts
+var InvitationService = class {
+	alepha = $inject(Alepha);
+	log = $logger();
+	repo = $repository(invitations);
+	users = $repository(users);
+	crypto = $inject(CryptoProvider);
+	dateTime = $inject(DateTimeProvider);
+	provider = $inject(InvitationProvider);
+	/**
+	* Get an invitation by ID.
+	*/
+	async getById(id) {
+		return this.repo.getById(id);
+	}
+	/**
+	* Create a new invitation.
+	*/
+	async create(data, inviter) {
+		if (data.email === inviter.email) throw new BadRequestError("Cannot invite yourself");
+		await this.provider.validateResource(data.resourceType, data.resourceId, inviter);
+		const existingUser = await this.users.findOne({ where: { email: { eq: data.email } } });
+		if (existingUser) {
+			if (await this.provider.isMember(data.resourceType, data.resourceId, data.email, existingUser.id)) throw new BadRequestError("User is already a member of this resource");
+		}
+		if (await this.repo.findOne({ where: {
+			resourceType: { eq: data.resourceType },
+			resourceId: { eq: data.resourceId },
+			email: { eq: data.email },
+			status: { eq: "pending" }
+		} })) throw new BadRequestError("A pending invitation already exists for this email and resource");
+		const config = this.alepha.store.get(invitationConfigAtom);
+		if (await this.repo.count({
+			resourceType: { eq: data.resourceType },
+			resourceId: { eq: data.resourceId },
+			status: { eq: "pending" }
+		}) >= config.maxPendingPerResource) throw new BadRequestError(`Maximum pending invitations per resource reached (${config.maxPendingPerResource})`);
+		if (await this.repo.count({
+			invitedBy: { eq: inviter.id },
+			status: { eq: "pending" }
+		}) >= config.maxPendingPerInviter) throw new BadRequestError(`Maximum pending invitations per inviter reached (${config.maxPendingPerInviter})`);
+		const token = this.crypto.randomUUID();
+		const tokenHash = this.crypto.hash(token, "sha256");
+		const expiresAt = this.dateTime.now().add(config.expirationDays, "days").toISOString();
+		const entity = await this.repo.create({
+			invitedBy: inviter.id,
+			email: data.email,
+			resourceType: data.resourceType,
+			resourceId: data.resourceId,
+			status: "pending",
+			roles: data.roles,
+			metadata: data.metadata,
+			token: tokenHash,
+			expiresAt
+		});
+		this.log.info("Invitation created", {
+			id: entity.id,
+			email: data.email,
+			resourceType: data.resourceType,
+			resourceId: data.resourceId,
+			invitedBy: inviter.id
+		});
+		await this.alepha.events.emit("invitation:created", {
+			invitation: entity,
+			token,
+			inviter
+		});
+		return entity;
+	}
+	/**
+	* Accept a pending invitation.
+	*/
+	async accept(invitationId, acceptedBy) {
+		const invitation = await this.repo.getById(invitationId);
+		if (invitation.status !== "pending") throw new BadRequestError(`Invitation is not pending (current status: ${invitation.status})`);
+		if (invitation.email !== acceptedBy.email) throw new ForbiddenError("This invitation was sent to a different email");
+		const now = this.dateTime.now();
+		if (now.isAfter(invitation.expiresAt)) {
+			await this.repo.updateById(invitationId, {
+				status: "expired",
+				resolvedAt: now.toISOString()
+			});
+			throw new BadRequestError("Invitation has expired");
+		}
+		if (await this.provider.isMember(invitation.resourceType, invitation.resourceId, invitation.email, acceptedBy.id)) {
+			await this.repo.updateById(invitationId, {
+				status: "accepted",
+				resolvedAt: now.toISOString(),
+				resolvedBy: acceptedBy.id
+			});
+			this.log.info("Invitation accepted (already member)", {
+				id: invitationId,
+				acceptedBy: acceptedBy.id
+			});
+			return;
+		}
+		await this.provider.onAccept(invitation, acceptedBy);
+		await this.repo.updateById(invitationId, {
+			status: "accepted",
+			resolvedAt: now.toISOString(),
+			resolvedBy: acceptedBy.id
+		});
+		this.log.info("Invitation accepted", {
+			id: invitationId,
+			email: invitation.email,
+			resourceType: invitation.resourceType,
+			resourceId: invitation.resourceId,
+			acceptedBy: acceptedBy.id
+		});
+		await this.alepha.events.emit("invitation:accepted", {
+			invitation,
+			acceptedBy
+		});
+	}
+	/**
+	* Decline a pending invitation.
+	*/
+	async decline(invitationId, declinedBy) {
+		const invitation = await this.repo.getById(invitationId);
+		if (invitation.status !== "pending") throw new BadRequestError(`Invitation is not pending (current status: ${invitation.status})`);
+		if (invitation.email !== declinedBy.email) throw new ForbiddenError("This invitation was sent to a different email");
+		const now = this.dateTime.now();
+		await this.repo.updateById(invitationId, {
+			status: "declined",
+			resolvedAt: now.toISOString(),
+			resolvedBy: declinedBy.id
+		});
+		this.log.info("Invitation declined", {
+			id: invitationId,
+			email: invitation.email,
+			resourceType: invitation.resourceType,
+			resourceId: invitation.resourceId,
+			declinedBy: declinedBy.id
+		});
+		await this.alepha.events.emit("invitation:declined", {
+			invitation,
+			declinedBy
+		});
+	}
+	/**
+	* Revoke a pending invitation (by the inviter or admin).
+	*/
+	async revoke(invitationId, revokedBy) {
+		const invitation = await this.repo.getById(invitationId);
+		if (invitation.status !== "pending") throw new BadRequestError(`Invitation is not pending (current status: ${invitation.status})`);
+		const now = this.dateTime.now();
+		await this.repo.updateById(invitationId, {
+			status: "revoked",
+			resolvedAt: now.toISOString(),
+			resolvedBy: revokedBy.id
+		});
+		this.log.info("Invitation revoked", {
+			id: invitationId,
+			email: invitation.email,
+			resourceType: invitation.resourceType,
+			resourceId: invitation.resourceId,
+			revokedBy: revokedBy.id
+		});
+		await this.alepha.events.emit("invitation:revoked", {
+			invitation,
+			revokedBy
+		});
+	}
+	/**
+	* Find invitations for a given email with resource info enrichment.
+	*/
+	async findByEmail(email, query = {}) {
+		const where = this.repo.createQueryWhere();
+		where.email = { eq: email };
+		if (query.status) where.status = { eq: query.status };
+		const results = await this.repo.findMany({
+			where,
+			orderBy: {
+				column: "createdAt",
+				direction: "desc"
+			}
+		});
+		const inviterIds = [...new Set(results.map((inv) => inv.invitedBy))];
+		const inviters = await this.loadInviters(inviterIds);
+		const enriched = [];
+		for (const inv of results) {
+			const inviter = inviters.get(inv.invitedBy);
+			let resourceName = inv.resourceType;
+			let resourceUrl;
+			try {
+				const info = await this.provider.getResourceInfo(inv.resourceType, inv.resourceId);
+				resourceName = info.name;
+				resourceUrl = info.url;
+			} catch (error) {
+				this.log.warn("Failed to load resource info for invitation", {
+					invitationId: inv.id,
+					resourceType: inv.resourceType,
+					resourceId: inv.resourceId,
+					error
+				});
+			}
+			enriched.push({
+				id: inv.id,
+				email: inv.email,
+				resourceType: inv.resourceType,
+				resourceId: inv.resourceId,
+				resourceName,
+				resourceUrl,
+				invitedBy: inv.invitedBy,
+				inviterName: this.formatInviterName(inviter),
+				inviterEmail: inviter?.email,
+				roles: inv.roles,
+				status: inv.status,
+				createdAt: inv.createdAt,
+				expiresAt: inv.expiresAt
+			});
+		}
+		return enriched;
+	}
+	/**
+	* Find invitations for a specific resource.
+	*/
+	async findByResource(resourceType, resourceId, status) {
+		const where = this.repo.createQueryWhere();
+		where.resourceType = { eq: resourceType };
+		where.resourceId = { eq: resourceId };
+		if (status) where.status = { eq: status };
+		return this.repo.findMany({
+			where,
+			orderBy: {
+				column: "createdAt",
+				direction: "desc"
+			}
+		});
+	}
+	/**
+	* Find invitations with pagination and filtering (admin).
+	*/
+	async findInvitations(query = {}) {
+		query.sort ??= "-createdAt";
+		const where = this.repo.createQueryWhere();
+		if (query.email) where.email = { like: `%${query.email}%` };
+		if (query.resourceType) where.resourceType = { eq: query.resourceType };
+		if (query.resourceId) where.resourceId = { eq: query.resourceId };
+		if (query.status) where.status = { eq: query.status };
+		if (query.invitedBy) where.invitedBy = { eq: query.invitedBy };
+		return this.repo.paginate(query, { where }, { count: true });
+	}
+	/**
+	* Delete an invitation (admin). Only non-pending invitations can be deleted.
+	*/
+	async deleteInvitation(id) {
+		if ((await this.repo.getById(id)).status === "pending") throw new BadRequestError("Cannot delete a pending invitation. Revoke it first.");
+		await this.repo.deleteById(id);
+		this.log.info("Invitation deleted", { id });
+	}
+	/**
+	* Expire all pending invitations that have passed their expiration date.
+	* Returns the number of expired invitations.
+	*/
+	async expirePending() {
+		const now = this.dateTime.nowISOString();
+		const expired = await this.repo.findMany({ where: {
+			status: { eq: "pending" },
+			expiresAt: { lt: now }
+		} });
+		if (expired.length === 0) return 0;
+		const ids = expired.map((inv) => inv.id);
+		await this.repo.updateMany({ id: { inArray: ids } }, {
+			status: "expired",
+			resolvedAt: now
+		});
+		for (const inv of expired) await this.alepha.events.emit("invitation:expired", { invitation: inv });
+		this.log.info("Expired pending invitations", { count: expired.length });
+		return expired.length;
+	}
+	/**
+	* Purge resolved invitations older than the configured purge days.
+	* Returns the number of purged invitations.
+	*/
+	async purgeResolved() {
+		const config = this.alepha.store.get(invitationConfigAtom);
+		if (config.purgeDays === 0) return 0;
+		const cutoff = this.dateTime.now().subtract(config.purgeDays, "days").toISOString();
+		const ids = await this.repo.deleteMany({
+			status: { inArray: [
+				"accepted",
+				"declined",
+				"expired",
+				"revoked"
+			] },
+			resolvedAt: { lt: cutoff }
+		});
+		if (ids.length > 0) this.log.info("Purged resolved invitations", { count: ids.length });
+		return ids.length;
+	}
+	/**
+	* Load user records for a list of inviter IDs.
+	*/
+	async loadInviters(ids) {
+		if (ids.length === 0) return /* @__PURE__ */ new Map();
+		const result = await this.users.findMany({ where: { id: { inArray: ids } } });
+		return new Map(result.map((user) => [user.id, user]));
+	}
+	/**
+	* Format inviter display name from user entity.
+	*/
+	formatInviterName(user) {
+		if (!user) return;
+		if (user.firstName && user.lastName) return `${user.firstName} ${user.lastName}`;
+		if (user.firstName) return user.firstName;
+		return user.username ?? user.email;
+	}
+};
+//#endregion
+//#region ../../src/api/invitations/controllers/AdminInvitationController.ts
+var AdminInvitationController = class {
+	url = "/invitations";
+	group = "admin:invitations";
+	invitationService = $inject(InvitationService);
+	/**
+	* Find invitations with pagination and filtering.
+	*/
+	findInvitations = $action({
+		path: this.url,
+		group: this.group,
+		use: [$secure({ permissions: ["admin:invitation:read"] })],
+		description: "Find invitations with pagination and filtering",
+		schema: {
+			query: invitationQuerySchema,
+			response: t.page(invitationResourceSchema)
+		},
+		handler: ({ query }) => this.invitationService.findInvitations(query)
+	});
+	/**
+	* Get an invitation by ID.
+	*/
+	getInvitation = $action({
+		path: `${this.url}/:id`,
+		group: this.group,
+		use: [$secure({ permissions: ["admin:invitation:read"] })],
+		description: "Get an invitation by ID",
+		schema: {
+			params: t.object({ id: t.uuid() }),
+			response: invitationResourceSchema
+		},
+		handler: ({ params }) => this.invitationService.getById(params.id)
+	});
+	/**
+	* Revoke a pending invitation.
+	*/
+	revokeInvitation = $action({
+		method: "POST",
+		path: `${this.url}/:id/revoke`,
+		group: this.group,
+		use: [$secure({ permissions: ["admin:invitation:delete"] })],
+		description: "Revoke a pending invitation",
+		schema: {
+			params: t.object({ id: t.uuid() }),
+			response: okSchema
+		},
+		handler: async ({ params, user }) => {
+			await this.invitationService.revoke(params.id, { id: user.id });
+			return { ok: true };
+		}
+	});
+	/**
+	* Delete an invitation.
+	*/
+	deleteInvitation = $action({
+		method: "DELETE",
+		path: `${this.url}/:id`,
+		group: this.group,
+		use: [$secure({ permissions: ["admin:invitation:delete"] })],
+		description: "Delete an invitation",
+		schema: {
+			params: t.object({ id: t.uuid() }),
+			response: okSchema
+		},
+		handler: async ({ params }) => {
+			await this.invitationService.deleteInvitation(params.id);
+			return {
+				ok: true,
+				id: params.id
+			};
+		}
+	});
+};
+//#endregion
+//#region ../../src/api/invitations/schemas/createInvitationSchema.ts
+const createInvitationSchema = t.object({
+	email: t.string({ format: "email" }),
+	resourceType: t.text({
+		minLength: 1,
+		maxLength: 100
+	}),
+	resourceId: t.text({
+		minLength: 1,
+		maxLength: 255
+	}),
+	roles: t.optional(t.array(t.text())),
+	metadata: t.optional(t.record(t.text(), t.any()))
+});
+//#endregion
+//#region ../../src/api/invitations/schemas/invitationWithResourceInfoSchema.ts
+const invitationWithResourceInfoSchema = t.object({
+	id: t.uuid(),
+	email: t.string({ format: "email" }),
+	resourceType: t.text(),
+	resourceId: t.text(),
+	resourceName: t.text(),
+	resourceUrl: t.optional(t.text()),
+	invitedBy: t.uuid(),
+	inviterName: t.optional(t.text()),
+	inviterEmail: t.optional(t.string({ format: "email" })),
+	roles: t.optional(t.array(t.text())),
+	status: t.enum([
+		"pending",
+		"accepted",
+		"declined",
+		"expired",
+		"revoked"
+	]),
+	createdAt: t.datetime(),
+	expiresAt: t.datetime()
+});
+//#endregion
+//#region ../../src/api/invitations/schemas/myInvitationsQuerySchema.ts
+const myInvitationsQuerySchema = t.object({ status: t.optional(t.enum([
+	"pending",
+	"accepted",
+	"declined",
+	"expired",
+	"revoked"
+])) });
+//#endregion
+//#region ../../src/api/invitations/controllers/InvitationController.ts
+var InvitationController = class {
+	url = "/invitations";
+	group = "invitations";
+	invitationService = $inject(InvitationService);
+	/**
+	* Create a new invitation.
+	*/
+	createInvitation = $action({
+		method: "POST",
+		path: this.url,
+		group: this.group,
+		use: [$secure({ permissions: ["invitation:create"] })],
+		description: "Create a new invitation",
+		schema: {
+			body: createInvitationSchema,
+			response: invitationResourceSchema
+		},
+		handler: ({ body, user }) => this.invitationService.create(body, user)
+	});
+	/**
+	* List invitations for the current user.
+	*/
+	getMyInvitations = $action({
+		path: `${this.url}/mine`,
+		group: this.group,
+		use: [$secure()],
+		description: "List invitations for the current user",
+		schema: {
+			query: myInvitationsQuerySchema,
+			response: t.array(invitationWithResourceInfoSchema)
+		},
+		handler: ({ query, user }) => this.invitationService.findByEmail(user.email, query)
+	});
+	/**
+	* Accept an invitation.
+	*/
+	acceptInvitation = $action({
+		method: "POST",
+		path: `${this.url}/:id/accept`,
+		group: this.group,
+		use: [$secure()],
+		description: "Accept an invitation",
+		schema: {
+			params: t.object({ id: t.uuid() }),
+			response: okSchema
+		},
+		handler: async ({ params, user }) => {
+			await this.invitationService.accept(params.id, user);
+			return { ok: true };
+		}
+	});
+	/**
+	* Decline an invitation.
+	*/
+	declineInvitation = $action({
+		method: "POST",
+		path: `${this.url}/:id/decline`,
+		group: this.group,
+		use: [$secure()],
+		description: "Decline an invitation",
+		schema: {
+			params: t.object({ id: t.uuid() }),
+			response: okSchema
+		},
+		handler: async ({ params, user }) => {
+			await this.invitationService.decline(params.id, user);
+			return { ok: true };
+		}
+	});
+};
+//#endregion
+//#region ../../src/api/invitations/jobs/InvitationJobs.ts
+var InvitationJobs = class {
+	log = $logger();
+	invitationService = $inject(InvitationService);
+	/**
+	* Expire pending invitations that have passed their expiration date.
+	*/
+	expireInvitations = $job({
+		cron: "0 * * * *",
+		lock: true,
+		handler: async () => {
+			const count = await this.invitationService.expirePending();
+			if (count > 0) this.log.info(`Expired ${count} invitations`);
+		}
+	});
+	/**
+	* Purge old resolved invitations.
+	*/
+	purgeInvitations = $job({
+		cron: "0 3 * * *",
+		lock: true,
+		handler: async () => {
+			const count = await this.invitationService.purgeResolved();
+			if (count > 0) this.log.info(`Purged ${count} old invitations`);
+		}
+	});
+};
+//#endregion
+//#region ../../src/api/invitations/index.ts
+/**
+* Invitation management module — create, accept, decline, revoke, and expire invitations.
+*
+* @module alepha.api.invitations
+*/
+const AlephaApiInvitations = $module({
+	name: "alepha.api.invitations",
+	services: [
+		InvitationService,
+		InvitationJobs,
+		InvitationController,
+		AdminInvitationController
+	],
+	register: (alepha) => {
+		alepha.with(InvitationService).with(InvitationJobs).with(InvitationController).with(AdminInvitationController);
+	}
+});
+//#endregion
+export { AdminInvitationController, AlephaApiInvitations, InvitationController, InvitationJobs, InvitationProvider, InvitationService, createInvitationSchema, invitationConfigAtom, invitationQuerySchema, invitationResourceSchema, invitationWithResourceInfoSchema, invitations, myInvitationsQuerySchema };
+
+//# sourceMappingURL=index.js.map