grm-shared-library 1.1.246 → 1.1.248

package/dist/cjs/kafka/dtos/user/guardians-changed-payload.dto.js

@@ -0,0 +1,66 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuardiansChangedPayloadDto = exports.GuardiansChangedReason = void 0;
+const class_validator_1 = require("class-validator");
+/** What changed about somebody's guardians - for logs and analytics; every reason means "refresh". */
+var GuardiansChangedReason;
+(function (GuardiansChangedReason) {
+    /** A guardian was added. */
+    GuardiansChangedReason["ADDED"] = "ADDED";
+    /** A guardian was removed by the person they guard. */
+    GuardiansChangedReason["REMOVED"] = "REMOVED";
+    /** Another guardian became the primary one. */
+    GuardiansChangedReason["PRIMARY_CHANGED"] = "PRIMARY_CHANGED";
+    /** A guardian on the list by phone number proved that number in the same organization's app, and is now an app guardian. */
+    GuardiansChangedReason["PROMOTED"] = "PROMOTED";
+    /** An app guardian's account was deleted; they stay on the list by phone number. */
+    GuardiansChangedReason["DEMOTED"] = "DEMOTED";
+    /** A guardian stopped looking after one of their dependents. */
+    GuardiansChangedReason["DEPENDENT_REMOVED"] = "DEPENDENT_REMOVED";
+})(GuardiansChangedReason || (exports.GuardiansChangedReason = GuardiansChangedReason = {}));
+/**
+ * Payload of `KAFKA_TOPICS.GUARDIANS_CHANGED`: somebody's guardian list changed,
+ * and these people's apps should read their guardians and dependents again.
+ *
+ * Ids only - no names, numbers or relationships. The apps read the lists through
+ * the guardian API, which applies its own access rules.
+ */
+class GuardiansChangedPayloadDto {
+}
+exports.GuardiansChangedPayloadDto = GuardiansChangedPayloadDto;
+__decorate([
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.IsPositive)(),
+    __metadata("design:type", Number)
+], GuardiansChangedPayloadDto.prototype, "organizationId", void 0);
+__decorate([
+    (0, class_validator_1.IsInt)(),
+    (0, class_validator_1.IsPositive)(),
+    __metadata("design:type", Number)
+], GuardiansChangedPayloadDto.prototype, "dependentId", void 0);
+__decorate([
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.ArrayMinSize)(1),
+    (0, class_validator_1.ArrayMaxSize)(100),
+    (0, class_validator_1.IsInt)({ each: true }),
+    (0, class_validator_1.IsPositive)({ each: true }),
+    __metadata("design:type", Array)
+], GuardiansChangedPayloadDto.prototype, "userIds", void 0);
+__decorate([
+    (0, class_validator_1.IsEnum)(GuardiansChangedReason),
+    __metadata("design:type", String)
+], GuardiansChangedPayloadDto.prototype, "reason", void 0);
+__decorate([
+    (0, class_validator_1.IsISO8601)(),
+    __metadata("design:type", String)
+], GuardiansChangedPayloadDto.prototype, "occurredAt", void 0);
+//# sourceMappingURL=guardians-changed-payload.dto.js.map

package/dist/cjs/kafka/dtos/user/guardians-changed-payload.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardians-changed-payload.dto.js","sourceRoot":"","sources":["../../../../../src/kafka/dtos/user/guardians-changed-payload.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAA4G;AAE5G,sGAAsG;AACtG,IAAY,sBAaX;AAbD,WAAY,sBAAsB;IAC9B,4BAA4B;IAC5B,yCAAe,CAAA;IACf,uDAAuD;IACvD,6CAAmB,CAAA;IACnB,+CAA+C;IAC/C,6DAAmC,CAAA;IACnC,4HAA4H;IAC5H,+CAAqB,CAAA;IACrB,oFAAoF;IACpF,6CAAmB,CAAA;IACnB,gEAAgE;IAChE,iEAAuC,CAAA;AAC3C,CAAC,EAbW,sBAAsB,sCAAtB,sBAAsB,QAajC;AAED;;;;;;GAMG;AACH,MAAa,0BAA0B;CAwBtC;AAxBD,gEAwBC;AApBG;IAFC,IAAA,uBAAK,GAAE;IACP,IAAA,4BAAU,GAAE;;kEACW;AAKxB;IAFC,IAAA,uBAAK,GAAE;IACP,IAAA,4BAAU,GAAE;;+DACQ;AAQrB;IALC,IAAA,yBAAO,GAAE;IACT,IAAA,8BAAY,EAAC,CAAC,CAAC;IACf,IAAA,8BAAY,EAAC,GAAG,CAAC;IACjB,IAAA,uBAAK,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrB,IAAA,4BAAU,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;2DACR;AAGnB;IADC,IAAA,wBAAM,EAAC,sBAAsB,CAAC;;0DACC;AAGhC;IADC,IAAA,2BAAS,GAAE;;8DACQ"}

package/dist/cjs/kafka/index.js

@@ -24,4 +24,5 @@ __exportStar(require("./dtos/otp/create-otp-payload.dto"), exports);
 __exportStar(require("./dtos/otp/otp-payload.dto"), exports);
 __exportStar(require("./dtos/password/password-reset-payload.dto"), exports);
 __exportStar(require("./dtos/account-deletion/account-deletion-request-payload.dto"), exports);
+__exportStar(require("./dtos/user/guardians-changed-payload.dto"), exports);
 //# sourceMappingURL=index.js.map

package/dist/cjs/kafka/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/kafka/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,mDAAiC;AACjC,8EAA4D;AAC5D,uEAAqD;AACrD,iFAA+D;AAC/D,0EAAwD;AACxD,oEAAkD;AAClD,6DAA2C;AAC3C,6EAA2D;AAC3D,+FAA6E"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/kafka/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,mDAAiC;AACjC,8EAA4D;AAC5D,uEAAqD;AACrD,iFAA+D;AAC/D,0EAAwD;AACxD,oEAAkD;AAClD,6DAA2C;AAC3C,6EAA2D;AAC3D,+FAA6E;AAC7E,4EAA0D"}

package/dist/cjs/kafka/topics.js

@@ -12,6 +12,10 @@ exports.KAFKA_TOPICS = {
     USER_CREATED: 'user.created',
     USER_UPDATED: 'user.updated',
     USER_DELETED: 'user.deleted',
+    // Somebody's guardians or dependents changed (producer: clarion-authentication;
+    // payload GuardiansChangedPayloadDto; consumer: clarion-notification, which
+    // sends each affected person a silent push so their app refreshes). Ids only.
+    GUARDIANS_CHANGED: 'user.guardians.changed.v1',
     // Org. ORG_CREATED is published by clarion-organization after commit
     // (payload OrganizationCreatedEvent); clarion-incident provisions the Safety
     // Alerts category from it.

package/dist/cjs/kafka/topics.js.map

@@ -1 +1 @@
-{"version":3,"file":"topics.js","sourceRoot":"","sources":["../../../src/kafka/topics.ts"],"names":[],"mappings":";;;AAAa,QAAA,YAAY,GAAG;IACxB,OAAO;IACP,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,6BAA6B,EAAE,+BAA+B;IAC9D,6BAA6B,EAAE,+BAA+B;IAC9D,OAAO;IACP,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,qEAAqE;IACrE,6EAA6E;IAC7E,2BAA2B;IAC3B,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,MAAM;IACN,YAAY,EAAE,eAAe;IAC7B,aAAa,EAAE,eAAe;IAC9B,WAAW;IACX,cAAc,EAAE,gBAAgB;IAChC,WAAW;IACX,gBAAgB,EAAE,kBAAkB;IACpC,gBAAgB,EAAE,kBAAkB;IACpC,uBAAuB,EAAE,yBAAyB;IAClD,sBAAsB,EAAE,wBAAwB;IAChD,yBAAyB,EAAE,2BAA2B;IACtD,wBAAwB,EAAE,0BAA0B;IACpD,0BAA0B,EAAE,4BAA4B;IACxD,sBAAsB,EAAE,wBAAwB;IAChD,iBAAiB,EAAE,mBAAmB;IACtC,2BAA2B,EAAE,6BAA6B;IAC1D,yCAAyC,EAAE,2CAA2C;IACtF,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,uCAAuC,EAAE,4CAA4C;IACrF,8CAA8C,EAAE,mDAAmD;IACnG,sDAAsD,EAClD,2DAA2D;IAC/D,qEAAqE;IACrE,+BAA+B;IAC/B,0CAA0C,EAAE,4DAA4D;IACxG,OAAO;IACP,oBAAoB,EAAE,sBAAsB;IAC5C,yBAAyB,EAAE,2BAA2B;IACtD,qBAAqB,EAAE,uBAAuB;IAC9C,OAAO;IACP,YAAY,EAAE,cAAc;IAC5B,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,aAAa;IAC1B,OAAO;IACP,iBAAiB,EAAE,mBAAmB;IACtC,oBAAoB,EAAE,sBAAsB;IAC5C,WAAW;IACX,qBAAqB,EAAE,uBAAuB;IAC9C,uBAAuB,EAAE,yBAAyB;IAClD,qBAAqB,EAAE,uBAAuB;IAC9C,sBAAsB,EAAE,wBAAwB;IAChD,qBAAqB,EAAE,uBAAuB;IAC9C,mBAAmB,EAAE,qBAAqB;IAC1C,qBAAqB,EAAE,uBAAuB;IAC9C,oBAAoB,EAAE,sBAAsB;IAC5C,wBAAwB,EAAE,0BAA0B;IACpD,wBAAwB,EAAE,0BAA0B;IACpD,wBAAwB,EAAE,0BAA0B;IACpD,iEAAiE;IACjE,iBAAiB,EAAE,oCAAoC;IACvD,eAAe,EAAE,kCAAkC;IACnD,wBAAwB,EAAE,6BAA6B;IACvD,wBAAwB,EAAE,6BAA6B;IACvD,wBAAwB,EAAE,6BAA6B;IACvD,wEAAwE;IACxE,+DAA+D;IAC/D,yBAAyB,EAAE,uCAAuC;IAClE,yBAAyB,EAAE,uCAAuC;IAClE,yBAAyB,EAAE,uCAAuC;IAClE,wCAAwC,EACpC,sDAAsD;IAC1D,gCAAgC,EAAE,8CAA8C;IAChF,iFAAiF;IACjF,wBAAwB,EAAE,6BAA6B;IACvD,+BAA+B,EAAE,oCAAoC;IACrE,iFAAiF;IACjF,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,iEAAiE;IACjE,sBAAsB,EAAE,2BAA2B;IACnD,sBAAsB,EAAE,2BAA2B;IACnD,uBAAuB,EAAE,4BAA4B;IACrD,6BAA6B,EAAE,kCAAkC;IACjE,+BAA+B,EAAE,oCAAoC;IACrE,8BAA8B,EAAE,mCAAmC;IACnE,+BAA+B,EAAE,oCAAoC;IACrE,4BAA4B,EAAE,iCAAiC;IAC/D,uBAAuB,EAAE,4BAA4B;IACrD,qBAAqB,EAAE,0BAA0B;IACjD,uBAAuB,EAAE,4BAA4B;IACrD,0BAA0B,EAAE,+BAA+B;IAC3D,2BAA2B,EAAE,gCAAgC;IAC7D,wBAAwB,EAAE,6BAA6B;IACvD,wBAAwB,EAAE,6BAA6B;IACvD,yBAAyB,EAAE,8BAA8B;IACzD,0BAA0B,EAAE,+BAA+B;IAC3D,oCAAoC,EAAE,yCAAyC;IAC/E,iCAAiC,EAAE,sCAAsC;IACzE,4BAA4B,EAAE,iCAAiC;IAC/D,+BAA+B,EAAE,oCAAoC;IACrE,wEAAwE;IACxE,8EAA8E;IAC9E,mDAAmD;IACnD,oBAAoB,EAAE,yBAAyB;IAC/C,sBAAsB,EAAE,2BAA2B;IACnD,kBAAkB,EAAE,uBAAuB;IAC3C,0BAA0B,EAAE,+BAA+B;IAC3D,+EAA+E;IAC/E,8DAA8D;IAC9D,iBAAiB,EAAE,6BAA6B;IAChD,4BAA4B,EAAE,wCAAwC;IACtE,mBAAmB,EAAE,+BAA+B;IACpD,uBAAuB,EAAE,mCAAmC;IAC5D,eAAe,EAAE,2BAA2B;IAC5C,2EAA2E;IAC3E,uEAAuE;IACvE,6EAA6E;IAC7E,+BAA+B;IAC/B,qCAAqC,EAAE,0CAA0C;IACjF,oBAAoB,EAAE,yBAAyB;IAC/C,8BAA8B,EAAE,mCAAmC;IACnE,0EAA0E;IAC1E,0EAA0E;IAC1E,yCAAyC,EAAE,8CAA8C;IACzF,sCAAsC,EAAE,wDAAwD;CACnG,CAAC"}
+{"version":3,"file":"topics.js","sourceRoot":"","sources":["../../../src/kafka/topics.ts"],"names":[],"mappings":";;;AAAa,QAAA,YAAY,GAAG;IACxB,OAAO;IACP,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,6BAA6B,EAAE,+BAA+B;IAC9D,6BAA6B,EAAE,+BAA+B;IAC9D,OAAO;IACP,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,gFAAgF;IAChF,4EAA4E;IAC5E,8EAA8E;IAC9E,iBAAiB,EAAE,2BAA2B;IAC9C,qEAAqE;IACrE,6EAA6E;IAC7E,2BAA2B;IAC3B,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,MAAM;IACN,YAAY,EAAE,eAAe;IAC7B,aAAa,EAAE,eAAe;IAC9B,WAAW;IACX,cAAc,EAAE,gBAAgB;IAChC,WAAW;IACX,gBAAgB,EAAE,kBAAkB;IACpC,gBAAgB,EAAE,kBAAkB;IACpC,uBAAuB,EAAE,yBAAyB;IAClD,sBAAsB,EAAE,wBAAwB;IAChD,yBAAyB,EAAE,2BAA2B;IACtD,wBAAwB,EAAE,0BAA0B;IACpD,0BAA0B,EAAE,4BAA4B;IACxD,sBAAsB,EAAE,wBAAwB;IAChD,iBAAiB,EAAE,mBAAmB;IACtC,2BAA2B,EAAE,6BAA6B;IAC1D,yCAAyC,EAAE,2CAA2C;IACtF,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,uCAAuC,EAAE,4CAA4C;IACrF,8CAA8C,EAAE,mDAAmD;IACnG,sDAAsD,EAClD,2DAA2D;IAC/D,qEAAqE;IACrE,+BAA+B;IAC/B,0CAA0C,EAAE,4DAA4D;IACxG,OAAO;IACP,oBAAoB,EAAE,sBAAsB;IAC5C,yBAAyB,EAAE,2BAA2B;IACtD,qBAAqB,EAAE,uBAAuB;IAC9C,OAAO;IACP,YAAY,EAAE,cAAc;IAC5B,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,aAAa;IAC1B,OAAO;IACP,iBAAiB,EAAE,mBAAmB;IACtC,oBAAoB,EAAE,sBAAsB;IAC5C,WAAW;IACX,qBAAqB,EAAE,uBAAuB;IAC9C,uBAAuB,EAAE,yBAAyB;IAClD,qBAAqB,EAAE,uBAAuB;IAC9C,sBAAsB,EAAE,wBAAwB;IAChD,qBAAqB,EAAE,uBAAuB;IAC9C,mBAAmB,EAAE,qBAAqB;IAC1C,qBAAqB,EAAE,uBAAuB;IAC9C,oBAAoB,EAAE,sBAAsB;IAC5C,wBAAwB,EAAE,0BAA0B;IACpD,wBAAwB,EAAE,0BAA0B;IACpD,wBAAwB,EAAE,0BAA0B;IACpD,iEAAiE;IACjE,iBAAiB,EAAE,oCAAoC;IACvD,eAAe,EAAE,kCAAkC;IACnD,wBAAwB,EAAE,6BAA6B;IACvD,wBAAwB,EAAE,6BAA6B;IACvD,wBAAwB,EAAE,6BAA6B;IACvD,wEAAwE;IACxE,+DAA+D;IAC/D,yBAAyB,EAAE,uCAAuC;IAClE,yBAAyB,EAAE,uCAAuC;IAClE,yBAAyB,EAAE,uCAAuC;IAClE,wCAAwC,EACpC,sDAAsD;IAC1D,gCAAgC,EAAE,8CAA8C;IAChF,iFAAiF;IACjF,wBAAwB,EAAE,6BAA6B;IACvD,+BAA+B,EAAE,oCAAoC;IACrE,iFAAiF;IACjF,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,iEAAiE;IACjE,sBAAsB,EAAE,2BAA2B;IACnD,sBAAsB,EAAE,2BAA2B;IACnD,uBAAuB,EAAE,4BAA4B;IACrD,6BAA6B,EAAE,kCAAkC;IACjE,+BAA+B,EAAE,oCAAoC;IACrE,8BAA8B,EAAE,mCAAmC;IACnE,+BAA+B,EAAE,oCAAoC;IACrE,4BAA4B,EAAE,iCAAiC;IAC/D,uBAAuB,EAAE,4BAA4B;IACrD,qBAAqB,EAAE,0BAA0B;IACjD,uBAAuB,EAAE,4BAA4B;IACrD,0BAA0B,EAAE,+BAA+B;IAC3D,2BAA2B,EAAE,gCAAgC;IAC7D,wBAAwB,EAAE,6BAA6B;IACvD,wBAAwB,EAAE,6BAA6B;IACvD,yBAAyB,EAAE,8BAA8B;IACzD,0BAA0B,EAAE,+BAA+B;IAC3D,oCAAoC,EAAE,yCAAyC;IAC/E,iCAAiC,EAAE,sCAAsC;IACzE,4BAA4B,EAAE,iCAAiC;IAC/D,+BAA+B,EAAE,oCAAoC;IACrE,wEAAwE;IACxE,8EAA8E;IAC9E,mDAAmD;IACnD,oBAAoB,EAAE,yBAAyB;IAC/C,sBAAsB,EAAE,2BAA2B;IACnD,kBAAkB,EAAE,uBAAuB;IAC3C,0BAA0B,EAAE,+BAA+B;IAC3D,+EAA+E;IAC/E,8DAA8D;IAC9D,iBAAiB,EAAE,6BAA6B;IAChD,4BAA4B,EAAE,wCAAwC;IACtE,mBAAmB,EAAE,+BAA+B;IACpD,uBAAuB,EAAE,mCAAmC;IAC5D,eAAe,EAAE,2BAA2B;IAC5C,2EAA2E;IAC3E,uEAAuE;IACvE,6EAA6E;IAC7E,+BAA+B;IAC/B,qCAAqC,EAAE,0CAA0C;IACjF,oBAAoB,EAAE,yBAAyB;IAC/C,8BAA8B,EAAE,mCAAmC;IACnE,0EAA0E;IAC1E,0EAA0E;IAC1E,yCAAyC,EAAE,8CAA8C;IACzF,sCAAsC,EAAE,wDAAwD;CACnG,CAAC"}

package/dist/cjs/modules/user/dtos/guardian-identifier.dto.js

@@ -17,7 +17,7 @@ class GuardianIdentifierDto {
 exports.GuardianIdentifierDto = GuardianIdentifierDto;
 __decorate([
     (0, swagger_1.ApiProperty)({
-        description: 'Phone number for external guardian',
+        description: 'Phone number of an external guardian (older apps). Prefer relationshipId, which names either kind.',
         example: '+1234567890',
         required: false,
         type: 'string'
@@ -28,7 +28,7 @@ __decorate([
 ], GuardianIdentifierDto.prototype, "phoneNumber", void 0);
 __decorate([
     (0, swagger_1.ApiProperty)({
-        description: 'Relationship ID for system guardian',
+        description: 'The guardian entry id - `id` of an app-user guardian relation or of an external guardian (since grm-shared-library 1.1.248)',
         example: 789,
         required: false,
         type: 'number'

package/dist/cjs/modules/user/dtos/guardian-identifier.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"guardian-identifier.dto.js","sourceRoot":"","sources":["../../../../../src/modules/user/dtos/guardian-identifier.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,qDAA6E;AAE7E,MAAa,qBAAqB;CAoBjC;AApBD,sDAoBC;AAXG;IARC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,QAAQ;KACjB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;0DACQ;AAUrB;IARC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,QAAQ;KACjB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;6DACW"}
+{"version":3,"file":"guardian-identifier.dto.js","sourceRoot":"","sources":["../../../../../src/modules/user/dtos/guardian-identifier.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,qDAA6E;AAE7E,MAAa,qBAAqB;CAoBjC;AApBD,sDAoBC;AAXG;IARC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,oGAAoG;QACjH,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,QAAQ;KACjB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;0DACQ;AAUrB;IARC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,6HAA6H;QAC1I,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,QAAQ;KACjB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;6DACW"}

package/dist/cjs/modules/user/index.js

@@ -32,4 +32,5 @@ __exportStar(require("./interfaces/guardian"), exports);
 __exportStar(require("./interfaces/guardian-relation"), exports);
 __exportStar(require("./interfaces/guardians-response"), exports);
 __exportStar(require("./interfaces/account-analytics"), exports);
+__exportStar(require("./utils/app-account.util"), exports);
 //# sourceMappingURL=index.js.map

package/dist/cjs/modules/user/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/modules/user/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,yDAAuC;AACvC,sDAAoC;AACpC,iEAA+C;AAC/C,sEAAoD;AACpD,6EAA2D;AAC3D,+EAA6D;AAC7D,yEAAuD;AAEvD,2DAAyC;AACzC,qEAAmD;AACnD,wEAAsD;AAEtD,oDAAkC;AAClC,4DAA0C;AAC1C,4DAA0C;AAC1C,wDAAsC;AACtC,iEAA+C;AAC/C,kEAAgD;AAChD,iEAA+C"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/modules/user/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,yDAAuC;AACvC,yDAAuC;AACvC,sDAAoC;AACpC,iEAA+C;AAC/C,sEAAoD;AACpD,6EAA2D;AAC3D,+EAA6D;AAC7D,yEAAuD;AAEvD,2DAAyC;AACzC,qEAAmD;AACnD,wEAAsD;AAEtD,oDAAkC;AAClC,4DAA0C;AAC1C,4DAA0C;AAC1C,wDAAsC;AACtC,iEAA+C;AAC/C,kEAAgD;AAChD,iEAA+C;AAE/C,2DAAyC"}

package/dist/cjs/modules/user/utils/app-account.util.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.APP_ACCOUNT_ERROR_CODES = exports.APP_ACCOUNT_ROLE = void 0;
+exports.isAppAccount = isAppAccount;
+exports.hasAppRole = hasAppRole;
+exports.parseAppOrganizations = parseAppOrganizations;
+exports.isAccountFromAnotherApp = isAccountFromAnotherApp;
+const role_enum_1 = require("../../role/enums/role.enum");
+/**
+ * App accounts and staff accounts.
+ *
+ * Each brand's mobile app (G4S Kenya, GeoSHIELD, SGA Security, ...) is its own
+ * product for one organization's customers, so an account made in one app is an
+ * account with that organization only. Signing in to another brand's app means
+ * registering with that brand. One person may therefore hold several app
+ * accounts - one per organization - with the same phone number and e-mail.
+ *
+ * Staff (Super-Admin, organization and control-centre staff, responders,
+ * corporate-client admins) keep one platform-wide account each: their e-mail and
+ * phone number stay unique across the whole platform.
+ *
+ * An APP ACCOUNT is one whose only role is Mobile-User. That is the same rule the
+ * database's unique indexes use (`roles = '{Mobile-User}'`), so code and schema
+ * can never disagree about which kind an account is. An account holding
+ * Mobile-User beside a staff role is a staff account that also uses an app.
+ */
+exports.APP_ACCOUNT_ROLE = role_enum_1.Roles.MOBILE_USER;
+/** An account whose only role is Mobile-User: unique within its organization, not platform-wide. */
+function isAppAccount(roles) {
+    return Array.isArray(roles) && roles.length === 1 && roles[0] === exports.APP_ACCOUNT_ROLE;
+}
+/** Holds the Mobile-User role, alone or beside staff roles: someone who can use a brand's app. */
+function hasAppRole(roles) {
+    return Array.isArray(roles) && roles.includes(exports.APP_ACCOUNT_ROLE);
+}
+/**
+ * Parses `APP_ORGANIZATIONS`. Blank means "none configured". A malformed entry
+ * throws: a typo here would let an app sign people in to the wrong organization,
+ * so it must stop the service at boot rather than be skipped.
+ */
+function parseAppOrganizations(raw) {
+    const map = new Map();
+    for (const entry of String(raw !== null && raw !== void 0 ? raw : '').split(',')) {
+        const trimmed = entry.trim();
+        if (!trimmed)
+            continue;
+        const match = /^([A-Za-z0-9_-]+)\s*:\s*(\d+)$/.exec(trimmed);
+        if (!match)
+            throw new Error(`APP_ORGANIZATIONS: "${trimmed}" is not <appId>:<organizationId>`);
+        const [, appId, id] = match;
+        const organizationId = Number(id);
+        if (!Number.isSafeInteger(organizationId) || organizationId <= 0) {
+            throw new Error(`APP_ORGANIZATIONS: "${trimmed}" names no valid organization`);
+        }
+        const existing = map.get(appId);
+        if (existing !== undefined && existing !== organizationId) {
+            throw new Error(`APP_ORGANIZATIONS: ${appId} is given two organizations (${existing} and ${organizationId})`);
+        }
+        map.set(appId, organizationId);
+    }
+    return map;
+}
+/**
+ * Whether a signed-in account is being used from another organization's app: the
+ * request names an app (`X-App-Id`) that belongs to organization A, and the account
+ * is an app user of organization B.
+ *
+ * Unknown here means "not a mismatch": no app named, an app with no configured
+ * organization, or an account that is staff only. Those keep working as before.
+ */
+function isAccountFromAnotherApp(appOrganizations, appId, account) {
+    if (!appId)
+        return false;
+    const expected = appOrganizations.get(appId);
+    if (expected === undefined)
+        return false;
+    if (!hasAppRole(account.roles))
+        return false;
+    return Number(account.organizationId) !== expected;
+}
+/** Error codes a client can act on, for the account rules above. */
+exports.APP_ACCOUNT_ERROR_CODES = {
+    /** A token or session belongs to another organization's app: sign out and sign in again here. */
+    APP_ACCOUNT_MISMATCH: 'APP_ACCOUNT_MISMATCH',
+    /** A sign-in names an app and an organization that do not belong together. */
+    APP_ORGANIZATION_MISMATCH: 'APP_ORGANIZATION_MISMATCH',
+    /** An older app asked for "the" account of a number that has accounts with several organizations. */
+    ACCOUNT_AMBIGUOUS: 'ACCOUNT_AMBIGUOUS',
+};
+//# sourceMappingURL=app-account.util.js.map

package/dist/cjs/modules/user/utils/app-account.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-account.util.js","sourceRoot":"","sources":["../../../../../src/modules/user/utils/app-account.util.ts"],"names":[],"mappings":";;;AAuBA,oCAEC;AAGD,gCAEC;AAeD,sDAmBC;AAUD,0DAUC;AApFD,0DAAmD;AAEnD;;;;;;;;;;;;;;;;;GAiBG;AACU,QAAA,gBAAgB,GAAG,iBAAK,CAAC,WAAW,CAAC;AAElD,oGAAoG;AACpG,SAAgB,YAAY,CAAC,KAA2C;IACpE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,wBAAgB,CAAC;AACvF,CAAC;AAED,kGAAkG;AAClG,SAAgB,UAAU,CAAC,KAA2C;IAClE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,wBAAgB,CAAC,CAAC;AACpE,CAAC;AAUD;;;;GAIG;AACH,SAAgB,qBAAqB,CAAC,GAA8B;IAChE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,KAAK,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,mCAAmC,CAAC,CAAC;QAC/F,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;QAC5B,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,cAAc,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,+BAA+B,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,gCAAgC,QAAQ,QAAQ,cAAc,GAAG,CAAC,CAAC;QAClH,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,uBAAuB,CACnC,gBAAkC,EAClC,KAAgC,EAChC,OAAsF;IAEtF,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC;AACvD,CAAC;AAED,oEAAoE;AACvD,QAAA,uBAAuB,GAAG;IACnC,iGAAiG;IACjG,oBAAoB,EAAE,sBAAsB;IAC5C,8EAA8E;IAC9E,yBAAyB,EAAE,2BAA2B;IACtD,qGAAqG;IACrG,iBAAiB,EAAE,mBAAmB;CAChC,CAAC"}

package/dist/esm/kafka/dtos/user/guardians-changed-payload.dto.js

@@ -0,0 +1,62 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { ArrayMaxSize, ArrayMinSize, IsArray, IsEnum, IsInt, IsISO8601, IsPositive } from "class-validator";
+/** What changed about somebody's guardians - for logs and analytics; every reason means "refresh". */
+export var GuardiansChangedReason;
+(function (GuardiansChangedReason) {
+    /** A guardian was added. */
+    GuardiansChangedReason["ADDED"] = "ADDED";
+    /** A guardian was removed by the person they guard. */
+    GuardiansChangedReason["REMOVED"] = "REMOVED";
+    /** Another guardian became the primary one. */
+    GuardiansChangedReason["PRIMARY_CHANGED"] = "PRIMARY_CHANGED";
+    /** A guardian on the list by phone number proved that number in the same organization's app, and is now an app guardian. */
+    GuardiansChangedReason["PROMOTED"] = "PROMOTED";
+    /** An app guardian's account was deleted; they stay on the list by phone number. */
+    GuardiansChangedReason["DEMOTED"] = "DEMOTED";
+    /** A guardian stopped looking after one of their dependents. */
+    GuardiansChangedReason["DEPENDENT_REMOVED"] = "DEPENDENT_REMOVED";
+})(GuardiansChangedReason || (GuardiansChangedReason = {}));
+/**
+ * Payload of `KAFKA_TOPICS.GUARDIANS_CHANGED`: somebody's guardian list changed,
+ * and these people's apps should read their guardians and dependents again.
+ *
+ * Ids only - no names, numbers or relationships. The apps read the lists through
+ * the guardian API, which applies its own access rules.
+ */
+export class GuardiansChangedPayloadDto {
+}
+__decorate([
+    IsInt(),
+    IsPositive(),
+    __metadata("design:type", Number)
+], GuardiansChangedPayloadDto.prototype, "organizationId", void 0);
+__decorate([
+    IsInt(),
+    IsPositive(),
+    __metadata("design:type", Number)
+], GuardiansChangedPayloadDto.prototype, "dependentId", void 0);
+__decorate([
+    IsArray(),
+    ArrayMinSize(1),
+    ArrayMaxSize(100),
+    IsInt({ each: true }),
+    IsPositive({ each: true }),
+    __metadata("design:type", Array)
+], GuardiansChangedPayloadDto.prototype, "userIds", void 0);
+__decorate([
+    IsEnum(GuardiansChangedReason),
+    __metadata("design:type", String)
+], GuardiansChangedPayloadDto.prototype, "reason", void 0);
+__decorate([
+    IsISO8601(),
+    __metadata("design:type", String)
+], GuardiansChangedPayloadDto.prototype, "occurredAt", void 0);
+//# sourceMappingURL=guardians-changed-payload.dto.js.map

package/dist/esm/kafka/dtos/user/guardians-changed-payload.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardians-changed-payload.dto.js","sourceRoot":"","sources":["../../../../../src/kafka/dtos/user/guardians-changed-payload.dto.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE5G,sGAAsG;AACtG,MAAM,CAAN,IAAY,sBAaX;AAbD,WAAY,sBAAsB;IAC9B,4BAA4B;IAC5B,yCAAe,CAAA;IACf,uDAAuD;IACvD,6CAAmB,CAAA;IACnB,+CAA+C;IAC/C,6DAAmC,CAAA;IACnC,4HAA4H;IAC5H,+CAAqB,CAAA;IACrB,oFAAoF;IACpF,6CAAmB,CAAA;IACnB,gEAAgE;IAChE,iEAAuC,CAAA;AAC3C,CAAC,EAbW,sBAAsB,KAAtB,sBAAsB,QAajC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,0BAA0B;CAwBtC;AApBG;IAFC,KAAK,EAAE;IACP,UAAU,EAAE;;kEACW;AAKxB;IAFC,KAAK,EAAE;IACP,UAAU,EAAE;;+DACQ;AAQrB;IALC,OAAO,EAAE;IACT,YAAY,CAAC,CAAC,CAAC;IACf,YAAY,CAAC,GAAG,CAAC;IACjB,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;2DACR;AAGnB;IADC,MAAM,CAAC,sBAAsB,CAAC;;0DACC;AAGhC;IADC,SAAS,EAAE;;8DACQ"}

package/dist/esm/kafka/index.js

@@ -8,4 +8,5 @@ export * from './dtos/otp/create-otp-payload.dto';
 export * from './dtos/otp/otp-payload.dto';
 export * from './dtos/password/password-reset-payload.dto';
 export * from './dtos/account-deletion/account-deletion-request-payload.dto';
+export * from './dtos/user/guardians-changed-payload.dto';
 //# sourceMappingURL=index.js.map

package/dist/esm/kafka/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/kafka/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,kBAAkB,CAAC;AACjC,cAAc,6CAA6C,CAAC;AAC5D,cAAc,sCAAsC,CAAC;AACrD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,mCAAmC,CAAC;AAClD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4CAA4C,CAAC;AAC3D,cAAc,8DAA8D,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/kafka/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,kBAAkB,CAAC;AACjC,cAAc,6CAA6C,CAAC;AAC5D,cAAc,sCAAsC,CAAC;AACrD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,mCAAmC,CAAC;AAClD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,4CAA4C,CAAC;AAC3D,cAAc,8DAA8D,CAAC;AAC7E,cAAc,2CAA2C,CAAC"}

package/dist/esm/kafka/topics.js

@@ -9,6 +9,10 @@ export const KAFKA_TOPICS = {
     USER_CREATED: 'user.created',
     USER_UPDATED: 'user.updated',
     USER_DELETED: 'user.deleted',
+    // Somebody's guardians or dependents changed (producer: clarion-authentication;
+    // payload GuardiansChangedPayloadDto; consumer: clarion-notification, which
+    // sends each affected person a silent push so their app refreshes). Ids only.
+    GUARDIANS_CHANGED: 'user.guardians.changed.v1',
     // Org. ORG_CREATED is published by clarion-organization after commit
     // (payload OrganizationCreatedEvent); clarion-incident provisions the Safety
     // Alerts category from it.

package/dist/esm/kafka/topics.js.map

@@ -1 +1 @@
-{"version":3,"file":"topics.js","sourceRoot":"","sources":["../../../src/kafka/topics.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG;IACxB,OAAO;IACP,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,6BAA6B,EAAE,+BAA+B;IAC9D,6BAA6B,EAAE,+BAA+B;IAC9D,OAAO;IACP,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,qEAAqE;IACrE,6EAA6E;IAC7E,2BAA2B;IAC3B,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,MAAM;IACN,YAAY,EAAE,eAAe;IAC7B,aAAa,EAAE,eAAe;IAC9B,WAAW;IACX,cAAc,EAAE,gBAAgB;IAChC,WAAW;IACX,gBAAgB,EAAE,kBAAkB;IACpC,gBAAgB,EAAE,kBAAkB;IACpC,uBAAuB,EAAE,yBAAyB;IAClD,sBAAsB,EAAE,wBAAwB;IAChD,yBAAyB,EAAE,2BAA2B;IACtD,wBAAwB,EAAE,0BAA0B;IACpD,0BAA0B,EAAE,4BAA4B;IACxD,sBAAsB,EAAE,wBAAwB;IAChD,iBAAiB,EAAE,mBAAmB;IACtC,2BAA2B,EAAE,6BAA6B;IAC1D,yCAAyC,EAAE,2CAA2C;IACtF,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,uCAAuC,EAAE,4CAA4C;IACrF,8CAA8C,EAAE,mDAAmD;IACnG,sDAAsD,EAClD,2DAA2D;IAC/D,qEAAqE;IACrE,+BAA+B;IAC/B,0CAA0C,EAAE,4DAA4D;IACxG,OAAO;IACP,oBAAoB,EAAE,sBAAsB;IAC5C,yBAAyB,EAAE,2BAA2B;IACtD,qBAAqB,EAAE,uBAAuB;IAC9C,OAAO;IACP,YAAY,EAAE,cAAc;IAC5B,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,aAAa;IAC1B,OAAO;IACP,iBAAiB,EAAE,mBAAmB;IACtC,oBAAoB,EAAE,sBAAsB;IAC5C,WAAW;IACX,qBAAqB,EAAE,uBAAuB;IAC9C,uBAAuB,EAAE,yBAAyB;IAClD,qBAAqB,EAAE,uBAAuB;IAC9C,sBAAsB,EAAE,wBAAwB;IAChD,qBAAqB,EAAE,uBAAuB;IAC9C,mBAAmB,EAAE,qBAAqB;IAC1C,qBAAqB,EAAE,uBAAuB;IAC9C,oBAAoB,EAAE,sBAAsB;IAC5C,wBAAwB,EAAE,0BAA0B;IACpD,wBAAwB,EAAE,0BAA0B;IACpD,wBAAwB,EAAE,0BAA0B;IACpD,iEAAiE;IACjE,iBAAiB,EAAE,oCAAoC;IACvD,eAAe,EAAE,kCAAkC;IACnD,wBAAwB,EAAE,6BAA6B;IACvD,wBAAwB,EAAE,6BAA6B;IACvD,wBAAwB,EAAE,6BAA6B;IACvD,wEAAwE;IACxE,+DAA+D;IAC/D,yBAAyB,EAAE,uCAAuC;IAClE,yBAAyB,EAAE,uCAAuC;IAClE,yBAAyB,EAAE,uCAAuC;IAClE,wCAAwC,EACpC,sDAAsD;IAC1D,gCAAgC,EAAE,8CAA8C;IAChF,iFAAiF;IACjF,wBAAwB,EAAE,6BAA6B;IACvD,+BAA+B,EAAE,oCAAoC;IACrE,iFAAiF;IACjF,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,iEAAiE;IACjE,sBAAsB,EAAE,2BAA2B;IACnD,sBAAsB,EAAE,2BAA2B;IACnD,uBAAuB,EAAE,4BAA4B;IACrD,6BAA6B,EAAE,kCAAkC;IACjE,+BAA+B,EAAE,oCAAoC;IACrE,8BAA8B,EAAE,mCAAmC;IACnE,+BAA+B,EAAE,oCAAoC;IACrE,4BAA4B,EAAE,iCAAiC;IAC/D,uBAAuB,EAAE,4BAA4B;IACrD,qBAAqB,EAAE,0BAA0B;IACjD,uBAAuB,EAAE,4BAA4B;IACrD,0BAA0B,EAAE,+BAA+B;IAC3D,2BAA2B,EAAE,gCAAgC;IAC7D,wBAAwB,EAAE,6BAA6B;IACvD,wBAAwB,EAAE,6BAA6B;IACvD,yBAAyB,EAAE,8BAA8B;IACzD,0BAA0B,EAAE,+BAA+B;IAC3D,oCAAoC,EAAE,yCAAyC;IAC/E,iCAAiC,EAAE,sCAAsC;IACzE,4BAA4B,EAAE,iCAAiC;IAC/D,+BAA+B,EAAE,oCAAoC;IACrE,wEAAwE;IACxE,8EAA8E;IAC9E,mDAAmD;IACnD,oBAAoB,EAAE,yBAAyB;IAC/C,sBAAsB,EAAE,2BAA2B;IACnD,kBAAkB,EAAE,uBAAuB;IAC3C,0BAA0B,EAAE,+BAA+B;IAC3D,+EAA+E;IAC/E,8DAA8D;IAC9D,iBAAiB,EAAE,6BAA6B;IAChD,4BAA4B,EAAE,wCAAwC;IACtE,mBAAmB,EAAE,+BAA+B;IACpD,uBAAuB,EAAE,mCAAmC;IAC5D,eAAe,EAAE,2BAA2B;IAC5C,2EAA2E;IAC3E,uEAAuE;IACvE,6EAA6E;IAC7E,+BAA+B;IAC/B,qCAAqC,EAAE,0CAA0C;IACjF,oBAAoB,EAAE,yBAAyB;IAC/C,8BAA8B,EAAE,mCAAmC;IACnE,0EAA0E;IAC1E,0EAA0E;IAC1E,yCAAyC,EAAE,8CAA8C;IACzF,sCAAsC,EAAE,wDAAwD;CACnG,CAAC"}
+{"version":3,"file":"topics.js","sourceRoot":"","sources":["../../../src/kafka/topics.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG;IACxB,OAAO;IACP,eAAe,EAAE,iBAAiB;IAClC,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,6BAA6B,EAAE,+BAA+B;IAC9D,6BAA6B,EAAE,+BAA+B;IAC9D,OAAO;IACP,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,YAAY,EAAE,cAAc;IAC5B,gFAAgF;IAChF,4EAA4E;IAC5E,8EAA8E;IAC9E,iBAAiB,EAAE,2BAA2B;IAC9C,qEAAqE;IACrE,6EAA6E;IAC7E,2BAA2B;IAC3B,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,WAAW,EAAE,aAAa;IAC1B,MAAM;IACN,YAAY,EAAE,eAAe;IAC7B,aAAa,EAAE,eAAe;IAC9B,WAAW;IACX,cAAc,EAAE,gBAAgB;IAChC,WAAW;IACX,gBAAgB,EAAE,kBAAkB;IACpC,gBAAgB,EAAE,kBAAkB;IACpC,uBAAuB,EAAE,yBAAyB;IAClD,sBAAsB,EAAE,wBAAwB;IAChD,yBAAyB,EAAE,2BAA2B;IACtD,wBAAwB,EAAE,0BAA0B;IACpD,0BAA0B,EAAE,4BAA4B;IACxD,sBAAsB,EAAE,wBAAwB;IAChD,iBAAiB,EAAE,mBAAmB;IACtC,2BAA2B,EAAE,6BAA6B;IAC1D,yCAAyC,EAAE,2CAA2C;IACtF,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,uCAAuC,EAAE,4CAA4C;IACrF,8CAA8C,EAAE,mDAAmD;IACnG,sDAAsD,EAClD,2DAA2D;IAC/D,qEAAqE;IACrE,+BAA+B;IAC/B,0CAA0C,EAAE,4DAA4D;IACxG,OAAO;IACP,oBAAoB,EAAE,sBAAsB;IAC5C,yBAAyB,EAAE,2BAA2B;IACtD,qBAAqB,EAAE,uBAAuB;IAC9C,OAAO;IACP,YAAY,EAAE,cAAc;IAC5B,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,aAAa;IAC1B,OAAO;IACP,iBAAiB,EAAE,mBAAmB;IACtC,oBAAoB,EAAE,sBAAsB;IAC5C,WAAW;IACX,qBAAqB,EAAE,uBAAuB;IAC9C,uBAAuB,EAAE,yBAAyB;IAClD,qBAAqB,EAAE,uBAAuB;IAC9C,sBAAsB,EAAE,wBAAwB;IAChD,qBAAqB,EAAE,uBAAuB;IAC9C,mBAAmB,EAAE,qBAAqB;IAC1C,qBAAqB,EAAE,uBAAuB;IAC9C,oBAAoB,EAAE,sBAAsB;IAC5C,wBAAwB,EAAE,0BAA0B;IACpD,wBAAwB,EAAE,0BAA0B;IACpD,wBAAwB,EAAE,0BAA0B;IACpD,iEAAiE;IACjE,iBAAiB,EAAE,oCAAoC;IACvD,eAAe,EAAE,kCAAkC;IACnD,wBAAwB,EAAE,6BAA6B;IACvD,wBAAwB,EAAE,6BAA6B;IACvD,wBAAwB,EAAE,6BAA6B;IACvD,wEAAwE;IACxE,+DAA+D;IAC/D,yBAAyB,EAAE,uCAAuC;IAClE,yBAAyB,EAAE,uCAAuC;IAClE,yBAAyB,EAAE,uCAAuC;IAClE,wCAAwC,EACpC,sDAAsD;IAC1D,gCAAgC,EAAE,8CAA8C;IAChF,iFAAiF;IACjF,wBAAwB,EAAE,6BAA6B;IACvD,+BAA+B,EAAE,oCAAoC;IACrE,iFAAiF;IACjF,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,iEAAiE;IACjE,sBAAsB,EAAE,2BAA2B;IACnD,sBAAsB,EAAE,2BAA2B;IACnD,uBAAuB,EAAE,4BAA4B;IACrD,6BAA6B,EAAE,kCAAkC;IACjE,+BAA+B,EAAE,oCAAoC;IACrE,8BAA8B,EAAE,mCAAmC;IACnE,+BAA+B,EAAE,oCAAoC;IACrE,4BAA4B,EAAE,iCAAiC;IAC/D,uBAAuB,EAAE,4BAA4B;IACrD,qBAAqB,EAAE,0BAA0B;IACjD,uBAAuB,EAAE,4BAA4B;IACrD,0BAA0B,EAAE,+BAA+B;IAC3D,2BAA2B,EAAE,gCAAgC;IAC7D,wBAAwB,EAAE,6BAA6B;IACvD,wBAAwB,EAAE,6BAA6B;IACvD,yBAAyB,EAAE,8BAA8B;IACzD,0BAA0B,EAAE,+BAA+B;IAC3D,oCAAoC,EAAE,yCAAyC;IAC/E,iCAAiC,EAAE,sCAAsC;IACzE,4BAA4B,EAAE,iCAAiC;IAC/D,+BAA+B,EAAE,oCAAoC;IACrE,wEAAwE;IACxE,8EAA8E;IAC9E,mDAAmD;IACnD,oBAAoB,EAAE,yBAAyB;IAC/C,sBAAsB,EAAE,2BAA2B;IACnD,kBAAkB,EAAE,uBAAuB;IAC3C,0BAA0B,EAAE,+BAA+B;IAC3D,+EAA+E;IAC/E,8DAA8D;IAC9D,iBAAiB,EAAE,6BAA6B;IAChD,4BAA4B,EAAE,wCAAwC;IACtE,mBAAmB,EAAE,+BAA+B;IACpD,uBAAuB,EAAE,mCAAmC;IAC5D,eAAe,EAAE,2BAA2B;IAC5C,2EAA2E;IAC3E,uEAAuE;IACvE,6EAA6E;IAC7E,+BAA+B;IAC/B,qCAAqC,EAAE,0CAA0C;IACjF,oBAAoB,EAAE,yBAAyB;IAC/C,8BAA8B,EAAE,mCAAmC;IACnE,0EAA0E;IAC1E,0EAA0E;IAC1E,yCAAyC,EAAE,8CAA8C;IACzF,sCAAsC,EAAE,wDAAwD;CACnG,CAAC"}

package/dist/esm/modules/user/dtos/guardian-identifier.dto.js

@@ -13,7 +13,7 @@ export class GuardianIdentifierDto {
 }
 __decorate([
     ApiProperty({
-        description: 'Phone number for external guardian',
+        description: 'Phone number of an external guardian (older apps). Prefer relationshipId, which names either kind.',
         example: '+1234567890',
         required: false,
         type: 'string'
@@ -24,7 +24,7 @@ __decorate([
 ], GuardianIdentifierDto.prototype, "phoneNumber", void 0);
 __decorate([
     ApiProperty({
-        description: 'Relationship ID for system guardian',
+        description: 'The guardian entry id - `id` of an app-user guardian relation or of an external guardian (since grm-shared-library 1.1.248)',
         example: 789,
         required: false,
         type: 'number'

package/dist/esm/modules/user/dtos/guardian-identifier.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"guardian-identifier.dto.js","sourceRoot":"","sources":["../../../../../src/modules/user/dtos/guardian-identifier.dto.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAc,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7E,MAAM,OAAO,qBAAqB;CAoBjC;AAXG;IARC,WAAW,CAAC;QACT,WAAW,EAAE,oCAAoC;QACjD,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,QAAQ;KACjB,CAAC;IACD,QAAQ,EAAE;IACV,UAAU,EAAE;;0DACQ;AAUrB;IARC,WAAW,CAAC;QACT,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,QAAQ;KACjB,CAAC;IACD,QAAQ,EAAE;IACV,UAAU,EAAE;;6DACW"}
+{"version":3,"file":"guardian-identifier.dto.js","sourceRoot":"","sources":["../../../../../src/modules/user/dtos/guardian-identifier.dto.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAc,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE7E,MAAM,OAAO,qBAAqB;CAoBjC;AAXG;IARC,WAAW,CAAC;QACT,WAAW,EAAE,oGAAoG;QACjH,OAAO,EAAE,aAAa;QACtB,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,QAAQ;KACjB,CAAC;IACD,QAAQ,EAAE;IACV,UAAU,EAAE;;0DACQ;AAUrB;IARC,WAAW,CAAC;QACT,WAAW,EAAE,6HAA6H;QAC1I,OAAO,EAAE,GAAG;QACZ,QAAQ,EAAE,KAAK;QACf,IAAI,EAAE,QAAQ;KACjB,CAAC;IACD,QAAQ,EAAE;IACV,UAAU,EAAE;;6DACW"}

package/dist/esm/modules/user/index.js

@@ -16,4 +16,5 @@ export * from './interfaces/guardian';
 export * from './interfaces/guardian-relation';
 export * from './interfaces/guardians-response';
 export * from './interfaces/account-analytics';
+export * from './utils/app-account.util';
 //# sourceMappingURL=index.js.map

package/dist/esm/modules/user/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/modules/user/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,qCAAqC,CAAC;AACpD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AAEvD,cAAc,0BAA0B,CAAC;AACzC,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AAEtD,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/modules/user/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAC;AACvC,cAAc,wBAAwB,CAAC;AACvC,cAAc,qBAAqB,CAAC;AACpC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,qCAAqC,CAAC;AACpD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,8CAA8C,CAAC;AAC7D,cAAc,wCAAwC,CAAC;AAEvD,cAAc,0BAA0B,CAAC;AACzC,cAAc,oCAAoC,CAAC;AACnD,cAAc,uCAAuC,CAAC;AAEtD,cAAc,mBAAmB,CAAC;AAClC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,2BAA2B,CAAC;AAC1C,cAAc,uBAAuB,CAAC;AACtC,cAAc,gCAAgC,CAAC;AAC/C,cAAc,iCAAiC,CAAC;AAChD,cAAc,gCAAgC,CAAC;AAE/C,cAAc,0BAA0B,CAAC"}

package/dist/esm/modules/user/utils/app-account.util.js

@@ -0,0 +1,83 @@
+import { Roles } from '../../role/enums/role.enum';
+/**
+ * App accounts and staff accounts.
+ *
+ * Each brand's mobile app (G4S Kenya, GeoSHIELD, SGA Security, ...) is its own
+ * product for one organization's customers, so an account made in one app is an
+ * account with that organization only. Signing in to another brand's app means
+ * registering with that brand. One person may therefore hold several app
+ * accounts - one per organization - with the same phone number and e-mail.
+ *
+ * Staff (Super-Admin, organization and control-centre staff, responders,
+ * corporate-client admins) keep one platform-wide account each: their e-mail and
+ * phone number stay unique across the whole platform.
+ *
+ * An APP ACCOUNT is one whose only role is Mobile-User. That is the same rule the
+ * database's unique indexes use (`roles = '{Mobile-User}'`), so code and schema
+ * can never disagree about which kind an account is. An account holding
+ * Mobile-User beside a staff role is a staff account that also uses an app.
+ */
+export const APP_ACCOUNT_ROLE = Roles.MOBILE_USER;
+/** An account whose only role is Mobile-User: unique within its organization, not platform-wide. */
+export function isAppAccount(roles) {
+    return Array.isArray(roles) && roles.length === 1 && roles[0] === APP_ACCOUNT_ROLE;
+}
+/** Holds the Mobile-User role, alone or beside staff roles: someone who can use a brand's app. */
+export function hasAppRole(roles) {
+    return Array.isArray(roles) && roles.includes(APP_ACCOUNT_ROLE);
+}
+/**
+ * Parses `APP_ORGANIZATIONS`. Blank means "none configured". A malformed entry
+ * throws: a typo here would let an app sign people in to the wrong organization,
+ * so it must stop the service at boot rather than be skipped.
+ */
+export function parseAppOrganizations(raw) {
+    const map = new Map();
+    for (const entry of String(raw !== null && raw !== void 0 ? raw : '').split(',')) {
+        const trimmed = entry.trim();
+        if (!trimmed)
+            continue;
+        const match = /^([A-Za-z0-9_-]+)\s*:\s*(\d+)$/.exec(trimmed);
+        if (!match)
+            throw new Error(`APP_ORGANIZATIONS: "${trimmed}" is not <appId>:<organizationId>`);
+        const [, appId, id] = match;
+        const organizationId = Number(id);
+        if (!Number.isSafeInteger(organizationId) || organizationId <= 0) {
+            throw new Error(`APP_ORGANIZATIONS: "${trimmed}" names no valid organization`);
+        }
+        const existing = map.get(appId);
+        if (existing !== undefined && existing !== organizationId) {
+            throw new Error(`APP_ORGANIZATIONS: ${appId} is given two organizations (${existing} and ${organizationId})`);
+        }
+        map.set(appId, organizationId);
+    }
+    return map;
+}
+/**
+ * Whether a signed-in account is being used from another organization's app: the
+ * request names an app (`X-App-Id`) that belongs to organization A, and the account
+ * is an app user of organization B.
+ *
+ * Unknown here means "not a mismatch": no app named, an app with no configured
+ * organization, or an account that is staff only. Those keep working as before.
+ */
+export function isAccountFromAnotherApp(appOrganizations, appId, account) {
+    if (!appId)
+        return false;
+    const expected = appOrganizations.get(appId);
+    if (expected === undefined)
+        return false;
+    if (!hasAppRole(account.roles))
+        return false;
+    return Number(account.organizationId) !== expected;
+}
+/** Error codes a client can act on, for the account rules above. */
+export const APP_ACCOUNT_ERROR_CODES = {
+    /** A token or session belongs to another organization's app: sign out and sign in again here. */
+    APP_ACCOUNT_MISMATCH: 'APP_ACCOUNT_MISMATCH',
+    /** A sign-in names an app and an organization that do not belong together. */
+    APP_ORGANIZATION_MISMATCH: 'APP_ORGANIZATION_MISMATCH',
+    /** An older app asked for "the" account of a number that has accounts with several organizations. */
+    ACCOUNT_AMBIGUOUS: 'ACCOUNT_AMBIGUOUS',
+};
+//# sourceMappingURL=app-account.util.js.map

package/dist/esm/modules/user/utils/app-account.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-account.util.js","sourceRoot":"","sources":["../../../../../src/modules/user/utils/app-account.util.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAEnD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC,WAAW,CAAC;AAElD,oGAAoG;AACpG,MAAM,UAAU,YAAY,CAAC,KAA2C;IACpE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,gBAAgB,CAAC;AACvF,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,UAAU,CAAC,KAA2C;IAClE,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AACpE,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAA8B;IAChE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,KAAK,GAAG,gCAAgC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,mCAAmC,CAAC,CAAC;QAC/F,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;QAC5B,MAAM,cAAc,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,IAAI,cAAc,IAAI,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,uBAAuB,OAAO,+BAA+B,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,gCAAgC,QAAQ,QAAQ,cAAc,GAAG,CAAC,CAAC;QAClH,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACnC,gBAAkC,EAClC,KAAgC,EAChC,OAAsF;IAEtF,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,OAAO,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC;AACvD,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACnC,iGAAiG;IACjG,oBAAoB,EAAE,sBAAsB;IAC5C,8EAA8E;IAC9E,yBAAyB,EAAE,2BAA2B;IACtD,qGAAqG;IACrG,iBAAiB,EAAE,mBAAmB;CAChC,CAAC"}

package/dist/types/kafka/dtos/user/guardians-changed-payload.dto.d.ts

@@ -0,0 +1,32 @@
+/** What changed about somebody's guardians - for logs and analytics; every reason means "refresh". */
+export declare enum GuardiansChangedReason {
+    /** A guardian was added. */
+    ADDED = "ADDED",
+    /** A guardian was removed by the person they guard. */
+    REMOVED = "REMOVED",
+    /** Another guardian became the primary one. */
+    PRIMARY_CHANGED = "PRIMARY_CHANGED",
+    /** A guardian on the list by phone number proved that number in the same organization's app, and is now an app guardian. */
+    PROMOTED = "PROMOTED",
+    /** An app guardian's account was deleted; they stay on the list by phone number. */
+    DEMOTED = "DEMOTED",
+    /** A guardian stopped looking after one of their dependents. */
+    DEPENDENT_REMOVED = "DEPENDENT_REMOVED"
+}
+/**
+ * Payload of `KAFKA_TOPICS.GUARDIANS_CHANGED`: somebody's guardian list changed,
+ * and these people's apps should read their guardians and dependents again.
+ *
+ * Ids only - no names, numbers or relationships. The apps read the lists through
+ * the guardian API, which applies its own access rules.
+ */
+export declare class GuardiansChangedPayloadDto {
+    /** The organization whose app the people use. Pushes go only to devices of this organization. */
+    organizationId: number;
+    /** Whose guardian list changed. */
+    dependentId: number;
+    /** Every app user whose guardians or dependents changed: the dependent and any app guardian involved. */
+    userIds: number[];
+    reason: GuardiansChangedReason;
+    occurredAt: string;
+}

package/dist/types/kafka/index.d.ts

@@ -8,3 +8,4 @@ export * from './dtos/otp/create-otp-payload.dto';
 export * from './dtos/otp/otp-payload.dto';
 export * from './dtos/password/password-reset-payload.dto';
 export * from './dtos/account-deletion/account-deletion-request-payload.dto';
+export * from './dtos/user/guardians-changed-payload.dto';

package/dist/types/kafka/topics.d.ts

@@ -7,6 +7,7 @@ export declare const KAFKA_TOPICS: {
     USER_CREATED: string;
     USER_UPDATED: string;
     USER_DELETED: string;
+    GUARDIANS_CHANGED: string;
     ORG_CREATED: string;
     ORG_UPDATED: string;
     ORG_DELETED: string;

package/dist/types/modules/user/index.d.ts

@@ -16,3 +16,4 @@ export * from './interfaces/guardian';
 export * from './interfaces/guardian-relation';
 export * from './interfaces/guardians-response';
 export * from './interfaces/account-analytics';
+export * from './utils/app-account.util';

package/dist/types/modules/user/interfaces/account-analytics.d.ts

@@ -61,7 +61,7 @@ export interface AccountAnalyticsKindRow {
 /** Of the accounts created in the period, how far each got - as they stand now. */
 export interface AccountAnalyticsFunnel {
     created: number;
-    /** Confirmed their phone or e-mail with a one-time code. */
+    /** Proved their phone or e-mail: a sign-in code, Google or Apple (the older app: its one-time code). */
     verified: number;
     acceptedTerms: number;
     /** Signed in at least once. */
@@ -84,7 +84,7 @@ export interface AccountAnalyticsAccounts {
     /** Active accounts that were created in an earlier period. */
     returning: number;
     funnel: AccountAnalyticsFunnel;
-    /** Now: never confirmed their phone or e-mail with a one-time code. */
+    /** Now: never proved their phone or e-mail (see `AccountAnalyticsFunnel.verified`). */
     pendingNow: number;
     /** Now: never signed in. */
     neverSignedIn: number;
@@ -104,12 +104,16 @@ export interface AccountAnalyticsAccounts {
     recency: AccountAnalyticsCount<AccountRecencyBand>[];
 }
 /**
- * How somebody signed in:
- *  - PASSWORD  e-mail and password (the admin and the web);
- *  - OTP       phone number and a one-time code (the app);
- *  - REVIEWER  the app-store reviewers' account.
+ * How somebody signed in - or, for a sign-up, made their account:
+ *  - PASSWORD    e-mail and password (the admin and the web);
+ *  - OTP         the older app (before 1.0.18): phone number and one code sent by SMS and e-mail together;
+ *  - PHONE_CODE  a code to the phone by SMS or a call, or a WhatsApp message from it - proves the number;
+ *  - EMAIL_CODE  a code to the e-mail - proves the e-mail only;
+ *  - GOOGLE      Google vouches for the e-mail;
+ *  - APPLE       Apple vouches for the e-mail (possibly a private relay address);
+ *  - REVIEWER    the app-store reviewers' account.
  */
-export type AccountSignInMethod = 'PASSWORD' | 'OTP' | 'REVIEWER';
+export type AccountSignInMethod = 'PASSWORD' | 'OTP' | 'PHONE_CODE' | 'EMAIL_CODE' | 'GOOGLE' | 'APPLE' | 'REVIEWER';
 export interface AccountAnalyticsMethodRow {
     method: string;
     succeeded: number;
@@ -127,8 +131,13 @@ export interface AccountAnalyticsSignIns {
     firstSignIns: number;
     /** Failed for an e-mail or a code that matches no account (counted, never stored). */
     unknownAccount: number;
+    /**
+     * By AccountSignInMethod. A wrong phone or e-mail code is not a failed sign-in - it is
+     * counted with the codes (`AccountAnalyticsVerificationCodes`) - so PHONE_CODE and
+     * EMAIL_CODE fail only for a switched-off account.
+     */
     byMethod: AccountAnalyticsMethodRow[];
-    /** INVALID_CREDENTIALS, UNVERIFIED, UNKNOWN_ACCOUNT, INVALID_TOKEN, ERROR... */
+    /** INVALID_CREDENTIALS, UNVERIFIED, UNKNOWN_ACCOUNT, INVALID_TOKEN, INVALID_ID_TOKEN, DISABLED, EMAIL_IN_USE, EMAIL_REQUIRED, ERROR... */
     failureReasons: AccountAnalyticsCount[];
     averageDailyUsers: number;
     peakDailyUsers: number;
@@ -141,6 +150,11 @@ export interface AccountAnalyticsOtpActionRow {
     sent: number;
     verified: number;
 }
+/**
+ * The older app's one-time codes (before 1.0.18): one code to the e-mail and the phone
+ * together, for signing up, in and confirming. The current app's codes are in
+ * `AccountAnalyticsSignInOptions.codes`.
+ */
 export interface AccountAnalyticsOtp {
     /** First sends and resends. */
     sent: number;
@@ -237,6 +251,166 @@ export interface AccountAnalyticsPrevious {
     deletionRequests: number;
     guardianLinks: number;
 }
+/** How a code travels. SMS and VOICE carry it to the phone; WHATSAPP is the person messaging us FROM the phone; EMAIL. */
+export type AccountVerificationChannel = 'SMS' | 'VOICE' | 'WHATSAPP' | 'EMAIL';
+/** What a code is for: signing in (or up), or proving the phone number of an account already signed in. */
+export type AccountVerificationPurpose = 'SIGN_IN' | 'VERIFY_PHONE';
+/** One channel's codes for one purpose, in the period. */
+export interface AccountAnalyticsCodeChannelRow {
+    purpose: AccountVerificationPurpose | string;
+    channel: AccountVerificationChannel | string;
+    /** Codes sent - for WhatsApp, the message the person was asked to send us. */
+    sent: number;
+    /** Refused before anything was sent: asked for too often, a number already on another account, a channel that cannot reach it. */
+    refused: number;
+    /** The SMS or call provider could not take it. The app offers the other channels. */
+    notDelivered: number;
+    confirmed: number;
+    wrongCode: number;
+    expired: number;
+    /** WhatsApp: the message came from a number other than the one being proven. */
+    wrongNumber: number;
+    /** confirmed / sent; null with none sent. */
+    confirmationRate: number | null;
+}
+/** Codes by the country of the number (or of the app, for an e-mail code) and channel, in the period. */
+export interface AccountAnalyticsCodeCountryRow {
+    /** KE, UG, TZ - or UNKNOWN. */
+    country: string;
+    channel: AccountVerificationChannel | string;
+    sent: number;
+    notDelivered: number;
+    confirmed: number;
+}
+/** The current app's codes (1.0.18 on): to the phone only, or to the e-mail only - never both. */
+export interface AccountAnalyticsVerificationCodes {
+    sent: number;
+    refused: number;
+    notDelivered: number;
+    confirmed: number;
+    wrongCode: number;
+    expired: number;
+    wrongNumber: number;
+    confirmationRate: number | null;
+    /** Biggest first. */
+    byChannel: AccountAnalyticsCodeChannelRow[];
+    byCountry: AccountAnalyticsCodeCountryRow[];
+    /** Why codes were refused: RATE_LIMITED, PHONE_IN_USE, CHANNEL_UNAVAILABLE. */
+    refusals: AccountAnalyticsCount[];
+}
+/** App users making their own account, in the period. */
+export interface AccountAnalyticsSignUps {
+    /** A phone or e-mail code confirmed that matched no account: the app showed the short sign-up form. */
+    formsStarted: number;
+    /** Accounts made from that form. Google and Apple make the account straight away, with no form. */
+    formsCompleted: number;
+    /** formsCompleted / formsStarted; null with none started. */
+    completionRate: number | null;
+    /** Sign-ups refused - the e-mail or number already has an account, the form came back too late. */
+    refused: number;
+    /** EMAIL_IN_USE, PHONE_IN_USE, EMAIL_REQUIRED, REGISTRATION_EXPIRED. */
+    failureReasons: AccountAnalyticsCount[];
+    /**
+     * App (Mobile-User) accounts created in the period, by how: PHONE_CODE, EMAIL_CODE,
+     * GOOGLE, APPLE, OTP (the older app) - and OTHER: made for the person (a corporate
+     * member, a partner's caller) or before sign-ups were recorded.
+     */
+    byMethod: AccountAnalyticsCount[];
+}
+export interface AccountAnalyticsPhoneCountryRow {
+    country: string;
+    appUsers: number;
+    verified: number;
+    unverified: number;
+    noNumber: number;
+}
+/**
+ * App users' phone numbers - the number a responder calls - as they stand now. A number
+ * is verified only when a code to it, or a WhatsApp message from it, proved it; a number
+ * saved with "Verify later" is shown to the dispatcher as not verified.
+ */
+export interface AccountAnalyticsPhoneNumbers {
+    appUsers: number;
+    withNumber: number;
+    verified: number;
+    unverified: number;
+    noNumber: number;
+    /** verified / appUsers; null with none. */
+    verifiedRate: number | null;
+    /**
+     * Every app user once: how the number was proven - SMS, VOICE, WHATSAPP, LEGACY_OTP (the
+     * older app's code, counted where its SMS always arrived) - or UNVERIFIED, or NONE.
+     */
+    byState: AccountAnalyticsCount[];
+    byCountry: AccountAnalyticsPhoneCountryRow[];
+    /** In the period: numbers proven by somebody already signed in (after Google, Apple or an e-mail code), by channel. */
+    verifiedInPeriod: AccountAnalyticsCount[];
+    /** In the period: "Verify later" - a number saved without proving it. */
+    deferred: number;
+    /** Now: app users whose e-mail is proven (an e-mail code, Google or Apple). */
+    emailVerified: number;
+}
+/** Google or Apple. */
+export interface AccountAnalyticsProviderRow {
+    provider: 'GOOGLE' | 'APPLE' | string;
+    /** Accounts linked to it now. */
+    linkedAccounts: number;
+    /** In the period. */
+    signIns: number;
+    /** Accounts it created, in the period. */
+    newAccounts: number;
+    /** Linked to an account that already had the same proven e-mail, in the period. */
+    linkedExisting: number;
+    /** The provider's token did not check out, or the account could not be used (switched off, e-mail taken or missing). */
+    failed: number;
+}
+/** Sign-ins in one country by one way in, in the period. */
+export interface AccountAnalyticsMethodCountryRow {
+    /** The account's country (KE, UG, TZ), or UNKNOWN. */
+    country: string;
+    method: AccountSignInMethod | string;
+    signIns: number;
+}
+export interface AccountAnalyticsSignInOptionsPoint {
+    /** As `AccountAnalyticsPoint.bucket`. */
+    bucket: string;
+    /** Successful sign-ins in the bucket by AccountSignInMethod; methods with none are left out. */
+    byMethod: Record<string, number>;
+    /** The current app's codes. */
+    codesSent: number;
+    codesConfirmed: number;
+}
+/** The same figures for the previous period of the same length. */
+export interface AccountAnalyticsSignInOptionsPrevious {
+    /** Sign-ins by PHONE_CODE, EMAIL_CODE, GOOGLE or APPLE. */
+    currentAppSignIns: number;
+    /** Sign-ins by the older app's code (OTP). */
+    olderAppSignIns: number;
+    codesSent: number;
+    codesConfirmed: number;
+    phonesVerified: number;
+    deferred: number;
+    formsCompleted: number;
+}
+/**
+ * The ways into the app since 1.0.18 - a code to the phone (SMS, a call, WhatsApp), a code
+ * to the e-mail, Google, Apple - next to the older app's SMS-and-e-mail code, and whether
+ * the phone numbers responders call are proven.
+ */
+export interface AccountAnalyticsSignInOptions {
+    /** People who signed in during the period, each by the way they signed in LAST. */
+    lastMethodUsed: AccountAnalyticsCount[];
+    byCountry: AccountAnalyticsMethodCountryRow[];
+    /** One point per bucket, as `AccountAnalytics.timeline`. */
+    timeline: AccountAnalyticsSignInOptionsPoint[];
+    codes: AccountAnalyticsVerificationCodes;
+    signUps: AccountAnalyticsSignUps;
+    phones: AccountAnalyticsPhoneNumbers;
+    /** GOOGLE and APPLE, always both. */
+    providers: AccountAnalyticsProviderRow[];
+    /** Absent for "forever". */
+    previous: AccountAnalyticsSignInOptionsPrevious | null;
+}
 /** A Super-Admin's view of every organization: one row each, biggest first. */
 export interface AccountAnalyticsOrganizationRow {
     organizationId: number;
@@ -266,6 +440,8 @@ export interface AccountAnalytics {
     passwords: AccountAnalyticsPasswords;
     guardians: AccountAnalyticsGuardians;
     deletions: AccountAnalyticsDeletions;
+    /** The ways into the app, codes by channel and proven phone numbers. Absent only from a clarion-authentication older than this field. */
+    signInOptions?: AccountAnalyticsSignInOptions;
     /** A Super-Admin looking at every organization only. */
     byOrganization?: AccountAnalyticsOrganizationRow[];
 }

package/dist/types/modules/user/interfaces/guardian.d.ts

@@ -1,5 +1,12 @@
 import { GuardianRelationship } from "../enums/guardian-relationship.enum";
 export interface Guardian {
+    /**
+     * The guardian entry's own id. External and app-user guardians share one table
+     * and one id space, so either kind can be removed or made primary by it
+     * (`GuardianIdentifierDto.relationshipId`). Absent only from responses of
+     * clarion-authentication builds older than grm-shared-library 1.1.248.
+     */
+    id?: number;
     userId?: number;
     name: string;
     phoneNumber: string;

package/dist/types/modules/user/utils/app-account.util.d.ts

@@ -0,0 +1,59 @@
+import { Roles } from '../../role/enums/role.enum';
+/**
+ * App accounts and staff accounts.
+ *
+ * Each brand's mobile app (G4S Kenya, GeoSHIELD, SGA Security, ...) is its own
+ * product for one organization's customers, so an account made in one app is an
+ * account with that organization only. Signing in to another brand's app means
+ * registering with that brand. One person may therefore hold several app
+ * accounts - one per organization - with the same phone number and e-mail.
+ *
+ * Staff (Super-Admin, organization and control-centre staff, responders,
+ * corporate-client admins) keep one platform-wide account each: their e-mail and
+ * phone number stay unique across the whole platform.
+ *
+ * An APP ACCOUNT is one whose only role is Mobile-User. That is the same rule the
+ * database's unique indexes use (`roles = '{Mobile-User}'`), so code and schema
+ * can never disagree about which kind an account is. An account holding
+ * Mobile-User beside a staff role is a staff account that also uses an app.
+ */
+export declare const APP_ACCOUNT_ROLE = Roles.MOBILE_USER;
+/** An account whose only role is Mobile-User: unique within its organization, not platform-wide. */
+export declare function isAppAccount(roles: readonly string[] | null | undefined): boolean;
+/** Holds the Mobile-User role, alone or beside staff roles: someone who can use a brand's app. */
+export declare function hasAppRole(roles: readonly string[] | null | undefined): boolean;
+/**
+ * Which organization each brand's app belongs to, as configured in
+ * `APP_ORGANIZATIONS` - for example `GardaWorld:48,G4S:49,SGA:51`. The ids differ
+ * per environment (Dev has its own organizations), which is why this is
+ * configuration and not code.
+ */
+export type AppOrganizations = ReadonlyMap<string, number>;
+/**
+ * Parses `APP_ORGANIZATIONS`. Blank means "none configured". A malformed entry
+ * throws: a typo here would let an app sign people in to the wrong organization,
+ * so it must stop the service at boot rather than be skipped.
+ */
+export declare function parseAppOrganizations(raw: string | null | undefined): AppOrganizations;
+/**
+ * Whether a signed-in account is being used from another organization's app: the
+ * request names an app (`X-App-Id`) that belongs to organization A, and the account
+ * is an app user of organization B.
+ *
+ * Unknown here means "not a mismatch": no app named, an app with no configured
+ * organization, or an account that is staff only. Those keep working as before.
+ */
+export declare function isAccountFromAnotherApp(appOrganizations: AppOrganizations, appId: string | null | undefined, account: {
+    roles?: readonly string[] | null;
+    organizationId?: number | string | null;
+}): boolean;
+/** Error codes a client can act on, for the account rules above. */
+export declare const APP_ACCOUNT_ERROR_CODES: {
+    /** A token or session belongs to another organization's app: sign out and sign in again here. */
+    readonly APP_ACCOUNT_MISMATCH: "APP_ACCOUNT_MISMATCH";
+    /** A sign-in names an app and an organization that do not belong together. */
+    readonly APP_ORGANIZATION_MISMATCH: "APP_ORGANIZATION_MISMATCH";
+    /** An older app asked for "the" account of a number that has accounts with several organizations. */
+    readonly ACCOUNT_AMBIGUOUS: "ACCOUNT_AMBIGUOUS";
+};
+export type AppAccountErrorCode = typeof APP_ACCOUNT_ERROR_CODES[keyof typeof APP_ACCOUNT_ERROR_CODES];

package/package.json

@@ -1,72 +1,72 @@
-{
-  "name": "grm-shared-library",
-  "version": "1.1.246",
-  "main": "dist/cjs/index.js",
-  "module": "dist/esm/index.js",
-  "types": "dist/types/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/types/index.d.ts",
-      "import": "./dist/esm/index.js",
-      "require": "./dist/cjs/index.js"
-    },
-    "./dist/modules/*": {
-      "types": "./dist/types/modules/*.d.ts",
-      "import": "./dist/esm/modules/*.js",
-      "require": "./dist/cjs/modules/*.js"
-    }
-  },
-  "files": [
-    "dist/**/*"
-  ],
-  "scripts": {
-    "clean": "rimraf dist dist-test",
-    "build:cjs": "tsc -p tsconfig.cjs.json",
-    "build:esm": "tsc -p tsconfig.esm.json",
-    "build:types": "tsc -p tsconfig.types.json",
-    "build": "npm run clean && npm run build:types && npm run build:cjs && npm run build:esm",
-    "prepublishOnly": "npm run build",
-    "pretest": "rimraf dist-test",
-    "test": "tsc -p tsconfig.spec.json && node --test \"dist-test/**/*.spec.js\""
-  },
-  "keywords": [],
-  "author": "",
-  "license": "ISC",
-  "description": "",
-  "publishConfig": {
-    "access": "public"
-  },
-  "devDependencies": {
-    "@types/express": "^5.0.3",
-    "@types/geojson": "^7946.0.14",
-    "@types/node": "^22.10.5",
-    "rimraf": "^5.0.5",
-    "typescript": "^5.7.3"
-  },
-  "dependencies": {
-    "@nestjs/common": "^11.0.0",
-    "@nestjs/core": "^11.0.0",
-    "@nestjs/mapped-types": "^2.0.6",
-    "@nestjs/microservices": "^11.0.0",
-    "@nestjs/swagger": "^11.2.0",
-    "@sentry/node": "^8.0.0",
-    "class-transformer": "^0.5.0",
-    "class-validator": "^0.14.0",
-    "express": "^5.1.0",
-    "geojson": "^0.5.0",
-    "grm-shared-library": "^1.1.101",
-    "libphonenumber-js": "^1.13.8",
-    "rxjs": "^7.8.2",
-    "swagger-ui-express": "^5.0.1",
-    "@nestjs/config": "^4.0.0"
-  },
-  "peerDependencies": {
-    "@nestjs/common": "^11.0.0",
-    "@nestjs/core": "^11.0.0",
-    "@nestjs/microservices": "^11.0.0",
-    "@sentry/node": "^8.0.0",
-    "class-transformer": "^0.5.0",
-    "class-validator": "^0.14.0",
-    "@nestjs/config": "^4.0.0"
-  }
-}
+{
+  "name": "grm-shared-library",
+  "version": "1.1.248",
+  "main": "dist/cjs/index.js",
+  "module": "dist/esm/index.js",
+  "types": "dist/types/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/types/index.d.ts",
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.js"
+    },
+    "./dist/modules/*": {
+      "types": "./dist/types/modules/*.d.ts",
+      "import": "./dist/esm/modules/*.js",
+      "require": "./dist/cjs/modules/*.js"
+    }
+  },
+  "files": [
+    "dist/**/*"
+  ],
+  "scripts": {
+    "clean": "rimraf dist dist-test",
+    "build:cjs": "tsc -p tsconfig.cjs.json",
+    "build:esm": "tsc -p tsconfig.esm.json",
+    "build:types": "tsc -p tsconfig.types.json",
+    "build": "npm run clean && npm run build:types && npm run build:cjs && npm run build:esm",
+    "prepublishOnly": "npm run build",
+    "pretest": "rimraf dist-test",
+    "test": "tsc -p tsconfig.spec.json && node --test \"dist-test/**/*.spec.js\""
+  },
+  "keywords": [],
+  "author": "",
+  "license": "ISC",
+  "description": "",
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.3",
+    "@types/geojson": "^7946.0.14",
+    "@types/node": "^22.10.5",
+    "rimraf": "^5.0.5",
+    "typescript": "^5.7.3"
+  },
+  "dependencies": {
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/config": "^4.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@nestjs/mapped-types": "^2.0.6",
+    "@nestjs/microservices": "^11.0.0",
+    "@nestjs/swagger": "^11.2.0",
+    "@sentry/node": "^8.0.0",
+    "class-transformer": "^0.5.0",
+    "class-validator": "^0.14.0",
+    "express": "^5.1.0",
+    "geojson": "^0.5.0",
+    "grm-shared-library": "^1.1.101",
+    "libphonenumber-js": "^1.13.8",
+    "rxjs": "^7.8.2",
+    "swagger-ui-express": "^5.0.1"
+  },
+  "peerDependencies": {
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/config": "^4.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@nestjs/microservices": "^11.0.0",
+    "@sentry/node": "^8.0.0",
+    "class-transformer": "^0.5.0",
+    "class-validator": "^0.14.0"
+  }
+}